Tom's Guide > Forum > Sécurité - Virus > Pubs et awtqrqq & awvvw.dll [Résolu]

Pubs et awtqrqq & awvvw.dll [Résolu]

Forum Sécurité - Virus : Pubs et awtqrqq & awvvw.dll [Résolu]

TomsGuide.com : 800 000 inscrits répondent à toutes vos questions high-tech et informatique. Pour obtenir de l'aide, inscrivez-vous gratuitement !
Créer un nouveau sujet Répondre
Mot :    Pseudo :           
 
loys@IDN   01-12-2007 à 15:57:42

Bonjour à tous. Cela fait un bon moment que mon ordinateur est, je pense, infecté.
J'explique mon probleme:
En naviguant sur internet avec mozilla firefox, j'ai beaucoup de pop up qui s'ouvrent pour m'afficher des pubs (immobilier, la redoute, centre de sécurité windows ... ect ).
Aussi, mon antivirus (Nod32) me prévient souvent de deux infections, mais il n'arrive jamais à les supprimer :

Code :
  1. c:\windows\system32\awtqrqq.dll - probablement une variante de  Win32/Genetik  cheval de Troie
  2. c:\windows\system32\awvvw.dll - Win32/Adware.Virtumonde application


J'ai aussi remarqué que le mode sans échec de mon PC ne fonctionne plus; apres avoir ouvert ma session, il affiche le bureau quelques secondes, les icones et la bare des taches disparaissent, il ne reste que l'écran noir avec écrit " Mode sans échec" dans chaque coin.

J'espere que vous pourrez m'aider.
Merci d'avance pour votre aide :).


Message édité par loys@IDN le 06-12-2007 à 20:39:42
Répondre
Liens sponsorisés
Inscrivez-vous ou connectez-vous pour masquer ceci.
XmichouX   01-12-2007 à 16:57:04
- 0 +

Salut,

Télécharge Hijackthis (de Trend Micro)
Poste un rapport en suivant ce tuto.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   01-12-2007 à 18:53:08
- 0 +

Salut, merci beaucoup pour ton aide :)

Voila mon rapport HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:51:26, on 01/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\ESET\nod32kui.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_ [...] TbId=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_ [...] TbId=66006
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loïc\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawfl [...] awflow.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-F [...] E_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O22 - SharedTaskScheduler: z - {9794859F-875B-40F3-842F-3DBEE5680101} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\psevwdff.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

--
End of file - 9396 bytes

Répondre à loys@IDN
XmichouX   01-12-2007 à 20:00:44
- 0 +

Re,

Infection Vundo :

Fais ces manips dans l’ordre :

1/ Télécharge VundoFix.exe :

Double-clique VundoFix.exe .
Clique sur Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Ensuite clique sur YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu auras un message comme quoi l’ordinateur va s’éteindre, fais ok

Poste le rapport qui se trouve dans C:\vundofix.txt

2/ Télécharge Combofix (par sUBs) sur ton Bureau. (Tuto)
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Le rapport se trouve ici : C:\Combofix.txt

3/ Poste un nouveau rapport HiJackThis (en ayant renommé HiJackthis.exe en scanner.exe)

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   02-12-2007 à 00:44:28
- 0 +

Re,
Voici les trois rapports que tu m'as demandé :

Rapport VundoFix:

Code :
  1. Checking Java version...
  3. Java version is 1.5.0.6
  5. Scan started at 19:34:31 13/03/2007
  7. Listing files found while scanning....
  9. No infected files were found.
  12. Beginning removal...
  14. VundoFix V6.1.4
  16. Checking Java version...
  18. Java version is 1.5.0.6
  20. Scan started at 19:51:30 13/03/2007
  22. Listing files found while scanning....
  24. No infected files were found.
  27. Beginning removal...
  29. VundoFix V6.3.16
  31. Checking Java version...
  33. Java version is 1.5.0.6
  34. Old versions of java are exploitable and should be removed.
  36. Scan started at 16:56:05 14/03/2007
  38. Listing files found while scanning....
  41. VundoFix V6.3.16
  43. Checking Java version...
  45. Java version is 1.5.0.6
  46. Old versions of java are exploitable and should be removed.
  48. Scan started at 21:03:41 14/03/2007
  50. Listing files found while scanning....
  52. C:\WINDOWS\system32\efcdbbc.dll
  53. C:\WINDOWS\system32\efhkj.bak1
  54. C:\WINDOWS\system32\efhkj.bak2
  55. C:\WINDOWS\system32\efhkj.ini
  56. C:\WINDOWS\system32\efhkj.ini2
  57. C:\WINDOWS\system32\efhkj.tmp
  58. C:\WINDOWS\system32\jkhfe.dll
  59. C:\WINDOWS\system32\pmnmjhe.dll
  60. C:\WINDOWS\system32\rqrollk.dll
  61. C:\WINDOWS\system32\rqromnn.dll
  62. C:\WINDOWS\system32\ssqomlk.dll
  63. C:\WINDOWS\system32\wvurroo.dll
  65. Beginning removal...
  67. Attempting to delete C:\WINDOWS\system32\efcdbbc.dll
  68. C:\WINDOWS\system32\efcdbbc.dll Has been deleted!
  70. Attempting to delete C:\WINDOWS\system32\efhkj.bak1
  71. C:\WINDOWS\system32\efhkj.bak1 Has been deleted!
  73. Attempting to delete C:\WINDOWS\system32\efhkj.bak2
  74. C:\WINDOWS\system32\efhkj.bak2 Has been deleted!
  76. Attempting to delete C:\WINDOWS\system32\efhkj.ini
  77. C:\WINDOWS\system32\efhkj.ini Has been deleted!
  79. Attempting to delete C:\WINDOWS\system32\efhkj.ini2
  80. C:\WINDOWS\system32\efhkj.ini2 Has been deleted!
  82. Attempting to delete C:\WINDOWS\system32\efhkj.tmp
  83. C:\WINDOWS\system32\efhkj.tmp Has been deleted!
  85. Attempting to delete C:\WINDOWS\system32\jkhfe.dll
  86. C:\WINDOWS\system32\jkhfe.dll Has been deleted!
  88. Attempting to delete C:\WINDOWS\system32\pmnmjhe.dll
  89. C:\WINDOWS\system32\pmnmjhe.dll Has been deleted!
  91. Attempting to delete C:\WINDOWS\system32\rqrollk.dll
  92. C:\WINDOWS\system32\rqrollk.dll Has been deleted!
  94. Attempting to delete C:\WINDOWS\system32\rqromnn.dll
  95. C:\WINDOWS\system32\rqromnn.dll Has been deleted!
  97. Attempting to delete C:\WINDOWS\system32\ssqomlk.dll
  98. C:\WINDOWS\system32\ssqomlk.dll Has been deleted!
  100. Attempting to delete C:\WINDOWS\system32\wvurroo.dll
  101. C:\WINDOWS\system32\wvurroo.dll Could not be deleted.
  103. Performing Repairs to the registry.
  104. Done!
  106. Beginning removal...
  108. Attempting to delete C:\WINDOWS\system32\wvurroo.dll
  109. C:\WINDOWS\system32\wvurroo.dll Has been deleted!
  111. Performing Repairs to the registry.
  112. Done!
  114. VundoFix V6.6.2
  116. Checking Java version...
  118. Java version is 1.5.0.6
  119. Old versions of java are exploitable and should be removed.
  121. Java version is 1.5.0.11
  123. Scan started at 00:12:18 02/12/2007
  125. Listing files found while scanning....
  127. C:\WINDOWS\system32\awtqrqq.dll
  128. C:\windows\system32\awvtq.dll
  129. C:\WINDOWS\system32\awvvw.dll
  130. C:\windows\system32\cbxxyyx.dll
  131. C:\windows\system32\ddcya.dll
  132. C:\windows\system32\ddcyx.dll
  133. C:\windows\system32\dfdjhxjf.dll
  134. C:\WINDOWS\system32\dgybneee.dll
  135. C:\windows\system32\efrxlvnj.exe
  136. C:\windows\system32\jkkji.dll
  137. C:\windows\system32\kjkmp.bak1
  138. C:\windows\system32\kjkmp.bak2
  139. C:\windows\system32\kjkmp.ini
  140. C:\WINDOWS\system32\lmllm.bak1
  141. C:\WINDOWS\system32\lmllm.bak2
  142. C:\WINDOWS\system32\lmllm.ini
  143. C:\WINDOWS\system32\lmllm.ini2
  144. C:\WINDOWS\system32\lmllm.tmp
  145. C:\windows\system32\mljgg.dll
  146. C:\WINDOWS\system32\mllml.dll
  147. C:\WINDOWS\system32\ogqtwyjq.dll
  148. C:\windows\system32\pfgqumod.exe
  149. C:\windows\system32\pmkjk.dll
  150. C:\windows\system32\qvttdjpp.dll
  151. C:\windows\system32\vtsqq.dll
  152. C:\windows\system32\vtstu.dll
  153. C:\WINDOWS\system32\wvvwa.bak1
  154. C:\windows\system32\wvvwa.bak2
  155. C:\WINDOWS\system32\wvvwa.ini
  156. C:\WINDOWS\system32\wvvwa.ini2
  157. C:\WINDOWS\system32\wvvwa.tmp
  158. C:\WINDOWS\system32\ysetuvon.dll
  160. Beginning removal...
  162. Attempting to delete C:\WINDOWS\system32\awtqrqq.dll
  163. C:\WINDOWS\system32\awtqrqq.dll Could not be deleted.
  165. Attempting to delete C:\windows\system32\awvtq.dll
  166. C:\windows\system32\awvtq.dll Has been deleted!
  168. Attempting to delete C:\WINDOWS\system32\awvvw.dll
  169. C:\WINDOWS\system32\awvvw.dll Has been deleted!
  171. Attempting to delete C:\windows\system32\cbxxyyx.dll
  172. C:\windows\system32\cbxxyyx.dll Has been deleted!
  174. Attempting to delete C:\windows\system32\ddcya.dll
  175. C:\windows\system32\ddcya.dll Has been deleted!
  177. Attempting to delete C:\windows\system32\ddcyx.dll
  178. C:\windows\system32\ddcyx.dll Has been deleted!
  180. Attempting to delete C:\windows\system32\dfdjhxjf.dll
  181. C:\windows\system32\dfdjhxjf.dll Has been deleted!
  183. Attempting to delete C:\windows\system32\efrxlvnj.exe
  184. C:\windows\system32\efrxlvnj.exe Has been deleted!
  186. Attempting to delete C:\windows\system32\jkkji.dll
  187. C:\windows\system32\jkkji.dll Has been deleted!
  189. Attempting to delete C:\windows\system32\kjkmp.bak1
  190. C:\windows\system32\kjkmp.bak1 Has been deleted!
  192. Attempting to delete C:\windows\system32\kjkmp.bak2
  193. C:\windows\system32\kjkmp.bak2 Has been deleted!
  195. Attempting to delete C:\windows\system32\kjkmp.ini
  196. C:\windows\system32\kjkmp.ini Has been deleted!
  198. Attempting to delete C:\WINDOWS\system32\lmllm.bak1
  199. C:\WINDOWS\system32\lmllm.bak1 Has been deleted!
  201. Attempting to delete C:\WINDOWS\system32\lmllm.bak2
  202. C:\WINDOWS\system32\lmllm.bak2 Has been deleted!
  204. Attempting to delete C:\WINDOWS\system32\lmllm.ini
  205. C:\WINDOWS\system32\lmllm.ini Has been deleted!
  207. Attempting to delete C:\WINDOWS\system32\lmllm.ini2
  208. C:\WINDOWS\system32\lmllm.ini2 Has been deleted!
  210. Attempting to delete C:\WINDOWS\system32\lmllm.tmp
  211. C:\WINDOWS\system32\lmllm.tmp Has been deleted!
  213. Attempting to delete C:\windows\system32\mljgg.dll
  214. C:\windows\system32\mljgg.dll Has been deleted!
  216. Attempting to delete C:\windows\system32\pfgqumod.exe
  217. C:\windows\system32\pfgqumod.exe Has been deleted!
  219. Attempting to delete C:\windows\system32\pmkjk.dll
  220. C:\windows\system32\pmkjk.dll Has been deleted!
  222. Attempting to delete C:\windows\system32\qvttdjpp.dll
  223. C:\windows\system32\qvttdjpp.dll Has been deleted!
  225. Attempting to delete C:\windows\system32\vtsqq.dll
  226. C:\windows\system32\vtsqq.dll Has been deleted!
  228. Attempting to delete C:\windows\system32\vtstu.dll
  229. C:\windows\system32\vtstu.dll Has been deleted!
  231. Attempting to delete C:\WINDOWS\system32\wvvwa.bak1
  232. C:\WINDOWS\system32\wvvwa.bak1 Has been deleted!
  234. Attempting to delete C:\windows\system32\wvvwa.bak2
  235. C:\windows\system32\wvvwa.bak2 Has been deleted!
  237. Attempting to delete C:\WINDOWS\system32\wvvwa.ini
  238. C:\WINDOWS\system32\wvvwa.ini Has been deleted!
  240. Attempting to delete C:\WINDOWS\system32\wvvwa.ini2
  241. C:\WINDOWS\system32\wvvwa.ini2 Has been deleted!
  243. Attempting to delete C:\WINDOWS\system32\wvvwa.tmp
  244. C:\WINDOWS\system32\wvvwa.tmp Has been deleted!
  246. Performing Repairs to the registry.
  247. Done!
  249. Beginning removal...
  251. Attempting to delete C:\WINDOWS\system32\awtqrqq.dll
  252. C:\WINDOWS\system32\awtqrqq.dll Has been deleted!
  254. Performing Repairs to the registry.
  255. Done!



Rapport Combofix:

Code :
  1. ComboFix 07-12-02.4 - Loïc 2007-12-02  0:29:28.1 - NTFSx86
  2. Microsoft Windows XP Professionnel  5.1.2600.2.1252.1.1036.18.328 [GMT 1:00]
  3. Running from: C:\Documents and Settings\Loïc\Bureau\ComboFix.exe
  4. * Created a new restore point
  5. .
  7. ((((((((((((((((((((((((((((((((((((  Autres suppressions  ))))))))))))))))))))))))))))))))))))))))))))))))
  8. .
  10. C:\Documents and Settings\Eric & Valérie\Application Data\macromedia\Flash Player\#SharedObjects\AQ62P34R\www.broadcaster.com
  11. C:\Documents and Settings\Eric & Valérie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
  12. C:\Documents and Settings\Eric & Valérie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
  13. C:\WINDOWS\system32\nvs2.inf
  14. c:\WINDOWS\system32\rfxxlimbn.dat
  15. c:\windows\system32\rfxxlimbn.exe
  16. c:\WINDOWS\system32\rfxxlimbn_nav.dat
  17. C:\WINDOWS\system32\rfxxlimbn_navps.dat
  18. C:\WINDOWS\system32\unsvchosts.exe
  19. C:\WINDOWS\system32\unsvchosts.lzma
  21. .
  22. (((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))
  24. .
  25. -------\LEGACY_DOMAINSERVICE
  26. -------\DomainService
  27. -------\NPF
  30. (((((((((((((((((((((((((((((  Fichiers cr‚‚s 2007-11-01 to 2007-12-01  ))))))))))))))))))))))))))))))))))))
  31. .
  33. 2007-12-01 18:50 . 2007-12-01 18:50    <REP>    d--------    C:\Program Files\Trend Micro
  34. 2007-11-28 15:42 . 2007-11-28 15:59    <REP>    d--------    C:\Program Files\The All-Seeing Eye
  35. 2007-11-27 18:45 . 2007-11-27 18:46    <REP>    d--------    C:\Program Files\Windows Live
  36. 2007-11-25 14:49 . 2007-11-25 14:49    <REP>    d--------    C:\Program Files\Microsoft CAPICOM 2.1.0.2
  37. 2007-11-25 06:52 . 2007-07-30 19:19    271,224    --a------    C:\WINDOWS\system32\mucltui.dll
  38. 2007-11-25 06:52 . 2007-07-30 19:19    207,736    --a------    C:\WINDOWS\system32\muweb.dll
  39. 2007-11-25 06:52 . 2007-07-30 19:18    30,072    --a------    C:\WINDOWS\system32\mucltui.dll.mui
  40. 2007-11-24 20:26 . 2007-11-24 20:29    <REP>    d--hsc---    C:\Program Files\Fichiers communs\WindowsLiveInstaller
  41. 2007-11-24 20:26 . 2007-11-27 19:02    <REP>    d--------    C:\Documents and Settings\All Users\Application Data\WLInstaller
  42. 2007-11-22 08:24 . 2007-11-22 08:24    <REP>    d--------    C:\Documents and Settings\All Users\Application Data\nView_Profiles
  43. 2007-11-20 00:09 . 2007-11-20 00:09    <REP>    d--------    C:\Program Files\mnProjects
  44. 2007-11-18 16:52 . 2007-11-28 14:44    107,832    --a------    C:\WINDOWS\system32\PnkBstrB.exe
  45. 2007-11-18 16:52 . 2007-11-18 16:52    66,872    --a------    C:\WINDOWS\system32\PnkBstrA.exe
  46. 2007-11-18 16:52 . 2007-11-28 14:44    22,328    --a------    C:\WINDOWS\system32\drivers\PnkBstrK.sys
  47. 2007-11-18 16:00 . 2007-11-25 08:52    <REP>    d--------    C:\Program Files\Wolfenstein - Enemy Territory
  48. 2007-11-17 11:35 . 2007-11-18 18:41    <REP>    d--------    C:\Program Files\NCSoft
  49. 2007-11-17 11:35 . 2007-03-12 16:42    3,495,784    --a------    C:\WINDOWS\system32\d3dx9_33.dll
  50. 2007-11-14 07:08 . 2007-11-14 07:08    118    --a------    C:\WINDOWS\system32\MRT.INI
  51. 2007-11-10 21:05 . 2007-11-21 15:06    54,156    --ah-----    C:\WINDOWS\QTFont.qfn
  52. 2007-11-10 21:05 . 2007-11-10 21:05    1,409    --a------    C:\WINDOWS\QTFont.for
  53. 2007-11-05 18:09 . 2007-11-05 18:45    <REP>    d--------    C:\Program Files\Perfect World
  54. 2007-11-05 18:07 . 2007-11-05 17:38    258,352    --a------    C:\WINDOWS\system32\unicows.dll
  55. 2007-11-01 15:21 . 2007-09-28 17:07    129,784    ---------    C:\WINDOWS\system32\pxafs.dll
  56. 2007-11-01 15:21 . 2007-09-28 17:07    9,464    ---------    C:\WINDOWS\system32\drivers\cdralw2k.sys
  57. 2007-11-01 15:21 . 2007-09-28 17:07    9,336    ---------    C:\WINDOWS\system32\drivers\cdr4_xp.sys
  58. 2007-11-01 09:33 . 2007-11-19 08:20    <REP>    d--------    C:\Program Files\Crawler
  59. 2007-11-01 09:33 . 2007-11-18 18:44    <REP>    d--------    C:\Program Files\Beneton Movie GIF
  61. .
  62. ((((((((((((((((((((((((((((((((((  Compte-rendu de Find3M  ))))))))))))))))))))))))))))))))))))))))))))))))
  63. .
  64. 2007-12-01 21:31    ---------    d-----w    C:\Program Files\eMule
  65. 2007-11-24 18:39    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\Google Updater
  66. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\vanBasco's Karaoke Player
  67. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\TrackMania Nations ESWC
  68. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\StuffPlug3
  69. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\LimeWire
  70. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\Heroes Ragnarok
  71. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\FrenchOtto
  72. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\FaxTools
  73. 2007-11-18 17:44    ---------    d-----w    C:\Program Files\DivX
  74. 2007-11-18 17:41    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
  75. 2007-11-18 17:39    ---------    d-----w    C:\Program Files\Jasc Software Inc
  76. 2007-10-23 10:29    ---------    d-----w    C:\Program Files\Net Pro Anti-Popup
  77. 2007-10-22 17:10    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
  78. 2007-10-22 17:08    ---------    d-----w    C:\Program Files\Microsoft
  79. 2007-10-21 15:20    ---------    d-----w    C:\Program Files\Red Kawa
  80. 2006-12-09 22:54    251    ----a-w    C:\Program Files\wt3d.ini
  81. 2007-07-26 08:13    6,486    --sh--w    C:\WINDOWS\system32\bbeeg.bak1
  82. 2007-04-29 11:49    538,529    --sh--w    C:\WINDOWS\system32\egjlm.bak1
  83. 2007-07-12 06:38    505,697    --sh--w    C:\WINDOWS\system32\egjlm.bak2
  84. 2007-07-18 17:14    557,212    --sh--w    C:\WINDOWS\system32\egjlm.ini2
  85. 2007-07-19 08:06    6,545    --sh--w    C:\WINDOWS\system32\fgjlm.bak1
  86. 2007-07-25 14:32    6,526    --sh--w    C:\WINDOWS\system32\fgjlm.bak2
  87. 2007-07-27 09:45    6,655    --sh--w    C:\WINDOWS\system32\fgjlm.ini2
  88. 2007-07-31 08:36    6,486    --sh--w    C:\WINDOWS\system32\fhhkj.bak1
  89. 2007-07-14 17:30    6,362    --sh--w    C:\WINDOWS\system32\gjkkj.bak1
  90. 2007-07-19 13:32    6,362    --sh--w    C:\WINDOWS\system32\gjllm.bak1
  91. 2007-07-12 17:45    6,362    --sh--w    C:\WINDOWS\system32\hjjlm.bak1
  92. 2007-07-20 11:14    6,362    --sh--w    C:\WINDOWS\system32\hjkmp.bak1
  93. 2007-07-20 05:56    6,362    --sh--w    C:\WINDOWS\system32\ijllm.bak1
  94. 2007-07-13 16:02    6,362    --sh--w    C:\WINDOWS\system32\ilnmp.bak1
  95. 2007-07-15 17:38    6,710    --sh--w    C:\WINDOWS\system32\ilnmp.bak2
  96. 2007-07-11 07:48    6,497    --sh--w    C:\WINDOWS\system32\jjllm.bak1
  97. 2007-07-13 09:59    6,402    --sh--w    C:\WINDOWS\system32\jjllm.bak2
  98. 2007-07-30 17:16    6,486    --sh--w    C:\WINDOWS\system32\kjkkj.bak1
  99. 2007-07-13 11:53    6,362    --sh--w    C:\WINDOWS\system32\klkkj.bak1
  100. 2007-07-25 18:35    6,526    --sh--w    C:\WINDOWS\system32\mpqss.bak1
  101. 2007-07-12 18:19    6,482    --sh--w    C:\WINDOWS\system32\nqtss.bak1
  102. 2007-07-30 18:49    6,486    --sh--w    C:\WINDOWS\system32\orutv.bak1
  103. 2007-07-13 08:52    6,362    --sh--w    C:\WINDOWS\system32\pqtss.bak1
  104. 2007-07-16 07:46    6,362    --sh--w    C:\WINDOWS\system32\rqtss.bak1
  105. 2007-07-17 22:08    6,362    --sh--w    C:\WINDOWS\system32\rtutv.bak1
  106. 2007-07-20 08:06    6,362    --sh--w    C:\WINDOWS\system32\srqss.bak1
  107. 2007-07-10 10:30    6,547    --sh--w    C:\WINDOWS\system32\ststv.bak1
  108. 2007-07-31 08:25    6,486    --sh--w    C:\WINDOWS\system32\uttss.bak1
  109. 2007-07-18 07:50    6,568    --sh--w    C:\WINDOWS\system32\wybeg.bak1
  110. 2007-07-23 20:48    6,486    --sh--w    C:\WINDOWS\system32\wybeg.bak2
  111. 2007-07-18 20:58    6,406    --sh--w    C:\WINDOWS\system32\wycdd.bak1
  112. 2007-07-22 08:59    6,526    --sh--w    C:\WINDOWS\system32\wycdd.bak2
  113. 2007-07-28 11:15    6,486    --sh--w    C:\WINDOWS\system32\yccdd.bak1
  114. 2007-07-26 20:50    6,486    --sh--w    C:\WINDOWS\system32\yybeg.bak1
  115. .
  117. (((((((((((((((((((((((((((((((((  Point de chargement Reg  )))))))))))))))))))))))))))))))))))))))))))))))))
  118. .
  119. .
  120. *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
  122. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0BE01085-B26D-4F83-8B23-E269C00895F4}]
  123.             C:\WINDOWS\system32\uayeaflv.dll
  125. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11C3004B-1C61-4A14-B43D-870FA5DE49E3}]
  126.             C:\WINDOWS\system32\mllml.dll
  128. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8B637DAB-09C1-4509-9C41-B7DEFE0EF726}]
  129.             C:\WINDOWS\system32\wvurroo.dll
  131. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9794859F-875B-40F3-842F-3DBEE5680101}]
  133. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{99EB758D-F83E-411B-B831-B1BE84EF9ECF}]
  134.             C:\WINDOWS\system32\mllml.dll
  136. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B2DAA879-74EB-43A9-8867-033A6DBA2367}]
  137.             C:\WINDOWS\system32\uayeaflv.dll
  139. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DFE8772C-312C-49EC-9A7B-A9E4BB789A6F}]
  140.             C:\WINDOWS\system32\awvvw.dll
  142. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E108FE29-5684-44FB-896A-443374608B8B}]
  143.             C:\WINDOWS\system32\awvvw.dll
  145. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EBB99DBB-9896-4EB0-BC56-844412E8B29d}]
  146.             C:\WINDOWS\system32\uayeaflv.dll
  148. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  149. "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-11-06 15:03]
  150. "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 21:00]
  151. "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 08:27]
  153. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  154. "NvCplDaemon"="RUNDLL32.exe" [2004-08-10 21:00 C:\WINDOWS\system32\rundll32.exe]
  155. "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-12-05 20:46]
  156. "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
  157. "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57]
  158. "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" []
  160. [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  161. "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 21:00]
  163. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  164. "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
  165. "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
  167. [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
  168. "{8B637DAB-09C1-4509-9C41-B7DEFE0EF726}"= C:\WINDOWS\system32\wvurroo.dll [ ]
  170. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddccy]
  171. C:\WINDOWS\system32\ddccy.dll
  173. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcyw]
  174. C:\WINDOWS\system32\ddcyw.dll
  176. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyw]
  177. C:\WINDOWS\system32\gebyw.dll
  179. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyy]
  180. C:\WINDOWS\system32\gebyy.dll
  182. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geebb]
  183. C:\WINDOWS\system32\geebb.dll
  185. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhf]
  186. C:\WINDOWS\system32\jkhhf.dll
  188. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkjg]
  189. C:\WINDOWS\system32\jkkjg.dll
  191. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkjk]
  192. C:\WINDOWS\system32\jkkjk.dll
  194. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkklk]
  195. C:\WINDOWS\system32\jkklk.dll
  197. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljge]
  198. C:\WINDOWS\system32\mljge.dll
  200. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljgf]
  201. C:\WINDOWS\system32\mljgf.dll
  203. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljjh]
  204. C:\WINDOWS\system32\mljjh.dll
  206. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlljg]
  207. C:\WINDOWS\system32\mlljg.dll
  209. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllji]
  210. C:\WINDOWS\system32\mllji.dll
  212. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlljj]
  213. C:\WINDOWS\system32\mlljj.dll
  215. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mllml]
  216. C:\WINDOWS\system32\mllml.dll
  218. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhh]
  219. C:\WINDOWS\system32\pmkhh.dll
  221. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkjh]
  222. C:\WINDOWS\system32\pmkjh.dll
  224. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnli]
  225. C:\WINDOWS\system32\pmnli.dll
  227. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpm]
  228. C:\WINDOWS\system32\ssqpm.dll
  230. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrs]
  231. C:\WINDOWS\system32\ssqrs.dll
  233. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sstqn]
  234. C:\WINDOWS\system32\sstqn.dll
  236. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sstqp]
  237. C:\WINDOWS\system32\sstqp.dll
  239. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sstqr]
  240. C:\WINDOWS\system32\sstqr.dll
  242. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssttu]
  243. C:\WINDOWS\system32\ssttu.dll
  245. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsts]
  246. C:\WINDOWS\system32\vtsts.dll
  248. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturo]
  249. C:\WINDOWS\system32\vturo.dll
  251. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtutr]
  252. C:\WINDOWS\system32\vtutr.dll
  254. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzbd32]
  255. winzbd32.dll
  257. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\j4241531]
  258.             rundll32 C:\WINDOWS\system32\j4241531.dll sook
  260. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
  261.             RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  263. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup]
  264.             rundll32.exe C:\WINDOWS\system32\vlobmjpy.dll,realset
  266. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
  267. "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  268. "GPLv3"=rundll32.exe "C:\WINDOWS\system32\xocfstys.dll",realset
  269. "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
  270. "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
  272. R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys
  273. S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\system32\Drivers\Ca533av.sys
  274. S3 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
  275. S3 psdfilter;psdfilter;\??\C:\WINDOWS\system32\Drivers\psdfilter.sys
  276. S3 psdvdisk;psdvdisk;\??\C:\WINDOWS\system32\Drivers\psdvdisk.sys
  277. S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys
  278. S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys
  280. .
  281. Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
  282. "2007-11-07 09:03:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
  283. - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
  284. .
  285. **************************************************************************
  287. catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  288. Rootkit scan 2007-12-02 00:34:34
  289. Windows 5.1.2600 Service Pack 2 NTFS
  291. scanning hidden processes ...
  293. scanning hidden autostart entries ...
  295. scanning hidden files ...
  297. scan completed successfully
  298. hidden files: 0
  300. **************************************************************************
  301. .
  302. Completion time: 2007-12-02  0:35:02 - machine was rebooted
  303. .
  304.     --- E O F ---



Rapport HijackThis:

Code :
  1. Logfile of Trend Micro HijackThis v2.0.2
  2. Scan saved at 00:38:03, on 02/12/2007
  3. Platform: Windows XP SP2 (WinNT 5.01.2600)
  4. MSIE: Internet Explorer v7.00 (7.00.6000.16544)
  5. Boot mode: Normal
  7. Running processes:
  8. C:\WINDOWS\System32\smss.exe
  9. C:\WINDOWS\system32\winlogon.exe
  10. C:\WINDOWS\system32\services.exe
  11. C:\WINDOWS\system32\lsass.exe
  12. C:\WINDOWS\system32\svchost.exe
  13. C:\WINDOWS\System32\svchost.exe
  14. C:\WINDOWS\system32\LEXBCES.EXE
  15. C:\WINDOWS\system32\spoolsv.exe
  16. C:\WINDOWS\system32\LEXPPS.EXE
  17. C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  18. C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
  19. C:\WINDOWS\eHome\ehRecvr.exe
  20. C:\WINDOWS\eHome\ehSched.exe
  21. c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  22. C:\Program Files\Eset\nod32krn.exe
  23. C:\WINDOWS\system32\nvsvc32.exe
  24. C:\Program Files\Kerio\Personal Firewall\persfw.exe
  25. C:\WINDOWS\system32\PnkBstrA.exe
  26. C:\WINDOWS\system32\svchost.exe
  27. C:\WINDOWS\system32\dllhost.exe
  28. C:\WINDOWS\Explorer.EXE
  29. C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
  30. C:\Program Files\QuickTime\qttask.exe
  31. C:\WINDOWS\system32\ctfmon.exe
  32. C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
  33. C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
  34. C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
  35. C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  36. C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
  37. C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
  38. C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
  39. C:\Program Files\Google\Google Updater\GoogleUpdater.exe
  40. C:\Program Files\ESET\nod32kui.exe
  41. C:\WINDOWS\System32\svchost.exe
  42. C:\WINDOWS\system32\wuauclt.exe
  43. C:\Program Files\Mozilla Firefox\firefox.exe
  44. C:\Program Files\Trend Micro\HijackThis\scanner.exe
  46. R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
  47. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  48. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
  49. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
  50. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
  51. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  52. R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  53. R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
  54. R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  55. R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  56. O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  57. O2 - BHO: (no name) - {0BE01085-B26D-4F83-8B23-E269C00895F4} - C:\WINDOWS\system32\uayeaflv.dll (file missing)
  58. O2 - BHO: (no name) - {11C3004B-1C61-4A14-B43D-870FA5DE49E3} - C:\WINDOWS\system32\mllml.dll (file missing)
  59. O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
  60. O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezobho.dll (file missing)
  61. O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  62. O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  63. O2 - BHO: (no name) - {8B637DAB-09C1-4509-9C41-B7DEFE0EF726} - C:\WINDOWS\system32\wvurroo.dll (file missing)
  64. O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  65. O2 - BHO: (no name) - {9794859F-875B-40F3-842F-3DBEE5680101} - (no file)
  66. O2 - BHO: (no name) - {99EB758D-F83E-411B-B831-B1BE84EF9ECF} - C:\WINDOWS\system32\mllml.dll (file missing)
  67. O2 - BHO: (no name) - {B2DAA879-74EB-43A9-8867-033A6DBA2367} - C:\WINDOWS\system32\uayeaflv.dll (file missing)
  68. O2 - BHO: (no name) - {DFE8772C-312C-49EC-9A7B-A9E4BB789A6F} - C:\WINDOWS\system32\awvvw.dll (file missing)
  69. O2 - BHO: (no name) - {E108FE29-5684-44FB-896A-443374608B8B} - C:\WINDOWS\system32\awvvw.dll (file missing)
  70. O2 - BHO: (no name) - {EBB99DBB-9896-4EB0-BC56-844412E8B29d} - C:\WINDOWS\system32\uayeaflv.dll (file missing)
  71. O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  72. O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
  73. O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  74. O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
  75. O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
  76. O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  77. O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  78. O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
  79. O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
  80. O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  81. O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  82. O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  83. O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
  84. O4 - Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
  85. O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
  86. O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  87. O4 - Global Startup: BlueSoleil.lnk = ?
  88. O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
  89. O4 - Global Startup: Microsoft Office.lnk.disabled
  90. O4 - Global Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
  91. O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
  92. O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
  93. O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
  94. O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
  95. O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  96. O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  97. O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loïc\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
  98. O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  99. O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  100. O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  101. O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  102. O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
  103. O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
  104. O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
  105. O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  106. O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  107. O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  108. O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  109. O20 - Winlogon Notify: ddccy - C:\WINDOWS\system32\ddccy.dll (file missing)
  110. O20 - Winlogon Notify: ddcyw - C:\WINDOWS\system32\ddcyw.dll (file missing)
  111. O20 - Winlogon Notify: gebyw - C:\WINDOWS\system32\gebyw.dll (file missing)
  112. O20 - Winlogon Notify: gebyy - C:\WINDOWS\system32\gebyy.dll (file missing)
  113. O20 - Winlogon Notify: geebb - C:\WINDOWS\system32\geebb.dll (file missing)
  114. O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll (file missing)
  115. O20 - Winlogon Notify: jkkjg - C:\WINDOWS\system32\jkkjg.dll (file missing)
  116. O20 - Winlogon Notify: jkkjk - C:\WINDOWS\system32\jkkjk.dll (file missing)
  117. O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll (file missing)
  118. O20 - Winlogon Notify: mljge - C:\WINDOWS\system32\mljge.dll (file missing)
  119. O20 - Winlogon Notify: mljgf - C:\WINDOWS\system32\mljgf.dll (file missing)
  120. O20 - Winlogon Notify: mljjh - C:\WINDOWS\system32\mljjh.dll (file missing)
  121. O20 - Winlogon Notify: mlljg - C:\WINDOWS\system32\mlljg.dll (file missing)
  122. O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
  123. O20 - Winlogon Notify: mlljj - C:\WINDOWS\system32\mlljj.dll (file missing)
  124. O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
  125. O20 - Winlogon Notify: pmkhh - C:\WINDOWS\system32\pmkhh.dll (file missing)
  126. O20 - Winlogon Notify: pmkjh - C:\WINDOWS\system32\pmkjh.dll (file missing)
  127. O20 - Winlogon Notify: pmnli - C:\WINDOWS\system32\pmnli.dll (file missing)
  128. O20 - Winlogon Notify: ssqpm - C:\WINDOWS\system32\ssqpm.dll (file missing)
  129. O20 - Winlogon Notify: ssqrs - C:\WINDOWS\system32\ssqrs.dll (file missing)
  130. O20 - Winlogon Notify: sstqn - C:\WINDOWS\system32\sstqn.dll (file missing)
  131. O20 - Winlogon Notify: sstqp - C:\WINDOWS\system32\sstqp.dll (file missing)
  132. O20 - Winlogon Notify: sstqr - C:\WINDOWS\system32\sstqr.dll (file missing)
  133. O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll (file missing)
  134. O20 - Winlogon Notify: vtsts - C:\WINDOWS\system32\vtsts.dll (file missing)
  135. O20 - Winlogon Notify: vturo - C:\WINDOWS\system32\vturo.dll (file missing)
  136. O20 - Winlogon Notify: vtutr - C:\WINDOWS\system32\vtutr.dll (file missing)
  137. O20 - Winlogon Notify: winzbd32 - winzbd32.dll (file missing)
  138. O22 - SharedTaskScheduler: z - {9794859F-875B-40F3-842F-3DBEE5680101} - (no file)
  139. O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
  140. O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  141. O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
  142. O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  143. O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  144. O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
  145. O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  146. O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
  147. O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
  148. O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  149. O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
  150. O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
  151. O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)
  153. --
  154. End of file - 12697 bytes


Message édité par loys@IDN le 02-12-2007 à 00:46:59
Répondre à loys@IDN
XmichouX   02-12-2007 à 01:10:10
- 0 +

Re,

Relance HiJackThis, do a system scan only, coche ces lignes :

# O2 - BHO: (no name) - {0BE01085-B26D-4F83-8B23-E269C00895F4} - C:\WINDOWS\system32\uayeaflv.dll (file missing)
# O2 - BHO: (no name) - {11C3004B-1C61-4A14-B43D-870FA5DE49E3} - C:\WINDOWS\system32\mllml.dll (file missing)
# O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
# O2 - BHO: (no name) - {8B637DAB-09C1-4509-9C41-B7DEFE0EF726} - C:\WINDOWS\system32\wvurroo.dll (file missing)
# O2 - BHO: (no name) - {9794859F-875B-40F3-842F-3DBEE5680101} - (no file)
# O2 - BHO: (no name) - {99EB758D-F83E-411B-B831-B1BE84EF9ECF} - C:\WINDOWS\system32\mllml.dll (file missing)
# O2 - BHO: (no name) - {B2DAA879-74EB-43A9-8867-033A6DBA2367} - C:\WINDOWS\system32\uayeaflv.dll (file missing)
# O2 - BHO: (no name) - {DFE8772C-312C-49EC-9A7B-A9E4BB789A6F} - C:\WINDOWS\system32\awvvw.dll (file missing)
# O2 - BHO: (no name) - {E108FE29-5684-44FB-896A-443374608B8B} - C:\WINDOWS\system32\awvvw.dll (file missing)
# O2 - BHO: (no name) - {EBB99DBB-9896-4EB0-BC56-844412E8B29d} - C:\WINDOWS\system32\uayeaflv.dll (file missing)
# O20 - Winlogon Notify: ddccy - C:\WINDOWS\system32\ddccy.dll (file missing)
# O20 - Winlogon Notify: ddcyw - C:\WINDOWS\system32\ddcyw.dll (file missing)
# O20 - Winlogon Notify: gebyw - C:\WINDOWS\system32\gebyw.dll (file missing)
# O20 - Winlogon Notify: gebyy - C:\WINDOWS\system32\gebyy.dll (file missing)
# O20 - Winlogon Notify: geebb - C:\WINDOWS\system32\geebb.dll (file missing)
# O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll (file missing)
# O20 - Winlogon Notify: jkkjg - C:\WINDOWS\system32\jkkjg.dll (file missing)
# O20 - Winlogon Notify: jkkjk - C:\WINDOWS\system32\jkkjk.dll (file missing)
# O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll (file missing)
# O20 - Winlogon Notify: mljge - C:\WINDOWS\system32\mljge.dll (file missing)
# O20 - Winlogon Notify: mljgf - C:\WINDOWS\system32\mljgf.dll (file missing)
# O20 - Winlogon Notify: mljjh - C:\WINDOWS\system32\mljjh.dll (file missing)
# O20 - Winlogon Notify: mlljg - C:\WINDOWS\system32\mlljg.dll (file missing)
# O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
# O20 - Winlogon Notify: mlljj - C:\WINDOWS\system32\mlljj.dll (file missing)
# O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
# O20 - Winlogon Notify: pmkhh - C:\WINDOWS\system32\pmkhh.dll (file missing)
# O20 - Winlogon Notify: pmkjh - C:\WINDOWS\system32\pmkjh.dll (file missing)
# O20 - Winlogon Notify: pmnli - C:\WINDOWS\system32\pmnli.dll (file missing)
# O20 - Winlogon Notify: ssqpm - C:\WINDOWS\system32\ssqpm.dll (file missing)
# O20 - Winlogon Notify: ssqrs - C:\WINDOWS\system32\ssqrs.dll (file missing)
# O20 - Winlogon Notify: sstqn - C:\WINDOWS\system32\sstqn.dll (file missing)
# O20 - Winlogon Notify: sstqp - C:\WINDOWS\system32\sstqp.dll (file missing)
# O20 - Winlogon Notify: sstqr - C:\WINDOWS\system32\sstqr.dll (file missing)
# O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll (file missing)
# O20 - Winlogon Notify: vtsts - C:\WINDOWS\system32\vtsts.dll (file missing)
# O20 - Winlogon Notify: vturo - C:\WINDOWS\system32\vturo.dll (file missing)
# O20 - Winlogon Notify: vtutr - C:\WINDOWS\system32\vtutr.dll (file missing)
# O20 - Winlogon Notify: winzbd32 - winzbd32.dll (file missing)
# O22 - SharedTaskScheduler: z - {9794859F-875B-40F3-842F-3DBEE5680101} - (no file)


Puis Fix Checked !

Puis refais un scan combofix, poste le rapport.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   02-12-2007 à 08:58:14
- 0 +

Salut,

Voici le rapport Combofix:

ComboFix 07-12-02.4 - Loïc 2007-12-02 8:46:01.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.409 [GMT 1:00]
Running from: C:\Documents and Settings\Loïc\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))))))))
.

2007-12-02 00:35 . <REP> C:\Documents and Settings\Eric 2007-12-02 00:35 <REP> ValÚrie\Local Settings
2007-12-01 18:50 . 2007-12-01 18:50 <REP> d-------- C:\Program Files\Trend Micro
2007-11-28 15:42 . 2007-11-28 15:59 <REP> d-------- C:\Program Files\The All-Seeing Eye
2007-11-27 18:45 . 2007-11-27 18:46 <REP> d-------- C:\Program Files\Windows Live
2007-11-25 14:49 . 2007-11-25 14:49 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-25 06:52 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-25 06:52 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-25 06:52 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-24 20:26 . 2007-11-24 20:29 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-11-24 20:26 . 2007-11-27 19:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-22 08:24 . 2007-11-22 08:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-20 00:09 . 2007-11-20 00:09 <REP> d-------- C:\Program Files\mnProjects
2007-11-18 16:52 . 2007-11-28 14:44 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-11-18 16:52 . 2007-11-18 16:52 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-11-18 16:52 . 2007-11-28 14:44 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-18 16:00 . 2007-11-25 08:52 <REP> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-11-17 11:35 . 2007-11-18 18:41 <REP> d-------- C:\Program Files\NCSoft
2007-11-17 11:35 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-11-14 07:08 . 2007-11-14 07:08 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-11-05 18:09 . 2007-11-05 18:45 <REP> d-------- C:\Program Files\Perfect World
2007-11-05 18:07 . 2007-11-05 17:38 258,352 --a------ C:\WINDOWS\system32\unicows.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-01 21:31 --------- d-----w C:\Program Files\eMule
2007-11-24 18:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-19 07:20 --------- d-----w C:\Program Files\Crawler
2007-11-18 17:44 --------- d-----w C:\Program Files\vanBasco's Karaoke Player
2007-11-18 17:44 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2007-11-18 17:44 --------- d-----w C:\Program Files\StuffPlug3
2007-11-18 17:44 --------- d-----w C:\Program Files\LimeWire
2007-11-18 17:44 --------- d-----w C:\Program Files\Heroes Ragnarok
2007-11-18 17:44 --------- d-----w C:\Program Files\FrenchOtto
2007-11-18 17:44 --------- d-----w C:\Program Files\FaxTools
2007-11-18 17:44 --------- d-----w C:\Program Files\DivX
2007-11-18 17:44 --------- d-----w C:\Program Files\Beneton Movie GIF
2007-11-18 17:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-18 17:39 --------- d-----w C:\Program Files\Jasc Software Inc
2007-10-23 10:29 --------- d-----w C:\Program Files\Net Pro Anti-Popup
2007-10-22 17:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
2007-10-22 17:08 --------- d-----w C:\Program Files\Microsoft
2007-10-21 15:20 --------- d-----w C:\Program Files\Red Kawa
2007-10-21 14:23 --------- d-----w C:\Documents and Settings\Loïc\Application Data\Radios Media Player
2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2007-09-28 16:08 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-09-28 16:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-03-14 21:06 583 ----a-w C:\Documents and Settings\Loïc\clean.reg
2007-03-14 21:06 583 ----a-w C:\Documents and Settings\Loïc\clean.reg
2007-02-18 19:45 3,992,288 ----a-w C:\Documents and Settings\Loïc\TRACE_BOOT+DRIVERS_1_1.BIN
2007-02-18 19:45 3,992,288 ----a-w C:\Documents and Settings\Loïc\TRACE_BOOT+DRIVERS_1_1.BIN
2006-12-09 22:54 251 ----a-w C:\Program Files\wt3d.ini
2007-07-26 08:13 6,486 --sh--w C:\WINDOWS\system32\bbeeg.bak1
2007-04-29 11:49 538,529 --sh--w C:\WINDOWS\system32\egjlm.bak1
2007-07-12 06:38 505,697 --sh--w C:\WINDOWS\system32\egjlm.bak2
2007-07-18 17:14 557,212 --sh--w C:\WINDOWS\system32\egjlm.ini2
2007-07-19 08:06 6,545 --sh--w C:\WINDOWS\system32\fgjlm.bak1
2007-07-25 14:32 6,526 --sh--w C:\WINDOWS\system32\fgjlm.bak2
2007-07-27 09:45 6,655 --sh--w C:\WINDOWS\system32\fgjlm.ini2
2007-07-31 08:36 6,486 --sh--w C:\WINDOWS\system32\fhhkj.bak1
2007-07-14 17:30 6,362 --sh--w C:\WINDOWS\system32\gjkkj.bak1
2007-07-19 13:32 6,362 --sh--w C:\WINDOWS\system32\gjllm.bak1
2007-07-12 17:45 6,362 --sh--w C:\WINDOWS\system32\hjjlm.bak1
2007-07-20 11:14 6,362 --sh--w C:\WINDOWS\system32\hjkmp.bak1
2007-07-20 05:56 6,362 --sh--w C:\WINDOWS\system32\ijllm.bak1
2007-07-13 16:02 6,362 --sh--w C:\WINDOWS\system32\ilnmp.bak1
2007-07-15 17:38 6,710 --sh--w C:\WINDOWS\system32\ilnmp.bak2
2007-07-11 07:48 6,497 --sh--w C:\WINDOWS\system32\jjllm.bak1
2007-07-13 09:59 6,402 --sh--w C:\WINDOWS\system32\jjllm.bak2
2007-07-30 17:16 6,486 --sh--w C:\WINDOWS\system32\kjkkj.bak1
2007-07-13 11:53 6,362 --sh--w C:\WINDOWS\system32\klkkj.bak1
2007-07-25 18:35 6,526 --sh--w C:\WINDOWS\system32\mpqss.bak1
2007-07-12 18:19 6,482 --sh--w C:\WINDOWS\system32\nqtss.bak1
2007-07-30 18:49 6,486 --sh--w C:\WINDOWS\system32\orutv.bak1
2007-07-13 08:52 6,362 --sh--w C:\WINDOWS\system32\pqtss.bak1
2007-07-16 07:46 6,362 --sh--w C:\WINDOWS\system32\rqtss.bak1
2007-07-17 22:08 6,362 --sh--w C:\WINDOWS\system32\rtutv.bak1
2007-07-20 08:06 6,362 --sh--w C:\WINDOWS\system32\srqss.bak1
2007-07-10 10:30 6,547 --sh--w C:\WINDOWS\system32\ststv.bak1
2007-07-31 08:25 6,486 --sh--w C:\WINDOWS\system32\uttss.bak1
2007-07-18 07:50 6,568 --sh--w C:\WINDOWS\system32\wybeg.bak1
2007-07-23 20:48 6,486 --sh--w C:\WINDOWS\system32\wybeg.bak2
2007-07-18 20:58 6,406 --sh--w C:\WINDOWS\system32\wycdd.bak1
2007-07-22 08:59 6,526 --sh--w C:\WINDOWS\system32\wycdd.bak2
2007-07-28 11:15 6,486 --sh--w C:\WINDOWS\system32\yccdd.bak1
2007-07-26 20:50 6,486 --sh--w C:\WINDOWS\system32\yybeg.bak1
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-11-06 15:03]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 21:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 08:27]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-10 21:00 C:\WINDOWS\system32\rundll32.exe]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-12-05 20:46]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 21:00]

C:\Documents and Settings\Lo‹c\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
NOD32 Control Center.lnk - C:\Program Files\ESET\nod32kui.exe [2006-12-05 19:57:00]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acer WLAN 11g USB Dongle.lnk - C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 19:25:14]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06]
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-01-20 12:53:32]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-12-05 17:35:07]
Microsoft Office.lnk.disabled [2007-02-19 09:59:44]
NOD32 Control Center.lnk - C:\Program Files\ESET\nod32kui.exe [2006-12-05 19:57:00]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-02-23 22:23:49]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\j4241531]
rundll32 C:\WINDOWS\system32\j4241531.dll sook

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup]
rundll32.exe C:\WINDOWS\system32\vlobmjpy.dll,realset

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"GPLv3"=rundll32.exe "C:\WINDOWS\system32\xocfstys.dll",realset
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys
S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
S3 psdfilter;psdfilter;\??\C:\WINDOWS\system32\Drivers\psdfilter.sys
S3 psdvdisk;psdvdisk;\??\C:\WINDOWS\system32\Drivers\psdvdisk.sys
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-07 09:03:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-02 08:47:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-02 8:48:38
C:\ComboFix2.txt ... 2007-12-02 00:35
.
--- E O F ---

Répondre à loys@IDN
XmichouX   02-12-2007 à 12:08:35
- 0 +

Bien, on attaque..

Télécharge ZebRestore
Dézippe-le. Ouvre le dossier, lance le en double cliquant sur l’exe.
Coche :
- Policies

Copie le texte se situant dans le cadre ci-dessous :

File::
C:\WINDOWS\system32\xocfstys.dll
C:\WINDOWS\system32\vlobmjpy.dll
C:\WINDOWS\system32\j4241531.dll
C:\Program Files\wt3d.ini
C:\WINDOWS\system32\bbeeg.bak1
C:\WINDOWS\system32\egjlm.bak1
C:\WINDOWS\system32\egjlm.bak2
C:\WINDOWS\system32\egjlm.ini2
C:\WINDOWS\system32\fgjlm.bak1
C:\WINDOWS\system32\fgjlm.bak2
C:\WINDOWS\system32\fgjlm.ini2
C:\WINDOWS\system32\fhhkj.bak1
C:\WINDOWS\system32\gjkkj.bak1
C:\WINDOWS\system32\gjllm.bak1
C:\WINDOWS\system32\hjjlm.bak1
C:\WINDOWS\system32\hjkmp.bak1
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\jjllm.bak1
C:\WINDOWS\system32\jjllm.bak2
C:\WINDOWS\system32\kjkkj.bak1
C:\WINDOWS\system32\klkkj.bak1
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\nqtss.bak1
C:\WINDOWS\system32\orutv.bak1
C:\WINDOWS\system32\pqtss.bak1
C:\WINDOWS\system32\rqtss.bak1
C:\WINDOWS\system32\rtutv.bak1
C:\WINDOWS\system32\srqss.bak1
C:\WINDOWS\system32\ststv.bak1
C:\WINDOWS\system32\uttss.bak1
C:\WINDOWS\system32\wybeg.bak1
C:\WINDOWS\system32\wybeg.bak2
C:\WINDOWS\system32\wycdd.bak1
C:\WINDOWS\system32\wycdd.bak2
C:\WINDOWS\system32\yccdd.bak1
C:\WINDOWS\system32\yybeg.bak1

Folder::
C:\Vundofix Backups

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GPLv3"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\j4241531]



Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   02-12-2007 à 13:12:19
- 0 +

Voici le rapport Combofix:

ComboFix 07-12-02.4 - Loïc 2007-12-02 12:48:33.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.369 [GMT 1:00]
Running from: C:\Documents and Settings\Loïc\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Loïc\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\wt3d.ini
C:\WINDOWS\system32\bbeeg.bak1
C:\WINDOWS\system32\egjlm.bak1
C:\WINDOWS\system32\egjlm.bak2
C:\WINDOWS\system32\egjlm.ini2
C:\WINDOWS\system32\fgjlm.bak1
C:\WINDOWS\system32\fgjlm.bak2
C:\WINDOWS\system32\fgjlm.ini2
C:\WINDOWS\system32\fhhkj.bak1
C:\WINDOWS\system32\gjkkj.bak1
C:\WINDOWS\system32\gjllm.bak1
C:\WINDOWS\system32\hjjlm.bak1
C:\WINDOWS\system32\hjkmp.bak1
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\j4241531.dll
C:\WINDOWS\system32\jjllm.bak1
C:\WINDOWS\system32\jjllm.bak2
C:\WINDOWS\system32\kjkkj.bak1
C:\WINDOWS\system32\klkkj.bak1
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\nqtss.bak1
C:\WINDOWS\system32\orutv.bak1
C:\WINDOWS\system32\pqtss.bak1
C:\WINDOWS\system32\rqtss.bak1
C:\WINDOWS\system32\rtutv.bak1
C:\WINDOWS\system32\srqss.bak1
C:\WINDOWS\system32\ststv.bak1
C:\WINDOWS\system32\uttss.bak1
C:\WINDOWS\system32\vlobmjpy.dll
C:\WINDOWS\system32\wybeg.bak1
C:\WINDOWS\system32\wybeg.bak2
C:\WINDOWS\system32\wycdd.bak1
C:\WINDOWS\system32\wycdd.bak2
C:\WINDOWS\system32\xocfstys.dll
C:\WINDOWS\system32\yccdd.bak1
C:\WINDOWS\system32\yybeg.bak1
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\wt3d.ini
C:\Vundofix Backups
C:\Vundofix Backups\efhkj.bak1.bad
C:\Vundofix Backups\efhkj.bak2.bad
C:\Vundofix Backups\efhkj.ini.bad
C:\Vundofix Backups\efhkj.ini2.bad
C:\Vundofix Backups\efhkj.tmp.bad
C:\Vundofix Backups\jkhfe.dll.bad
C:\Vundofix Backups\kjkmp.bak1.bad
C:\Vundofix Backups\kjkmp.bak2.bad
C:\Vundofix Backups\kjkmp.ini.bad
C:\Vundofix Backups\lmllm.bak1.bad
C:\Vundofix Backups\lmllm.bak2.bad
C:\Vundofix Backups\lmllm.ini.bad
C:\Vundofix Backups\lmllm.ini2.bad
C:\Vundofix Backups\lmllm.tmp.bad
C:\Vundofix Backups\pmnmjhe.dll.bad
C:\Vundofix Backups\rqrollk.dll.bad
C:\Vundofix Backups\rqromnn.dll.bad
C:\Vundofix Backups\ssqomlk.dll.bad
C:\Vundofix Backups\wvvwa.bak1.bad
C:\Vundofix Backups\wvvwa.bak2.bad
C:\Vundofix Backups\wvvwa.ini.bad
C:\Vundofix Backups\wvvwa.ini2.bad
C:\Vundofix Backups\wvvwa.tmp.bad
C:\WINDOWS\system32\bbeeg.bak1
C:\WINDOWS\system32\egjlm.bak1
C:\WINDOWS\system32\egjlm.bak2
C:\WINDOWS\system32\egjlm.ini2
C:\WINDOWS\system32\fgjlm.bak1
C:\WINDOWS\system32\fgjlm.bak2
C:\WINDOWS\system32\fgjlm.ini2
C:\WINDOWS\system32\fhhkj.bak1
C:\WINDOWS\system32\gjkkj.bak1
C:\WINDOWS\system32\gjllm.bak1
C:\WINDOWS\system32\hjjlm.bak1
C:\WINDOWS\system32\hjkmp.bak1
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\jjllm.bak1
C:\WINDOWS\system32\jjllm.bak2
C:\WINDOWS\system32\kjkkj.bak1
C:\WINDOWS\system32\klkkj.bak1
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\nqtss.bak1
C:\WINDOWS\system32\orutv.bak1
C:\WINDOWS\system32\pqtss.bak1
C:\WINDOWS\system32\rqtss.bak1
C:\WINDOWS\system32\rtutv.bak1
C:\WINDOWS\system32\srqss.bak1
C:\WINDOWS\system32\ststv.bak1
C:\WINDOWS\system32\uttss.bak1
C:\WINDOWS\system32\wybeg.bak1
C:\WINDOWS\system32\wybeg.bak2
C:\WINDOWS\system32\wycdd.bak1
C:\WINDOWS\system32\wycdd.bak2
C:\WINDOWS\system32\yccdd.bak1
C:\WINDOWS\system32\yybeg.bak1

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))))))))
.

2007-12-02 00:35 . <REP> C:\Documents and Settings\Eric 2007-12-02 00:35 <REP> ValÚrie\Local Settings
2007-12-02 00:35 . <REP> C:\Documents and Settings\Eric 2007-12-02 00:35 <REP> ValÚrie\Local Settings
2007-12-01 18:50 . 2007-12-01 18:50 <REP> d-------- C:\Program Files\Trend Micro
2007-11-28 15:42 . 2007-12-02 12:03 <REP> d-------- C:\Program Files\The All-Seeing Eye
2007-11-27 18:45 . 2007-11-27 18:46 <REP> d-------- C:\Program Files\Windows Live
2007-11-25 14:49 . 2007-11-25 14:49 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-25 06:52 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-25 06:52 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-25 06:52 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-24 20:26 . 2007-11-24 20:29 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-11-24 20:26 . 2007-11-27 19:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-22 08:24 . 2007-11-22 08:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-20 00:09 . 2007-11-20 00:09 <REP> d-------- C:\Program Files\mnProjects
2007-11-18 16:52 . 2007-12-02 12:15 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-11-18 16:52 . 2007-11-18 16:52 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-11-18 16:52 . 2007-12-02 12:10 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-18 16:00 . 2007-11-25 08:52 <REP> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-11-17 11:35 . 2007-11-18 18:41 <REP> d-------- C:\Program Files\NCSoft
2007-11-17 11:35 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-11-14 07:08 . 2007-11-14 07:08 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-11-05 18:09 . 2007-11-05 18:45 <REP> d-------- C:\Program Files\Perfect World
2007-11-05 18:07 . 2007-11-05 17:38 258,352 --a------ C:\WINDOWS\system32\unicows.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-01 21:31 --------- d-----w C:\Program Files\eMule
2007-11-24 18:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-19 07:20 --------- d-----w C:\Program Files\Crawler
2007-11-18 17:44 --------- d-----w C:\Program Files\vanBasco's Karaoke Player
2007-11-18 17:44 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2007-11-18 17:44 --------- d-----w C:\Program Files\StuffPlug3
2007-11-18 17:44 --------- d-----w C:\Program Files\LimeWire
2007-11-18 17:44 --------- d-----w C:\Program Files\Heroes Ragnarok
2007-11-18 17:44 --------- d-----w C:\Program Files\FrenchOtto
2007-11-18 17:44 --------- d-----w C:\Program Files\FaxTools
2007-11-18 17:44 --------- d-----w C:\Program Files\DivX
2007-11-18 17:44 --------- d-----w C:\Program Files\Beneton Movie GIF
2007-11-18 17:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-18 17:39 --------- d-----w C:\Program Files\Jasc Software Inc
2007-10-23 10:29 --------- d-----w C:\Program Files\Net Pro Anti-Popup
2007-10-22 17:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
2007-10-22 17:08 --------- d-----w C:\Program Files\Microsoft
2007-10-21 15:20 --------- d-----w C:\Program Files\Red Kawa
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-11-06 15:03]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 21:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 08:27]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-10 21:00 C:\WINDOWS\system32\rundll32.exe]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-12-05 20:46]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 21:00]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

R1 fwdrv;Kerio Personal Firewall Driver;C:\WINDOWS\system32\Drivers\fwdrv.sys
S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
S3 psdfilter;psdfilter;\??\C:\WINDOWS\system32\Drivers\psdfilter.sys
S3 psdvdisk;psdvdisk;\??\C:\WINDOWS\system32\Drivers\psdvdisk.sys
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-07 09:03:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-02 13:06:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-02 13:07:31 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-02 08:48
C:\ComboFix3.txt ... 2007-12-02 00:35
.
--- E O F ---



Et le rapport HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:08:01, on 02/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezobho.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loïc\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

--
End of file - 9353 bytes

Répondre à loys@IDN
XmichouX   02-12-2007 à 13:13:46
- 0 +

Bien,

Télécharge sur ton bureau : Clean (de Malekal) >Tuto<
Dézippe le sur ton bureau. Double-clic sur ce dossier clean.
Double-clic sur clean.cmd. (L’extension cmd peut ne pas apparaître) Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé et poste le rapport ici.
Le rapport se trouve ici : C:\rapport_clean.txt

Si tu obtiens un fichier C:\upload_moi.zip, merci de faire ceci.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   02-12-2007 à 13:33:39
- 0 +

J'ai uploadé le fichier upload_moi.

Voici le rapport Clean:

02/12/2007 a 13:24:28,78

*** Recherche des fichiers dans C:
C:\StubInstaller.exe FOUND

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\mcrh.tmp FOUND

*** Recherche des fichiers dans C:\Program Files
C:\PROGRA~1\PERFEC~1\ FOUND



EDIT: En fait non, upload.malekal.com me dit "Vous n'avez pas choisi de fichier !".

Le fichier que j'ai obtenu n'était pas "C:\upload_moi.zip" mais "C:\upload_moi_TEYSSIER.tar.gz".


Message édité par loys@IDN le 02-12-2007 à 13:37:13
Répondre à loys@IDN
XmichouX   02-12-2007 à 14:15:12
- 0 +

Essaie de l'uploader sinon tan pis.

Télécharge AVG Anti-Spyware Installes-le.
Si le lien ne fonctionne pas : >Clique ici<
Lance AVG et fais une mise à jour.
Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglet comment réagir, clique sur Actions recommandées. Choisis Quarantaine.
Ne fais pas d’analyse pour le moment.
Redémarre en mode sans échec
/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\
Relance Avg.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas.
Clique sur "Enregistrer le rapport". Ceci génère un rapport qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
Poste le ici.
&
Toujours en mode sans échec, relance clean et fais l'option 2, poste le rapport.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   02-12-2007 à 16:40:54
- 0 +

Re,

Rapport AVG:

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 16:28:09 02/12/2007

+ Résultat de l'analyse:



HKU\S-1-5-21-2074014421-2895735302-1175302388-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{5D4831E0-5A7C-4A46-AFD5-A79AB8CE36C2} -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B89CEA26-ECB5-40D8-BB54-F267A162670D}\RP390\A0099821.exe -> Downloader.Tiny.id : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B89CEA26-ECB5-40D8-BB54-F267A162670D}\RP390\A0099826.exe -> Downloader.Tiny.id : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\ESET\infected\C5AD42CA.NQF -> Logger.VBStat.h : Nettoyé et sauvegardé (mise en quarantaine).
:mozilla.263:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.317:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.318:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.319:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.727:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.728:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.210:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.216:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.217:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.218:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.219:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.220:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.221:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.222:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.223:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.224:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.225:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.227:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.230:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.231:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.232:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.400:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.444:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.566:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.63:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.640:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.64:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.654:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.134:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.135:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.136:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.141:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.143:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.30:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.31:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.32:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.611:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.612:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.613:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@3.adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@stats.adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Nettoyé.
:mozilla.205:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.626:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.627:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.628:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.629:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.630:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.631:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.219:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.231:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.322:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.323:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.10:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.12:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.13:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.14:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.17:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.29:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.32:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.33:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.34:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.90:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.93:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.94:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.107:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.466:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.162:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.162:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.297:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.120:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.28:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.59:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.129:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.130:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.131:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.132:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.133:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.134:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.220:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.524:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.525:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.617:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.679:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Casinotropez : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@casinotropez[1].txt -> TrackingCookie.Casinotropez : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@www.casinotropez[1].txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.714:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Clickhype : Nettoyé.
:mozilla.423:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.424:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.425:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.74:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.75:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.76:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.313:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Counted : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@cpvfeed[3].txt -> TrackingCookie.Cpvfeed : Nettoyé.
:mozilla.729:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Cqcounter : Nettoyé.
:mozilla.109:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.23:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.66:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.133:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.246:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.31:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.459:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.655:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.656:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.100:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.101:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.102:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.103:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.104:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.105:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.106:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.107:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.108:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.237:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.238:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.239:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.58:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.59:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.60:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.62:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@fastclick[1].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@fastclick[1].txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.199:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.343:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.637:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.405:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.406:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.407:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.458:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.577:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.578:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.579:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.580:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.662:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.757:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.81:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.82:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.831:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.832:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@ehg-warnerbrothers.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@ehg-dig.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@ehg.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.197:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.198:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.358:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.359:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@ivwbox[2].txt -> TrackingCookie.Ivwbox : Nettoyé.
:mozilla.614:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Liveperson : Nettoyé.
:mozilla.151:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.344:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.71:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.27:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Netflame : Nettoyé.
:mozilla.517:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.518:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.127:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.165:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.165:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.607:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@overture[2].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Nettoyé.
:mozilla.116:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.
:mozilla.117:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.
:mozilla.419:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Questionmarket : Nettoyé.
:mozilla.420:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Questionmarket : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@realmedia[2].txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.804:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.805:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.806:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.807:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.808:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.809:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.117:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.118:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.119:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.120:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.121:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.122:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.123:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.142:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.143:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.144:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.145:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.146:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.147:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.148:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.240:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.241:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.242:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.243:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.244:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.245:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.246:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.370:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.371:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.116:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.117:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.118:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.119:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.18:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.19:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.19:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.20:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.20:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.21:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.21:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.22:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.22:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.23:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.235:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.236:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.329:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.330:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.331:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.49:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.53:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.54:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.55:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.56:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.100:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.101:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.102:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.20:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.23:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.24:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.25:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.67:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.68:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.69:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.70:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.99:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.606:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.
:mozilla.229:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Vegasred : Nettoyé.
:mozilla.41:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.42:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.43:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.55:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.57:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.58:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.63:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.64:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.65:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.673:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@statse.webtrendslive[3].txt -> TrackingCookie.Webtrendslive : Nettoyé.
:mozilla.263:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.264:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.265:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.266:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.267:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.45:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.46:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.47:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.48:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.50:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.51:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.52:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.542:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.543:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.544:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.137:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.138:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.139:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.140:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.142:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.268:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.269:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.270:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.271:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.272:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.273:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.274:C:\Documents and Settings\Loïc\Application Data\Mozilla\Firefox\Profiles\8b3jolt2.default\cookies-1.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.491:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.492:C:\Documents and Settings\Eric & Valérie\Application Data\Mozilla\Firefox\Profiles\j6dseoa2.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
C:\Documents and Settings\Eric & Valérie\Cookies\eric_&_valérie@zedo[1].txt -> TrackingCookie.Zedo : Nettoyé.
C:\Documents and Settings\Loïc\Cookies\loïc@zedo[2].txt -> TrackingCookie.Zedo : Nettoyé.
C:\Program Files\ESET\infected\3AQ2TSDA.NQF -> Trojan.BHO.bd : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\awtuspo.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\wvuvurs.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport



Rapport Clean:

Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 02/12/2007 a 16:29:02,65

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:
tentative de suppression de C:\StubInstaller.exe

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32
tentative de suppression de C:\WINDOWS\system32\mcrh.tmp

*** Suppression des fichiers dans C:\Program Files
tentative de suppression de C:\PROGRA~1\PERFEC~1\

*** Suppression des clefs du registre effectuee..

Répondre à loys@IDN
XmichouX   02-12-2007 à 23:13:58
- 0 +

Bien, reposte un Hijackthis.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   02-12-2007 à 23:17:17
- 0 +

Voila:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:17:05, on 02/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\ESET\nod32kui.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezobho.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loïc\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

--
End of file - 9531 bytes

Répondre à loys@IDN
XmichouX   02-12-2007 à 23:21:08
- 0 +

Re,

Relance HiJackThis, do a system scan only, coche ces lignes :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66006
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezobho.dll (file missing)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loïc\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)


Puis Fix Checked !


Fais une analyse antivirus en ligne sur Kaspersky avec Internet Explorer. (Tuto)
Autorise les active x.
Clique sur Démarrer Online Scanner.
Sélectionne le poste de travail comme analyse. Enregistres sous le rapport en format .txt.
Colle son rapport ici.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   03-12-2007 à 19:09:32
- 0 +

Voila, il en a trouvé beaucoup ^^'.

Je l'ai uploadé sur partage-facile parce que ça me fesait planter firefox quand je le c/c sur le forum.

Voici le lien : http://www.partage-facile.com/1122 [...] y.txt.html

Répondre à loys@IDN
XmichouX   03-12-2007 à 20:03:31
- 0 +

Re,

 

Supprime C:\Program Files\eMule\Incomplete\T-217706-Menace.Sur.La.Planete.Rap.2007.PAL.FRENCH.COMPLETE.MDVDR-NRV.zip

 

Vide ce dossier : Je suppose que c'est la quarantaine de nod32 : C:\Program Files\ESET\infected

 

Désactive-réactive la restauration système

 

Désinstalle, supprime tous les logiciels utilisés pour la désinfection ainsi que les dossiers créés correspondants.. Garde ccleaner, avg et antivir si nous les avons installé..
Rapporte ton infection sur Malware Complaints >Tuto<
Ton(tes) infection(s) : Vundo

 

Puis regarde ces pages :

 

Sécuriser son Ordinateur
cracks/P2P

 

Toujours des problèmes ?


Message édité par XmichouX le 03-12-2007 à 20:04:12
------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   03-12-2007 à 21:06:18
- 0 +

Je te remercie beaucoup pour ton aide, apparement il n'y a plus de problèmes. Je repasserai dans quelques jours pour dire si des virus se sont encore manifestés ou pas.

J'ai rapporté mon infection sur Malware Complaints.

Merci pour tes liens sur la sécurité de l'ordinateur et le risque des cracks/P2P, ils me seront utiles :).

Encore un grand merci pour ton aide.

Bonne continuation ;).

Répondre à loys@IDN
XmichouX   03-12-2007 à 21:12:06
- 0 +

Pas de problème,
bonne soirée ;)

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   05-12-2007 à 21:18:14
- 0 +

En effet, j'ai encore un petit problème. Mon Pc ne s'éteint plus, lorsque j'essaye de l'arrêter, il reste bloqué sur l'écran bleu " Fermeture de Windows ". Je suis obligé de l'éteindre avec un appui prolongé sur le bouton arret. =S

Répondre à loys@IDN
XmichouX   05-12-2007 à 22:28:54
- 0 +

Pfou ...
Reposte un Hijackthis & Combofix.

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   05-12-2007 à 22:44:58
- 0 +

Merci de ton aide :)

Voila le rapport HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:37:32, on 05/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\ESET\nod32kui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: NOD32 Control Center.lnk = C:\Program Files\ESET\nod32kui.exe
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

--
End of file - 7142 bytes



Et le rapport Combofix:

ComboFix 07-12-02.6 - Loïc 2007-12-05 22:39:28.4 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.315 [GMT 1:00]
Running from: C:\Documents and Settings\Loïc\Bureau\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-05 to 2007-12-05 ))))))))))))))))))))))))))))))))))))
.

2007-12-05 22:37 . 2007-12-05 22:37 <REP> d-------- C:\Program Files\Trend Micro
2007-12-04 18:27 . 2007-12-04 18:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-12-04 18:27 . 2007-12-04 23:36 624,672 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-12-04 18:27 . 2007-12-04 18:27 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-12-04 18:27 . 2007-06-21 21:54 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-12-04 18:27 . 2007-12-04 18:27 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-12-04 18:27 . 2007-06-21 21:55 54,672 --a------ C:\WINDOWS\system32\vsutil_loc040c.dll
2007-12-04 18:27 . 2007-06-21 21:55 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2007-12-04 18:27 . 2007-06-21 21:55 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc040c.dll
2007-12-04 18:27 . 2007-06-21 21:55 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc040c.dll
2007-12-04 18:27 . 2007-12-04 23:36 8,396 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-12-04 18:27 . 2007-12-04 18:29 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-12-04 18:25 . 2007-12-05 22:35 <REP> d-------- C:\WINDOWS\Internet Logs
2007-12-04 12:45 . <REP> C:\Documents and Settings\Eric 2007-12-04 12:45 <REP> Valérie\Application Data\Grisoft
2007-12-04 08:15 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-02 23:46 . 2007-12-02 23:46 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-02 23:46 . 2007-12-02 23:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-02 16:44 . 2007-12-02 16:44 <REP> d-------- C:\Program Files\Gravity
2007-12-02 15:23 . 2007-12-02 15:23 <REP> d-------- C:\Documents and Settings\Loïc\Application Data\Grisoft
2007-12-02 15:23 . 2007-12-02 15:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-02 15:23 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-02 00:35 . <REP> C:\Documents and Settings\Eric 2007-12-02 00:35 <REP> ValÚrie\Local Settings
2007-11-28 15:42 . 2007-12-02 12:03 <REP> d-------- C:\Program Files\The All-Seeing Eye
2007-11-27 18:45 . 2007-11-27 18:46 <REP> d-------- C:\Program Files\Windows Live
2007-11-25 14:49 . 2007-11-25 14:49 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-25 06:52 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-25 06:52 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-25 06:52 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-24 20:26 . 2007-11-24 20:29 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-11-24 20:26 . 2007-11-27 19:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-22 08:24 . 2007-11-22 08:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-20 00:09 . 2007-11-20 00:09 <REP> d-------- C:\Program Files\mnProjects
2007-11-18 16:52 . 2007-12-02 12:15 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-11-18 16:52 . 2007-11-18 16:52 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-11-18 16:52 . 2007-12-02 12:10 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-18 16:00 . 2007-11-25 08:52 <REP> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-11-17 11:35 . 2007-11-18 18:41 <REP> d-------- C:\Program Files\NCSoft
2007-11-17 11:35 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-11-14 07:08 . 2007-11-14 07:08 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-11-05 18:07 . 2007-11-05 17:38 258,352 --a------ C:\WINDOWS\system32\unicows.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-05 21:10 --------- d-----w C:\Program Files\Heroes Ragnarok
2007-12-04 19:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-04 11:54 --------- d-----w C:\Program Files\eMule
2007-12-04 11:45 --------- d-----w C:\Documents and Settings\Eric & Valérie\Application Data\Grisoft
2007-12-04 07:15 --------- d-----w C:\Program Files\Java
2007-11-24 18:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-19 07:20 --------- d-----w C:\Program Files\Crawler
2007-11-18 17:44 --------- d-----w C:\Program Files\vanBasco's Karaoke Player
2007-11-18 17:44 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2007-11-18 17:44 --------- d-----w C:\Program Files\LimeWire
2007-11-18 17:44 --------- d-----w C:\Program Files\FrenchOtto
2007-11-18 17:44 --------- d-----w C:\Program Files\FaxTools
2007-11-18 17:44 --------- d-----w C:\Program Files\DivX
2007-11-18 17:44 --------- d-----w C:\Program Files\Beneton Movie GIF
2007-11-18 17:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-18 17:39 --------- d-----w C:\Program Files\Jasc Software Inc
2007-10-23 10:29 --------- d-----w C:\Program Files\Net Pro Anti-Popup
2007-10-22 17:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
2007-10-22 17:08 --------- d-----w C:\Program Files\Microsoft
2007-10-21 15:20 --------- d-----w C:\Program Files\Red Kawa
2007-10-21 14:23 --------- d-----w C:\Documents and Settings\Loïc\Application Data\Radios Media Player
2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2007-09-28 16:08 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-09-28 16:07 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-09-28 16:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-09-28 16:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-09-28 16:07 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-03-14 21:06 583 ----a-w C:\Documents and Settings\Loïc\clean.reg
2007-03-14 21:06 583 ----a-w C:\Documents and Settings\Loïc\clean.reg
2007-02-18 19:45 3,992,288 ----a-w C:\Documents and Settings\Loïc\TRACE_BOOT+DRIVERS_1_1.BIN
2007-02-18 19:45 3,992,288 ----a-w C:\Documents and Settings\Loïc\TRACE_BOOT+DRIVERS_1_1.BIN
.

((((((((((((((((((((((((((((( snapshot@2007-12-02_ 0.34.47.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-10-24 02:01:44 780,800 ----a-w C:\WINDOWS\Resources\Themes\Zune\Shell\NormalColor\shellstyle.dll
+ 2007-05-30 23:03:48 110,360 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
+ 2007-05-30 23:03:50 119,576 ----a-w C:\WINDOWS\system32\drivers\klif.sys
- 2007-11-08 14:11:45 189,792 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2007-12-05 07:28:59 191,384 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2006-12-15 00:30:58 49,248 ----a-w C:\WINDOWS\system32\java.exe
+ 2007-09-24 21:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2006-12-15 00:31:06 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-24 21:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2006-12-15 02:09:14 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2007-09-24 22:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 11:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 14:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 14:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-06-21 20:54:26 796,048 ----a-w C:\WINDOWS\system32\libeay32_0.9.6l.dll
+ 2007-06-21 20:54:30 83,432 ----a-w C:\WINDOWS\system32\vsdata.dll
+ 2007-06-21 20:54:52 394,984 ----a-w C:\WINDOWS\system32\vsdatant.sys
+ 2007-06-21 20:54:32 157,160 ----a-w C:\WINDOWS\system32\vsinit.dll
+ 2007-06-21 20:54:32 103,912 ----a-w C:\WINDOWS\system32\vsmonapi.dll
+ 2007-06-21 20:54:32 275,944 ----a-w C:\WINDOWS\system32\vspubapi.dll
+ 2007-06-21 20:54:32 71,144 ----a-w C:\WINDOWS\system32\vsregexp.dll
+ 2007-06-21 20:54:34 472,552 ----a-w C:\WINDOWS\system32\vsutil.dll
+ 2007-06-21 20:54:34 46,568 ----a-w C:\WINDOWS\system32\vswmi.dll
+ 2007-06-21 20:54:34 99,816 ----a-w C:\WINDOWS\system32\vsxml.dll
+ 2007-06-21 20:54:34 83,432 ----a-w C:\WINDOWS\system32\zlcomm.dll
+ 2007-06-21 20:54:34 71,144 ----a-w C:\WINDOWS\system32\zlcommdb.dll
+ 2007-06-21 20:54:24 366,112 ----a-w C:\WINDOWS\system32\ZoneLabs\av.dll
+ 2007-06-21 20:55:26 26,000 ----a-w C:\WINDOWS\system32\ZoneLabs\av_loc040c.dll
+ 2007-05-30 23:03:30 65,248 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\aphish.dat
+ 2006-06-30 13:47:36 21,568 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\avcmhk4.dll
+ 2007-05-30 23:03:16 77,824 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHComm.dll
+ 2007-05-30 23:03:16 110,592 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHrule.dll
+ 2007-05-30 23:03:16 331,776 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHUM.dll
+ 2007-05-30 23:03:16 38,400 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\FSSync.dll
+ 2006-09-19 22:12:14 208,960 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\inv.dll
+ 2007-05-30 23:03:16 258,048 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\kave.dll
+ 2006-12-19 17:13:52 1,093,632 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\libeay32.dll
+ 2007-05-30 23:03:20 548,864 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcp80.dll
+ 2007-05-30 23:03:20 626,688 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcr80.dll
+ 2007-05-30 23:03:18 184,320 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prloader.dll
+ 2007-05-30 23:03:22 90,112 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prremote.dll
+ 2007-05-30 23:03:18 118,784 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
+ 2006-12-19 17:13:52 200,704 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ssleay32.dll
+ 2007-06-21 20:54:24 99,816 ----a-w C:\WINDOWS\system32\ZoneLabs\camupd.dll
+ 2007-06-21 20:55:26 17,808 ----a-w C:\WINDOWS\system32\ZoneLabs\camupd_loc040c.dll
+ 2004-01-30 11:35:08 813,568 ----a-w C:\WINDOWS\system32\ZoneLabs\dbghelp.dll
+ 2007-06-21 20:54:24 128,480 ----a-w C:\WINDOWS\system32\ZoneLabs\fbl.dll
+ 2007-06-21 20:54:26 38,376 ----a-w C:\WINDOWS\system32\ZoneLabs\featuremap.dll
+ 2007-06-21 20:54:26 321,016 ----a-w C:\WINDOWS\system32\ZoneLabs\imsecure.dll
+ 2007-06-21 20:55:28 26,000 ----a-w C:\WINDOWS\system32\ZoneLabs\imsecure_loc040c.dll
+ 2007-06-21 20:55:26 288,144 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\ConfigWizard_loc040c.zip.dll
+ 2007-06-21 20:55:28 152,976 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\LicenseUI_loc040c.zip.dll
+ 2007-06-21 20:54:54 26,000 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zlsvc.zip.dll
+ 2007-06-21 20:54:54 1,361,296 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zpy.zip.dll
+ 2007-06-21 20:54:54 71,056 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zui.zip.dll
+ 2007-06-21 20:56:16 30,184 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\rpc_server\rpc_server.dll
+ 2007-06-21 20:56:16 30,216 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll
+ 2007-06-11 11:43:50 714,472 ----a-w C:\WINDOWS\system32\ZoneLabs\qrbase.dll
+ 2007-06-11 11:43:52 788,200 ----a-w C:\WINDOWS\system32\ZoneLabs\qrsrecl.dll
+ 2007-06-21 20:54:28 173,544 ----a-w C:\WINDOWS\system32\ZoneLabs\scheduler.dll
+ 2007-06-21 20:55:30 17,808 ----a-w C:\WINDOWS\system32\ZoneLabs\scheduler_loc040c.dll
+ 2007-01-11 10:12:08 2,432,259 ----a-w C:\WINDOWS\system32\ZoneLabs\spyware.dat
+ 2007-06-11 11:43:56 1,496,808 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.dll
+ 2007-06-11 11:44:10 50,416 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.sys
+ 2007-06-21 20:54:28 456,168 ----a-w C:\WINDOWS\system32\ZoneLabs\ssleay32.dll
+ 2007-06-21 20:56:16 210,432 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\httpblocker\httpblocker.dll
+ 2007-06-21 20:56:18 3,229,176 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\imslsp\imslsp.dll
+ 2007-06-21 20:55:28 26,000 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\imslsp\imslsp_loc040c.dll
+ 2006-09-04 19:59:14 503,875 ----a-w C:\WINDOWS\system32\ZoneLabs\upd_core.dll
+ 2007-12-04 18:12:46 833,248 ----a-w C:\WINDOWS\system32\ZoneLabs\updating.dll
+ 2007-06-21 20:54:46 144,936 ----a-w C:\WINDOWS\system32\ZoneLabs\updclient.exe
+ 2007-06-21 20:55:30 75,152 ----a-w C:\WINDOWS\system32\ZoneLabs\updClient_loc040c.dll
+ 2007-01-11 16:31:06 286,787 ----a-w C:\WINDOWS\system32\ZoneLabs\updtrsdk.dll
+ 2007-06-21 20:54:30 108,008 ----a-w C:\WINDOWS\system32\ZoneLabs\vsavpro.dll
+ 2007-06-21 20:54:30 79,336 ----a-w C:\WINDOWS\system32\ZoneLabs\vsdb.dll
+ 2007-06-21 20:55:30 17,808 ----a-w C:\WINDOWS\system32\ZoneLabs\vsdb_loc040c.dll
+ 2007-06-21 20:54:46 75,304 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmon.exe
+ 2007-06-21 20:55:30 46,480 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmon_loc040c.dll
+ 2007-06-21 20:54:32 2,024,936 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmondll.dll
+ 2007-06-21 20:54:32 1,345,000 ----a-w C:\WINDOWS\system32\ZoneLabs\vsruledb.dll
+ 2007-06-21 20:55:30 198,032 ----a-w C:\WINDOWS\system32\ZoneLabs\vsruledb_loc040c.dll
+ 2007-06-21 20:54:34 243,176 ----a-w C:\WINDOWS\system32\ZoneLabs\vsvault.dll
+ 2007-06-21 20:55:30 17,808 ----a-w C:\WINDOWS\system32\ZoneLabs\vsvault_loc040c.dll
+ 2007-01-11 10:12:08 2,432,259 ----a-w C:\WINDOWS\system32\ZoneLabs\zlasdbup.dat
+ 2007-06-21 20:54:36 177,640 ----a-w C:\WINDOWS\system32\ZoneLabs\zlparser.dll
+ 2007-06-21 20:54:36 79,344 ----a-w C:\WINDOWS\system32\ZoneLabs\zlquarantine.dll
+ 2007-06-21 20:55:32 17,808 ----a-w C:\WINDOWS\system32\ZoneLabs\zlquarantine_loc040c.dll
+ 2007-06-21 20:54:36 378,344 ----a-w C:\WINDOWS\system32\ZoneLabs\zlsre.dll
+ 2007-06-21 20:55:32 21,904 ----a-w C:\WINDOWS\system32\ZoneLabs\zlsre_loc040c.dll
+ 2007-06-21 20:54:36 120,296 ----a-w C:\WINDOWS\system32\ZoneLabs\zlupdate.dll
+ 2007-06-21 20:54:40 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-11-06 15:03]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 21:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-10 21:00 C:\WINDOWS\system32\rundll32.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 21:00]

C:\Documents and Settings\Lo‹c\Menu D‚marrer\Programmes\D‚marrage\
NOD32 Control Center.lnk - C:\Program Files\ESET\nod32kui.exe [2006-12-05 19:57:00]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

S2 Ca533av;Icatch(IV) Video Camera Device;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 int15.sys;int15.sys;\??\C:\Acer\Empowering Technology\eRecovery\int15.sys
S3 psdfilter;psdfilter;\??\C:\WINDOWS\system32\Drivers\psdfilter.sys
S3 psdvdisk;psdvdisk;\??\C:\WINDOWS\system32\Drivers\psdvdisk.sys
S3 USBCamera;Icatch(IV) Still Camera Device;C:\WINDOWS\system32\Drivers\Bulk533.sys
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-07 09:03:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 22:42:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-05 22:42:51
.
--- E O F ---

Répondre à loys@IDN
XmichouX   06-12-2007 à 07:17:22
- 0 +

Ben.. plus d'infection visible :o :D

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
loys@IDN   06-12-2007 à 20:38:49
- 0 +

Problème reglé. Apres une série de redémarages réussis/ratés en terminant des processus dans le gestionnaire des tâches, j'ai fini par voir que c'était le processus " BTNtservice.exe" qui m'empechait de fermer Windows.
BTNtservice.exe est un processus du logiciel BlueSoleil (qui permet d'envoyer des fichiers via bluetooth avec un adaptateur USB).

Probleme reglé en supprimant BTNtservice.exe. Cela ne gene pas l'envoi/reception de fichiers via bluetooth.

J'ai ajouté "[Résolu]" au titre de mon topic.

Voila, je te remercie encore pour toute ton aide pour désinfecter mon PC. Bonne soirée à toi :D.

:hello:


Message édité par loys@IDN le 06-12-2007 à 20:41:56
Répondre à loys@IDN
XmichouX   06-12-2007 à 21:00:43
- 0 +

A toi aussi ;)

------------------------------ >> Centre de Formation Helpers <<
 Répondre à XmichouX
Créer un nouveau sujet Répondre
Tom's Guide > Forum > Sécurité - Virus > Pubs et awtqrqq & awvvw.dll [Résolu]
Aller à :

Il y a 1167 utilisateurs connus et inconnus. Pour voir la liste des connectés connus, cliquez ici.

Plan du forum
Forum Bestofmedia ©
2000-2009 Bestofmedia Group
Page générée en 0,926 secondes
Attention

Vous allez répondre sur un sujet resté inactif pendant plus de 6 mois.
Assurez-vous d'apporter des éléments nouveaux à la discussion avant de poursuivre.

Répondre Annuler
Liens