[RESOLU] virus msn party_jpg

Bonjour,

Comme beaucoup de monde j'ai été infecté par le virus party_jpg un dossier compressé attrapé par msn... Après une recherche sur le forum j'ai analysé mon pc avec msnfix et hijackthis dont voici le rapport : ( Je n'ai plus de problème avec msn mais j'ai tjs des fenetres intempestives sur internet qui reviennent toutes les 2 minutes et que je n'avais pas avant )

Merci

Logfile of HijackThis v1.99.1
Scan saved at 22:09:38, on 2/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\shpc32.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\NetMeeting\howypohoz77798.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pifziinhgjtlcjwmkfjqha. [...] 3EdiZ.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qcoyelwoprzqhkebljgdfh. [...] YePbc.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C7A7D216-15AE-4E2B-DA2B-4CE6058208C7} - C:\WINDOWS\system32\hfc.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [xkstartup] RunDll32 insxk35c.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [SHPC32] shpc32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Style For Eggs Idle] C:\Documents and Settings\All Users\Application Data\BROWSE PROGRAM STYLE FOR\admin option.exe
O4 - HKLM\..\Run: [howypohoz] C:\Program Files\NetMeeting\howypohoz77798.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [film warn] C:\DOCUME~1\ben\APPLIC~1\GRAMJU~1\Roam Enc.exe
O4 - HKCU\..\Run: [DesktopX] "C:\PROGRA~1\STARDOCK\OBJECT~1\DESKTOPX\DesktopX.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\Party poker\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\Party poker\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Merci pout ton aide... Voici les rapports :

MSNFix 1.597

C:\Documents and Settings\ben\Bureau\MSNFix
Fix exécuté le dim. 02/12/2007 - 22:22:26.04 By ben
mode normal

************************ Recherche les fichiers présents

Aucun Fichier trouvé

************************ Recherche les dossiers présents

Aucun dossier trouvé


************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[C:\DOC.EXE] 6FB9A3FC9E4B1EFCCDAAEC4307E24511
[C:\WGC_DOSS.EXE] 8BA89CC4F1338CEE5C5C417C058EAD59
[C:\MAKEDIR.EXE] 572DF349CA1A20CBEF65A491F7C4A109

[color=#FF0000]==>[/color] SVP merci d'envoyer le fichier C:\DOCUME~1\ben\Bureau\Upload_Me.zip sur http://upload.changelog.fr




------------------------------------------------------------------------
Auteur : !aur3n7 Contact: http://changelog.fr
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

Search Navipromo version 3.3.6 commencé le mer. 05/12/2007 à 18:54:55.48

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 14.11.2007 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180


*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\DOCUME~1\ben\APPLIC~1 ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\BEN\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans C:\DOCUME~1\BEN\LOCALS~1\APPLIC~1 *



*** Recherche fichiers ***




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse terminée le mer. 05/12/2007 à 18:55:37.55 ***

Voici mon nouveau rapport :


-----------------------------[ Lop S&D 2.0.1 ]---------------------------

Microsoft Windows XP [version 5.1.2600] [ OS : Windows_NT ]

"C:\Program Files\Lop SD"

[ jeu. 06/12/2007 | 14:34:20.24 ] [ CHAIDRONB ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Supprimé! - C:\WINDOWS\Tasks\B08E7B939041F157.job
Echec ! - C:\Documents and Settings\All Users\APPLIC~1\BROWSE~1
Supprimé! - C:\Documents and Settings\ben\APPLIC~1\GRAMJU~1
Echec ! - C:\Documents and Settings\All Users\APPLIC~1\BROWSE PROGRAM STYLE FOR\admin option.exe
Restauré! - Fichier Hosts

\\\\\\\\\\\\\\\\\\\\\\\\\\\ DEUXIEME PASSAGE ///////////////////////////

Echec ! - C:\Documents and Settings\All Users\APPLIC~1\BROWSE~1
Echec ! - C:\Documents and Settings\All Users\APPLIC~1\BROWSE PROGRAM STYLE FOR\admin option.exe

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


-------------[ Listing des dossiers dans Application Data ]------------

C:\Documents and Settings\Default User\APPLIC~1\desktop.ini
C:\Documents and Settings\Default User\APPLIC~1\Microsoft

C:\Documents and Settings\All Users\APPLIC~1\WLInstaller
C:\Documents and Settings\All Users\APPLIC~1\Adobe
C:\Documents and Settings\All Users\APPLIC~1\memo meow idle browse
C:\Documents and Settings\All Users\APPLIC~1\BROWSE PROGRAM STYLE FOR
C:\Documents and Settings\All Users\APPLIC~1\ABBYY
C:\Documents and Settings\All Users\APPLIC~1\Windows Genuine Advantage
C:\Documents and Settings\All Users\APPLIC~1\blehbitssetupthird
C:\Documents and Settings\All Users\APPLIC~1\Spybot - Search & Destroy
C:\Documents and Settings\All Users\APPLIC~1\Autodesk
C:\Documents and Settings\All Users\APPLIC~1\MSScanAppDataDir
C:\Documents and Settings\All Users\APPLIC~1\Symantec
C:\Documents and Settings\All Users\APPLIC~1\desktop.ini
C:\Documents and Settings\All Users\APPLIC~1\Microsoft

C:\Documents and Settings\NetworkService\APPLIC~1\Microsoft

C:\Documents and Settings\LocalService\APPLIC~1\Microsoft

C:\Documents and Settings\Invit‚\APPLIC~1\Help
C:\Documents and Settings\Invit‚\APPLIC~1\Macromedia
C:\Documents and Settings\Invit‚\APPLIC~1\Real
C:\Documents and Settings\Invit‚\APPLIC~1\Identities
C:\Documents and Settings\Invit‚\APPLIC~1\desktop.ini
C:\Documents and Settings\Invit‚\APPLIC~1\Microsoft

C:\Documents and Settings\Administrateur\APPLIC~1\desktop.ini
C:\Documents and Settings\Administrateur\APPLIC~1\Microsoft

C:\Documents and Settings\ben\APPLIC~1\BearShare
C:\Documents and Settings\ben\APPLIC~1\U3
C:\Documents and Settings\ben\APPLIC~1\Canon
C:\Documents and Settings\ben\APPLIC~1\dm.ini
C:\Documents and Settings\ben\APPLIC~1\IrfanView
C:\Documents and Settings\ben\APPLIC~1\Google
C:\Documents and Settings\ben\APPLIC~1\AdobeUM
C:\Documents and Settings\ben\APPLIC~1\DMCache
C:\Documents and Settings\ben\APPLIC~1\Adobe
C:\Documents and Settings\ben\APPLIC~1\Kazaa Lite
C:\Documents and Settings\ben\APPLIC~1\Help
C:\Documents and Settings\ben\APPLIC~1\Macromedia
C:\Documents and Settings\ben\APPLIC~1\Sun
C:\Documents and Settings\ben\APPLIC~1\Lavasoft
C:\Documents and Settings\ben\APPLIC~1\Real
C:\Documents and Settings\ben\APPLIC~1\Identities
C:\Documents and Settings\ben\APPLIC~1\desktop.ini
C:\Documents and Settings\ben\APPLIC~1\Microsoft

----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

C:\WINDOWS\tasks\SA.DAT
C:\WINDOWS\tasks\desktop.ini

---------------[ Listing des dossiers dans C:\Program Files ]--------------

C:\Program Files\802.11 Wireless LAN
C:\Program Files\ABBYY PDF Transformer 2.0
C:\Program Files\Adobe
C:\Program Files\Ahead
C:\Program Files\AutoCAD LT 2000
C:\Program Files\Autodesk
C:\Program Files\BearFlix
C:\Program Files\Bearshare
C:\Program Files\byLight
C:\Program Files\Canon
C:\Program Files\Cisco Systems
C:\Program Files\Common Files
C:\Program Files\CWshredder
C:\Program Files\CyberLink
C:\Program Files\DesignCAD Pro 5000
C:\Program Files\directx
C:\Program Files\DivX
C:\Program Files\Fichiers communs
C:\Program Files\Hewlett-Packard
C:\Program Files\Hijackthis Version Fran‡aise
C:\Program Files\hp deskjet 3820 series
C:\Program Files\Internet Explorer
C:\Program Files\IrfanView
C:\Program Files\Java
C:\Program Files\K-Lite Codec Pack
C:\Program Files\Lavasoft
C:\Program Files\Logitech
C:\Program Files\Lop SD
C:\Program Files\Macromedia
C:\Program Files\Maxthon
C:\Program Files\Messenger Plus! Live
C:\Program Files\Microsoft CAPICOM 2.1.0.2
C:\Program Files\microsoft frontpage
C:\Program Files\Microsoft IntelliPoint
C:\Program Files\Microsoft Office
C:\Program Files\Microsoft Visual Studio
C:\Program Files\Microsoft Works
C:\Program Files\Microsoft.NET
C:\Program Files\Movie Maker
C:\Program Files\MSN Gaming Zone
C:\Program Files\Navilog1
C:\Program Files\NetMeeting
C:\Program Files\Norton SystemWorks
C:\Program Files\OfficeUpdate11
C:\Program Files\Outlook Express
C:\Program Files\Party poker
C:\Program Files\Real
C:\Program Files\Samsung
C:\Program Files\Services en ligne
C:\Program Files\Spybot - Search & Destroy
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus
C:\Program Files\Winamp
C:\Program Files\Windows Journal Viewer
C:\Program Files\Windows Live
C:\Program Files\Windows Live Safety Center
C:\Program Files\Windows Media Components
C:\Program Files\Windows Media Connect 2
C:\Program Files\Windows Media Player
C:\Program Files\Windows NT
C:\Program Files\WinRAR
C:\Program Files\WinZip
C:\Program Files\xerox
C:\Program Files\Xing
C:\Program Files\ZyXEL Corporation

------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

C:\Program Files\Fichiers communs\Adobe
C:\Program Files\Fichiers communs\Ahead
C:\Program Files\Fichiers communs\Autodesk Shared
C:\Program Files\Fichiers communs\Canon
C:\Program Files\Fichiers communs\DESIGNER
C:\Program Files\Fichiers communs\Deterministic Networks
C:\Program Files\Fichiers communs\FotoWire
C:\Program Files\Fichiers communs\InstallShield
C:\Program Files\Fichiers communs\Java
C:\Program Files\Fichiers communs\Logitech
C:\Program Files\Fichiers communs\MAGIX Shared
C:\Program Files\Fichiers communs\Microsoft Shared
C:\Program Files\Fichiers communs\MSSoap
C:\Program Files\Fichiers communs\ODBC
C:\Program Files\Fichiers communs\Real
C:\Program Files\Fichiers communs\Services
C:\Program Files\Fichiers communs\SpeechEngines
C:\Program Files\Fichiers communs\stardock
C:\Program Files\Fichiers communs\Symantec Shared
C:\Program Files\Fichiers communs\System
C:\Program Files\Fichiers communs\Xing Shared

----------------------[ Recherche avec S_Lop ]---------------------

C:\Documents and Settings\All Users\APPLIC~1\BROWSE PROGRAM STYLE FOR\admin option.exe
C:\Documents and Settings\All Users\APPLIC~1\BROWSE~1

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

Aucun fichier / dossier Lop trouvé !

----------------------[ Verification du Registre ]----------------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 14:36:37
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden files ...
scan completed successfully
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

--------------------[ Fin du rapport a 14:36:40.94 ]----------------------

Voila c est posté sur upload je m occupe des autres rapports...

Et voila le rapport pour admin_option ( je pense qu il va deja ete mis en quarantaine par log s d ) :

Fichier admin_option.exe reçu le 2007.12.06 21:52:59 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 21/32 (65.63%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 4.
L'heure estimée de démarrage est entre 47 et 68 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.12.7.0 2007.12.06 -
AntiVir 7.6.0.34 2007.12.06 TR/Dldr.Swizzor.Gen
Authentium 4.93.8 2007.12.05 -
Avast 4.7.1098.0 2007.12.06 Win32bfuscated-BPS
AVG 7.5.0.503 2007.12.06 Downloader.Obfuskated
BitDefender 7.2 2007.12.06 Trojan.FatObfus.2.Gen
CAT-QuickHeal 9.00 2007.12.06 Trojan.Obfuscated.gen
ClamAV 0.91.2 2007.12.06 Trojan.Obfus-8
DrWeb 4.44.0.09170 2007.12.06 Trojan.Packed.149
eSafe 7.0.15.0 2007.12.06 -
eTrust-Vet 31.3.5356 2007.12.06 -
Ewido 4.0 2007.12.06 -
FileAdvisor 1 2007.12.06 -
Fortinet 3.14.0.0 2007.12.06 -
F-Prot 4.4.2.54 2007.12.05 W32/Heuristic-162!Eldorado
F-Secure 6.70.13030.0 2007.12.06 Trojan.Win32.Obfuscated.en
Ikarus T3.1.1.12 2007.12.06 not-a-virus:AdWare.Win32.Lop.ag
Kaspersky 7.0.0.125 2007.12.06 Trojan.Win32.Obfuscated.en
McAfee 5179 2007.12.06 Swizzor.gen.a
Microsoft 1.3007 2007.12.06 Trojan:Win32/C2Lop.C
NOD32v2 2707 2007.12.06 Win32/Obfuscated.A1
Norman 5.80.02 2007.12.06 W32/Lop.gen
Panda 9.0.0.4 2007.12.06 -
Prevx1 V2 2007.12.06 -
Rising 20.21.32.00 2007.12.06 Packer.RyCrypt
Sophos 4.24.0 2007.12.06 Mal/Swizzor-B
Sunbelt 2.2.907.0 2007.12.06 VIPRE.Suspicious
Symantec 10 2007.12.06 -
TheHacker 6.2.9.151 2007.12.05 -
VBA32 3.12.2.5 2007.12.05 MalwareScope.Trojan-Downloader.Obfuscated.2
VirusBuster 4.3.26:9 2007.12.06 Trojan.DL.Obfusc.Gen.8
Webwasher-Gateway 6.6.2 2007.12.06 Trojan.Dldr.Swizzor.Gen
Information additionnelle
File size: 1537536 bytes
MD5: 7da644f05c24334c7353dc74306567e0
SHA1: 934d19c946448b53c91ba138694386699e20e058
PEiD: -
packers: Malware_Prot.S
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

C:\Documents and Settings\All Users\Application Data\BROWSE PROGRAM STYLE FOR moved successfully.

Created on 12/07/2007 13:45:33




-----------------------------[ Lop S&D 2.0.1 ]---------------------------

Microsoft Windows XP [version 5.1.2600] [ OS : Windows_NT ]

"C:\Program Files\Lop SD"

[ ven. 07/12/2007 | 13:46:59.47 ] [ CHAIDRONB ]


-------------[ Listing des dossiers dans Application Data ]------------

C:\Documents and Settings\Default User\APPLIC~1\desktop.ini
C:\Documents and Settings\Default User\APPLIC~1\Microsoft

C:\Documents and Settings\All Users\APPLIC~1\WLInstaller
C:\Documents and Settings\All Users\APPLIC~1\Adobe
C:\Documents and Settings\All Users\APPLIC~1\memo meow idle browse
C:\Documents and Settings\All Users\APPLIC~1\ABBYY
C:\Documents and Settings\All Users\APPLIC~1\Windows Genuine Advantage
C:\Documents and Settings\All Users\APPLIC~1\blehbitssetupthird
C:\Documents and Settings\All Users\APPLIC~1\Spybot - Search & Destroy
C:\Documents and Settings\All Users\APPLIC~1\Autodesk
C:\Documents and Settings\All Users\APPLIC~1\MSScanAppDataDir
C:\Documents and Settings\All Users\APPLIC~1\Symantec
C:\Documents and Settings\All Users\APPLIC~1\desktop.ini
C:\Documents and Settings\All Users\APPLIC~1\Microsoft

C:\Documents and Settings\NetworkService\APPLIC~1\Microsoft

C:\Documents and Settings\LocalService\APPLIC~1\Microsoft

C:\Documents and Settings\Invit‚\APPLIC~1\Help
C:\Documents and Settings\Invit‚\APPLIC~1\Macromedia
C:\Documents and Settings\Invit‚\APPLIC~1\Real
C:\Documents and Settings\Invit‚\APPLIC~1\Identities
C:\Documents and Settings\Invit‚\APPLIC~1\desktop.ini
C:\Documents and Settings\Invit‚\APPLIC~1\Microsoft

C:\Documents and Settings\Administrateur\APPLIC~1\desktop.ini
C:\Documents and Settings\Administrateur\APPLIC~1\Microsoft

C:\Documents and Settings\ben\APPLIC~1\Gramjumproad
C:\Documents and Settings\ben\APPLIC~1\BearShare
C:\Documents and Settings\ben\APPLIC~1\U3
C:\Documents and Settings\ben\APPLIC~1\Canon
C:\Documents and Settings\ben\APPLIC~1\dm.ini
C:\Documents and Settings\ben\APPLIC~1\IrfanView
C:\Documents and Settings\ben\APPLIC~1\Google
C:\Documents and Settings\ben\APPLIC~1\AdobeUM
C:\Documents and Settings\ben\APPLIC~1\DMCache
C:\Documents and Settings\ben\APPLIC~1\Adobe
C:\Documents and Settings\ben\APPLIC~1\Kazaa Lite
C:\Documents and Settings\ben\APPLIC~1\Help
C:\Documents and Settings\ben\APPLIC~1\Macromedia
C:\Documents and Settings\ben\APPLIC~1\Sun
C:\Documents and Settings\ben\APPLIC~1\Lavasoft
C:\Documents and Settings\ben\APPLIC~1\Real
C:\Documents and Settings\ben\APPLIC~1\Identities
C:\Documents and Settings\ben\APPLIC~1\desktop.ini
C:\Documents and Settings\ben\APPLIC~1\Microsoft

----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

C:\WINDOWS\tasks\SA.DAT
C:\WINDOWS\tasks\desktop.ini

---------------[ Listing des dossiers dans C:\Program Files ]--------------

C:\Program Files\802.11 Wireless LAN
C:\Program Files\ABBYY PDF Transformer 2.0
C:\Program Files\Adobe
C:\Program Files\Ahead
C:\Program Files\AutoCAD LT 2000
C:\Program Files\Autodesk
C:\Program Files\BearFlix
C:\Program Files\Bearshare
C:\Program Files\byLight
C:\Program Files\Canon
C:\Program Files\Cisco Systems
C:\Program Files\Common Files
C:\Program Files\CWshredder
C:\Program Files\CyberLink
C:\Program Files\DesignCAD Pro 5000
C:\Program Files\directx
C:\Program Files\DivX
C:\Program Files\Fichiers communs
C:\Program Files\Hewlett-Packard
C:\Program Files\Hijackthis Version Fran‡aise
C:\Program Files\hp deskjet 3820 series
C:\Program Files\Internet Explorer
C:\Program Files\IrfanView
C:\Program Files\Java
C:\Program Files\K-Lite Codec Pack
C:\Program Files\Lavasoft
C:\Program Files\Logitech
C:\Program Files\Lop SD
C:\Program Files\Macromedia
C:\Program Files\Maxthon
C:\Program Files\Messenger Plus! Live
C:\Program Files\Microsoft CAPICOM 2.1.0.2
C:\Program Files\microsoft frontpage
C:\Program Files\Microsoft IntelliPoint
C:\Program Files\Microsoft Office
C:\Program Files\Microsoft Visual Studio
C:\Program Files\Microsoft Works
C:\Program Files\Microsoft.NET
C:\Program Files\Movie Maker
C:\Program Files\MSN Gaming Zone
C:\Program Files\Navilog1
C:\Program Files\NetMeeting
C:\Program Files\Norton SystemWorks
C:\Program Files\OfficeUpdate11
C:\Program Files\Outlook Express
C:\Program Files\Party poker
C:\Program Files\Real
C:\Program Files\Samsung
C:\Program Files\Services en ligne
C:\Program Files\Spybot - Search & Destroy
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus
C:\Program Files\Winamp
C:\Program Files\Windows Journal Viewer
C:\Program Files\Windows Live
C:\Program Files\Windows Live Safety Center
C:\Program Files\Windows Media Components
C:\Program Files\Windows Media Connect 2
C:\Program Files\Windows Media Player
C:\Program Files\Windows NT
C:\Program Files\WinRAR
C:\Program Files\WinZip
C:\Program Files\xerox
C:\Program Files\Xing
C:\Program Files\ZyXEL Corporation

------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

C:\Program Files\Fichiers communs\Adobe
C:\Program Files\Fichiers communs\Ahead
C:\Program Files\Fichiers communs\Autodesk Shared
C:\Program Files\Fichiers communs\Canon
C:\Program Files\Fichiers communs\DESIGNER
C:\Program Files\Fichiers communs\Deterministic Networks
C:\Program Files\Fichiers communs\FotoWire
C:\Program Files\Fichiers communs\InstallShield
C:\Program Files\Fichiers communs\Java
C:\Program Files\Fichiers communs\Logitech
C:\Program Files\Fichiers communs\MAGIX Shared
C:\Program Files\Fichiers communs\Microsoft Shared
C:\Program Files\Fichiers communs\MSSoap
C:\Program Files\Fichiers communs\ODBC
C:\Program Files\Fichiers communs\Real
C:\Program Files\Fichiers communs\Services
C:\Program Files\Fichiers communs\SpeechEngines
C:\Program Files\Fichiers communs\stardock
C:\Program Files\Fichiers communs\Symantec Shared
C:\Program Files\Fichiers communs\System
C:\Program Files\Fichiers communs\Xing Shared

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

Aucun fichier / dossier Lop trouvé !

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 13:48:55
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden files ...
scan completed successfully
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

--------------------[ Fin du rapport a 13:48:59.19 ]----------------------

Bonsoir!

Non les pops ups sont tjs la... C'est "ads.k8l.info" et "top-banners.com " tu connais peut-etre...

Voila le rapport de Clean :

sam. 08/12/2007 a 1:03:19.84

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\
C:\WINDOWS\smdat32m.sys FOUND

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files

Ok... Voici les rapports :

Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec mar. 11/12/2007 a 17:49:36.10

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\
tentative de suppression de C:\WINDOWS\smdat32m.sys

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !


Logfile of HijackThis v1.99.1
Scan saved at 18:14:22, on 11/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\shpc32.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\NetMeeting\howypohoz77798.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.othbicetsjpsgldrduv.com [...] 3EdiZ.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qcoyelwoprzqhkebljgdfh. [...] YePbc.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C7A7D216-15AE-4E2B-DA2B-4CE6058208C7} - C:\WINDOWS\system32\hfc.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [xkstartup] RunDll32 insxk35c.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [SHPC32] shpc32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [howypohoz] C:\Program Files\NetMeeting\howypohoz77798.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DesktopX] "C:\PROGRA~1\STARDOCK\OBJECT~1\DESKTOPX\DesktopX.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [film warn] C:\DOCUME~1\ben\APPLIC~1\GRAMJU~1\Roam Enc.exe
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\Party poker\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\Party poker\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Etape 1 OK

Etape 2 :

Fichier Insxk35c.dll reçu le 2007.12.12 13:59:17 (CET)Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.12.12.11 2007.12.12 -
AntiVir 7.6.0.40 2007.12.12 -
Authentium 4.93.8 2007.12.11 -
Avast 4.7.1098.0 2007.12.11 -
AVG 7.5.0.503 2007.12.12 -
BitDefender 7.2 2007.12.12 -
CAT-QuickHeal 9.00 2007.12.11 -
ClamAV 0.91.2 2007.12.12 -
DrWeb 4.44.0.09170 2007.12.12 -
eSafe 7.0.15.0 2007.12.11 -
eTrust-Vet 31.3.5371 2007.12.12 -
Ewido 4.0 2007.12.12 -
FileAdvisor 1 2007.12.12 -
Fortinet 3.14.0.0 2007.12.12 -
F-Prot 4.4.2.54 2007.12.11 -
F-Secure 6.70.13030.0 2007.12.12 -
Ikarus T3.1.1.12 2007.12.12 -
Kaspersky 7.0.0.125 2007.12.12 -
McAfee 5183 2007.12.11 -
Microsoft 1.3007 2007.12.12 -
NOD32v2 2719 2007.12.12 -
Norman 5.80.02 2007.12.11 -
Panda 9.0.0.4 2007.12.12 -
Prevx1 V2 2007.12.12 -
Rising 20.22.22.00 2007.12.12 -
Sophos 4.24.0 2007.12.12 -
Sunbelt 2.2.907.0 2007.12.12 -
Symantec 10 2007.12.12 -
TheHacker 6.2.9.155 2007.12.10 -
VBA32 3.12.2.5 2007.12.10 -
VirusBuster 4.3.26:9 2007.12.11 -
Webwasher-Gateway 6.6.2 2007.12.12 -

Information additionnelle
File size: 53248 bytes
MD5: 18f916317bb6c4988c1ab95f1b591848
SHA1: eaef154a751238c8d507692d27211182e3be6d00
PEiD: -

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2007.12.12.11 2007.12.12 -
AntiVir 7.6.0.40 2007.12.12 -
Authentium 4.93.8 2007.12.11 -
Avast 4.7.1098.0 2007.12.11 -
AVG 7.5.0.503 2007.12.12 -
BitDefender 7.2 2007.12.12 -
CAT-QuickHeal 9.00 2007.12.11 -
ClamAV 0.91.2 2007.12.12 -
DrWeb 4.44.0.09170 2007.12.12 -
eSafe 7.0.15.0 2007.12.11 -
eTrust-Vet 31.3.5371 2007.12.12 -
Ewido 4.0 2007.12.12 -
FileAdvisor 1 2007.12.12 -
Fortinet 3.14.0.0 2007.12.12 -
F-Prot 4.4.2.54 2007.12.11 -
F-Secure 6.70.13030.0 2007.12.12 -
Ikarus T3.1.1.12 2007.12.12 -
Kaspersky 7.0.0.125 2007.12.12 -
McAfee 5183 2007.12.11 -
Microsoft 1.3007 2007.12.12 -
NOD32v2 2719 2007.12.12 -
Norman 5.80.02 2007.12.11 -
Panda 9.0.0.4 2007.12.12 -
Prevx1 V2 2007.12.12 -
Rising 20.22.22.00 2007.12.12 -
Sophos 4.24.0 2007.12.12 -
Sunbelt 2.2.907.0 2007.12.12 -
Symantec 10 2007.12.12 -
TheHacker 6.2.9.155 2007.12.10 -
VBA32 3.12.2.5 2007.12.10 -
VirusBuster 4.3.26:9 2007.12.11 -
Webwasher-Gateway 6.6.2 2007.12.12 -

Information additionnelle
File size: 53248 bytes
MD5: 18f916317bb6c4988c1ab95f1b591848
SHA1: eaef154a751238c8d507692d27211182e3be6d00
PEiD: -

Etape 3 :


-----------------------------[ Lop S&D 2.0.1 ]---------------------------

Microsoft Windows XP [version 5.1.2600] [ OS : Windows_NT ]

"C:\Program Files\Lop SD"

[ mer. 12/12/2007 | 14:06:16.18 ] [ CHAIDRONB ]


-------------[ Listing des dossiers dans Application Data ]------------

C:\Documents and Settings\Default User\APPLIC~1\desktop.ini
C:\Documents and Settings\Default User\APPLIC~1\Microsoft

C:\Documents and Settings\All Users\APPLIC~1\TEMP
C:\Documents and Settings\All Users\APPLIC~1\WLInstaller
C:\Documents and Settings\All Users\APPLIC~1\Adobe
C:\Documents and Settings\All Users\APPLIC~1\memo meow idle browse
C:\Documents and Settings\All Users\APPLIC~1\ABBYY
C:\Documents and Settings\All Users\APPLIC~1\Windows Genuine Advantage
C:\Documents and Settings\All Users\APPLIC~1\blehbitssetupthird
C:\Documents and Settings\All Users\APPLIC~1\Spybot - Search & Destroy
C:\Documents and Settings\All Users\APPLIC~1\Autodesk
C:\Documents and Settings\All Users\APPLIC~1\MSScanAppDataDir
C:\Documents and Settings\All Users\APPLIC~1\Symantec
C:\Documents and Settings\All Users\APPLIC~1\desktop.ini
C:\Documents and Settings\All Users\APPLIC~1\Microsoft

C:\Documents and Settings\NetworkService\APPLIC~1\Microsoft

C:\Documents and Settings\LocalService\APPLIC~1\Microsoft

C:\Documents and Settings\Invit‚\APPLIC~1\Help
C:\Documents and Settings\Invit‚\APPLIC~1\Macromedia
C:\Documents and Settings\Invit‚\APPLIC~1\Real
C:\Documents and Settings\Invit‚\APPLIC~1\Identities
C:\Documents and Settings\Invit‚\APPLIC~1\desktop.ini
C:\Documents and Settings\Invit‚\APPLIC~1\Microsoft

C:\Documents and Settings\Administrateur\APPLIC~1\desktop.ini
C:\Documents and Settings\Administrateur\APPLIC~1\Microsoft

C:\Documents and Settings\ben\APPLIC~1\Gramjumproad
C:\Documents and Settings\ben\APPLIC~1\BearShare
C:\Documents and Settings\ben\APPLIC~1\U3
C:\Documents and Settings\ben\APPLIC~1\Canon
C:\Documents and Settings\ben\APPLIC~1\dm.ini
C:\Documents and Settings\ben\APPLIC~1\IrfanView
C:\Documents and Settings\ben\APPLIC~1\Google
C:\Documents and Settings\ben\APPLIC~1\AdobeUM
C:\Documents and Settings\ben\APPLIC~1\DMCache
C:\Documents and Settings\ben\APPLIC~1\Adobe
C:\Documents and Settings\ben\APPLIC~1\Kazaa Lite
C:\Documents and Settings\ben\APPLIC~1\Help
C:\Documents and Settings\ben\APPLIC~1\Macromedia
C:\Documents and Settings\ben\APPLIC~1\Sun
C:\Documents and Settings\ben\APPLIC~1\Lavasoft
C:\Documents and Settings\ben\APPLIC~1\Real
C:\Documents and Settings\ben\APPLIC~1\Identities
C:\Documents and Settings\ben\APPLIC~1\desktop.ini
C:\Documents and Settings\ben\APPLIC~1\Microsoft

----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

C:\WINDOWS\tasks\SA.DAT
C:\WINDOWS\tasks\desktop.ini

---------------[ Listing des dossiers dans C:\Program Files ]--------------

C:\Program Files\802.11 Wireless LAN
C:\Program Files\ABBYY PDF Transformer 2.0
C:\Program Files\Adobe
C:\Program Files\Ahead
C:\Program Files\AutoCAD LT 2000
C:\Program Files\Autodesk
C:\Program Files\BearFlix
C:\Program Files\Bearshare
C:\Program Files\byLight
C:\Program Files\Canon
C:\Program Files\Cisco Systems
C:\Program Files\Common Files
C:\Program Files\CWshredder
C:\Program Files\CyberLink
C:\Program Files\DesignCAD Pro 5000
C:\Program Files\directx
C:\Program Files\DivX
C:\Program Files\Fichiers communs
C:\Program Files\Hewlett-Packard
C:\Program Files\Hijackthis Version Fran‡aise
C:\Program Files\hp deskjet 3820 series
C:\Program Files\Internet Explorer
C:\Program Files\IrfanView
C:\Program Files\Java
C:\Program Files\K-Lite Codec Pack
C:\Program Files\Lavasoft
C:\Program Files\Logitech
C:\Program Files\Lop SD
C:\Program Files\Macromedia
C:\Program Files\Maxthon
C:\Program Files\Messenger Plus! Live
C:\Program Files\Microsoft CAPICOM 2.1.0.2
C:\Program Files\microsoft frontpage
C:\Program Files\Microsoft IntelliPoint
C:\Program Files\Microsoft Office
C:\Program Files\Microsoft Visual Studio
C:\Program Files\Microsoft Works
C:\Program Files\Microsoft.NET
C:\Program Files\Movie Maker
C:\Program Files\MSN Gaming Zone
C:\Program Files\Navilog1
C:\Program Files\NetMeeting
C:\Program Files\Norton SystemWorks
C:\Program Files\OfficeUpdate11
C:\Program Files\Outlook Express
C:\Program Files\Party poker
C:\Program Files\Real
C:\Program Files\Samsung
C:\Program Files\Services en ligne
C:\Program Files\Spybot - Search & Destroy
C:\Program Files\Symantec
C:\Program Files\Symantec AntiVirus
C:\Program Files\Winamp
C:\Program Files\Windows Journal Viewer
C:\Program Files\Windows Live
C:\Program Files\Windows Live Safety Center
C:\Program Files\Windows Media Components
C:\Program Files\Windows Media Connect 2
C:\Program Files\Windows Media Player
C:\Program Files\Windows NT
C:\Program Files\WinRAR
C:\Program Files\WinZip
C:\Program Files\xerox
C:\Program Files\Xing
C:\Program Files\ZyXEL Corporation

------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

C:\Program Files\Fichiers communs\Adobe
C:\Program Files\Fichiers communs\Ahead
C:\Program Files\Fichiers communs\Autodesk Shared
C:\Program Files\Fichiers communs\Canon
C:\Program Files\Fichiers communs\DESIGNER
C:\Program Files\Fichiers communs\Deterministic Networks
C:\Program Files\Fichiers communs\FotoWire
C:\Program Files\Fichiers communs\InstallShield
C:\Program Files\Fichiers communs\Java
C:\Program Files\Fichiers communs\Logitech
C:\Program Files\Fichiers communs\MAGIX Shared
C:\Program Files\Fichiers communs\Microsoft Shared
C:\Program Files\Fichiers communs\MSSoap
C:\Program Files\Fichiers communs\ODBC
C:\Program Files\Fichiers communs\Real
C:\Program Files\Fichiers communs\Services
C:\Program Files\Fichiers communs\SpeechEngines
C:\Program Files\Fichiers communs\stardock
C:\Program Files\Fichiers communs\Symantec Shared
C:\Program Files\Fichiers communs\System
C:\Program Files\Fichiers communs\Xing Shared

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

Aucun fichier / dossier Lop trouvé !

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-12 14:08:11
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden files ...
scan completed successfully
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

--------------------[ Fin du rapport a 14:08:13.35 ]----------------------

Les fichiers sont supprimés... Voici le rapport :

Logfile of HijackThis v1.99.1
Scan saved at 18:55:29, on 13/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\shpc32.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\NetMeeting\howypohoz77798.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Party poker\PartyGaming.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C7A7D216-15AE-4E2B-DA2B-4CE6058208C7} - C:\WINDOWS\system32\hfc.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [xkstartup] RunDll32 insxk35c.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [SHPC32] shpc32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [howypohoz] C:\Program Files\NetMeeting\howypohoz77798.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DesktopX] "C:\PROGRA~1\STARDOCK\OBJECT~1\DESKTOPX\DesktopX.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\Party poker\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\Party poker\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Bonsoir! J'ai essayé de faire le scan online de Kapersky mais il ne veut pas telecharger le controle ActiveX. Il me dit qu il faut etre administrateur et mettre le niveau d IE sur moyen, ce que j ai fait et ca ne marche tjs pas...

Voici le rapport de Panda :


Incident Status Location

Adware:Adware/TTC Not disinfected C:\Program Files\NetMeeting\howypohoz77798.exe
Potentially unwanted tool:application/myway Not disinfected hkey_classes_root\clsid\{66FC8717-EFA7-4546-8C4A-E224F3A80C76}
Potentially unwanted tool:application/altnet Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\AltnetDM
Adware:adware/seekmo Not disinfected Windows Registry
Adware:adware/instafinder Not disinfected Windows Registry
Adware:adware/topconvert Not disinfected Windows Registry
Adware:adware/wupd Not disinfected Windows Registry
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Invité\Cookies\invité@xiti[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Invité\Cookies\invité@xiti[2].txt
Adware:Adware/CWS Not disinfected C:\Documents and Settings\BEN\Local Settings\Temporary Internet Files\Content.IE5\I72FMTID\acdt-pid70[1].exe
Potentially unwanted tool:Application/Pskill.K Not disinfected C:\Documents and Settings\BEN\Bureau\CLEAN\PSKILL.EXE
Virus:Trj/Agent.HEH Disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\INCL\MSNCHK.EXE
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\INCL\Process.exe
Virus:Trj/Agent.HEH Disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\MSNCHK.EXE
Dialerialer.KVT Not disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\dim. 02122007_215845.69.zip[backup/carlton]
Adware:Adware/Secure32 Not disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\dim. 02122007_215845.69.zip[backup/a.exe]
Virus:Trj/Agent.GXF Disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\dim. 02122007_215845.69.zip[backup/b111.exe]
Virus:Trj/Downloader.RKF Disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\dim. 02122007_215845.69.zip[backup/mrofinu1148.exe]
Virus:W32/MSNFunny.D.worm Disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\dim. 02122007_215845.69.zip[backup/msimn.exe]
Virus:W32/MSNFunny.D.worm Disinfected C:\Documents and Settings\BEN\Bureau\MSNFix\dim. 02122007_215845.69.zip[backup/party_jpg.zip][www.party_jpg_Msn.com]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\BEN\Cookies\ben@xiti[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\BEN\Cookies\ben@overture[1].txt
Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\BEN\Cookies\ben@cassava[1].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\BEN\Cookies\ben@azjmp[1].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\BEN\Cookies\ben@yadro[1].txt
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\BEN\Cookies\ben@toplist[1].txt
Spyware:Cookie/AspinallsOnlineCasino Not disinfected C:\Documents and Settings\BEN\Cookies\ben@pacificpoker[1].txt
Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\BEN\Cookies\ben@fe.lea.lycos[1].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\BEN\Cookies\ben@yadro[3].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\BEN\Cookies\ben@server.iad.liveperson[2].txt
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\BEN\Cookies\ben@metriweb[2].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\BEN\Cookies\ben@247realmedia[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\BEN\Cookies\ben@bs.serving-sys[2].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\BEN\Cookies\ben@yadro[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\BEN\Cookies\ben@com[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\BEN\Cookies\ben@atwola[2].txt
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\BEN\Cookies\ben@weborama[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\BEN\Cookies\ben@serving-sys[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Program Files\Lop SD\Process.exe
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\THPMEZSS.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\KSVRXICN.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\FVLESJTJ.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\ORJDDXPX.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\RPCJQNNM.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\NTXNOWHL.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\FGLJXHQQ.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\PZSKLOOE.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\XHJXGYLC.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\ETHFZJRN.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\YTGENKLW.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\GZLNINLQ.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\TPPKRNOU.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\SDBTFATH.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\NANRSMZV.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\LVULJZKX.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\KPSAXOMO.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\INITAHWA.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\ATOPOYSR.EXE
Adware:Adware/SystemDoctor Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\DUBIMKZA.EXE
Adware:Adware/Lop Not disinfected C:\Program Files\Lop SD\Backup-Lop\S-D\JICGNGAU.EXE
Potentially unwanted tool:Application/Processor Not disinfected C:\Program Files\Navilog1\Process.exe
Virus:Trj/Rebooter.J Disinfected C:\Program Files\Navilog1\REBOOT.EXE

Voila j'ai supprimé les 2 fichiers.
Rapport AVG :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 18:41:20 18/12/2007

+ Résultat de l'analyse:



HKU\S-1-5-21-527237240-854245398-1842383139-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929CD6E-2062-44A4-B2C5-2C7E78FBAB38} -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122712.EXE -> Backdoor.SdBot.cjn : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122717.exe -> Backdoor.SdBot.cjn : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\ben\Bureau\MSNFix\dim. 02122007_215845.69.zip/backup/b147.exe -> Downloader.Agent.fjn : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122634.exe -> Downloader.Agent.fjn : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122701.exe -> Downloader.Agent.fjn : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122714.exe -> Downloader.Agent.fjn : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\ben\Bureau\MSNFix\dim. 02122007_215845.69.zip/backup/a.exe -> Downloader.Harnig.ax : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122713.exe -> Downloader.Harnig.ax : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP431\A0122168.dll -> Not-A-Virus.Adware.PurityScan : Nettoyé et sauvegardé (mise en quarantaine).
C:\!KillBox\howypohoz77798.exe -> Not-A-Virus.Adware.TTC : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122625.EXE -> Not-A-Virus.Adware.TTC : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP442\A0129426.exe -> Not-A-Virus.Adware.TTC : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\ben\Cookies\ben@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@pandasoftware.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@m.webtrends[3].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@m.webtrends[4].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@yadro[1].txt -> TrackingCookie.Yadro : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@yadro[2].txt -> TrackingCookie.Yadro : Nettoyé.
C:\Documents and Settings\ben\Cookies\ben@yadro[3].txt -> TrackingCookie.Yadro : Nettoyé.
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122622.exe -> Trojan.Dialer.us : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Lop SD\Backup-Lop.zip/S-D/dubimkza.exe -> Trojan.Obfuscated.en : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Lop SD\Backup-Lop.zip/S-D/initahwa.exe -> Trojan.Obfuscated.en : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Lop SD\Backup-Lop\S-D\dubimkza.exe -> Trojan.Obfuscated.en : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Lop SD\Backup-Lop\S-D\initahwa.exe -> Trojan.Obfuscated.en : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP437\A0124039.exe -> Trojan.Obfuscated.en : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP437\A0124042.exe -> Trojan.Obfuscated.en : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP441\A0128354.exe -> Trojan.Obfuscated.en : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP433\A0122629.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{B07D9A15-D81E-455C-96D2-793C6066C9CF}\RP434\A0122761.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

Bonsoir! Non plus de problemes ni avec msn ni avec les pubs intempestives...

Merci beaucoup pour ton aide!!!