Bonjour,

Alors voilà.

Ce matin mon petit frère a voulu joué sur l'ordinateur mais il a eu un BSoD donc il n'a plus rien touché jusqu'à ce que je rentre du boulot.

Ce que j'ai fait j'ai redémarer le PC et là j'ai eu ceci :

Windows Security Alert :

"Windows has detected an internet attack attempt... Somebody's trying to infect your PC with spyware or harmful viruses. Run full system scan now to protect your PC from Internet attacks, hijacking attempts and spyware. Click here to download spyware remover for total protection".

et ensuite j'ai découvert un fond d'écran rouge avec marqué dessus :

"Your privacy is in danger / Download privacy protect software now".

J'ai donc chercher un peu sur internet et j'ai trouver un topic (je mettrai le lien si vous me l'autorisez car ce n'est pas un topic de info-du-net.) qui disait de télécharger HijackThis et de télécharger SmitfraudFix et de faire un rapport avec HijackThis et SmitfraudFix ce que j'ai fait et donc les voici dans l'ordre (HijackThis et SmitfraudFix) :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41:22, on 26/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Program Files\QuickTime\QTTask.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Pack Securite\Common\FSLAUNCH.EXE
C:\WINDOWS\NOTEPAD.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.p [...] Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {DB055111-4F4F-4730-ADC5-C40EBBFF6E67} - (no file)
O2 - BHO: QXK Olive - {E77162C5-39EE-46AA-8C3C-821013405C4B} - C:\WINDOWS\nfavxwdbsvn.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: fdkowvbp - {07343B81-F9B7-41F9-8258-EA5A83DEDC8A} - C:\WINDOWS\fdkowvbp.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
O4 - HKLM\..\Run: [ROAD ITCH AMOK PING] C:\Documents and Settings\All Users\Application Data\Long slow road itch\LOUD WAIT.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "D:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Error fork] C:\DOCUME~1\Nadine\APPLIC~1\MP3SEC~1\City Play.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com [...] _0_2_0.cab
O16 - DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} (Jolly Bear Games Player) - http://games.bigfishgames.com/fr_b [...] Player.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O21 - SSODL: eqvwamkl - {6ADA6F7C-85CF-4AF3-AE4B-CDA276F886A8} - C:\WINDOWS\eqvwamkl.dll
O21 - SSODL: wnslvxtf - {683B7B9B-DCB4-4549-BE50-1EF245276E91} - C:\WINDOWS\wnslvxtf.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)
O24 - Desktop Component 1: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 10203 bytes



SmitFraudFix v2.331

Rapport fait à 17:40:04,76, 26/07/2008
Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Program Files\QuickTime\QTTask.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Pack Securite\Common\FSLAUNCH.EXE

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\privacy_danger PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nadine


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nadine\Application Data

C:\Documents and Settings\Nadine\Application Data\Skinux PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Nadine\Favoris

C:\DOCUME~1\Nadine\Favoris\Error Cleaner.url PRESENT !
C:\DOCUME~1\Nadine\Favoris\Privacy Protector.url PRESENT !
C:\DOCUME~1\Nadine\Favoris\Spyware?Malware Protection.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

C:\DOCUME~1\Nadine\Bureau\Error Cleaner.url PRESENT !
C:\DOCUME~1\Nadine\Bureau\Privacy Protector.url PRESENT !
C:\DOCUME~1\Nadine\Bureau\Spyware?Malware Protection.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
+--------------------------------------------------+
[!] Suspicious: nfavxwdbsvn.dll
BHO: QXK Olive - {E77162C5-39EE-46AA-8C3C-821013405C4B}
TypeLib: {6E3B4285-57B3-4339-96C9-22D4A1067A66}
Interface: {B5F87132-68C6-4F53-A53F-045040A38DB4}
Interface: {DF16CD78-EB2A-4D74-A8A5-B4D8EAC5CA7F}

[!] Suspicious: fdkowvbp.dll
Toolbar: fdkowvbp - {07343B81-F9B7-41F9-8258-EA5A83DEDC8A}
TypeLib: {FD676E78-B007-435B-A17D-BCA27E2355EB}
Interface: {93F1109F-B8F0-4972-8736-B32EE1525E23}
Classe: fdkowvbp.blbm
Classe: fdkowvbp.ToolBar.1

[!] Suspicious: eqvwamkl.dll
SSODL: eqvwamkl - {6ADA6F7C-85CF-4AF3-AE4B-CDA276F886A8}

[!] Suspicious: wnslvxtf.dll
SSODL: wnslvxtf - {683B7B9B-DCB4-4549-BE50-1EF245276E91}


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) 82566DC Gigabit Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7F5B463C-4F89-448E-B420-15E3C7061EA6}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7F5B463C-4F89-448E-B420-15E3C7061EA6}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7F5B463C-4F89-448E-B420-15E3C7061EA6}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin



Merci de bien vouloir me répondre rapidement.

et pour ceux qui serait dans le même problème dans lequel j'ai été aller voir là ==> http://forum.pcastuces.com/problem [...] s34170.htm

Bonjour XmichouX,

voilà j'ai fait ce que tu m'as dit. Aussi j'avais oublier de dire q'il y a en tout 4 sessions (sans aucun mot de passe) sur mon PC. Aurais-je du faire 4X la même chose pour le supprimer complètement ?

Voici le rapport :


SDFix: Version 1.208
Run by Nadine on 27/07/2008 at 18:41

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\EXPB.EXE - Deleted
C:\Documents and Settings\Sylvain\Bureau\Error Cleaner.url - Deleted
C:\Documents and Settings\Sylvain\Favoris\Error Cleaner.url - Deleted
C:\Documents and Settings\Sylvain\Bureau\Privacy Protector.url - Deleted
C:\Documents and Settings\Sylvain\Favoris\Privacy Protector.url - Deleted
C:\Documents and Settings\Sylvain\Bureau\Spyware&Malware Protection.url - Deleted
C:\Documents and Settings\Sylvain\Favoris\Spyware&Malware Protection.url - Deleted
C:\Program Files\PCHealthCenter\0.exe - Deleted
C:\Program Files\PCHealthCenter\0.gif - Deleted
C:\Program Files\PCHealthCenter\1.exe - Deleted
C:\Program Files\PCHealthCenter\1.gif - Deleted
C:\Program Files\PCHealthCenter\2.exe - Deleted
C:\Program Files\PCHealthCenter\2.gif - Deleted
C:\Program Files\PCHealthCenter\3.exe - Deleted
C:\Program Files\PCHealthCenter\3.gif - Deleted
C:\Program Files\PCHealthCenter\4.0xe - Deleted
C:\Program Files\PCHealthCenter\5.exe - Deleted
C:\Program Files\PCHealthCenter\7.0xe - Deleted
C:\Program Files\PCHealthCenter\sc.html - Deleted
C:\Program Files\PCHealthCenter\sex1.ico - Deleted
C:\Program Files\PCHealthCenter\sex2.ico - Deleted
C:\WINDOWS\grswptdl.exe - Deleted



Folder C:\Program Files\PCHealthCenter - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-27 18:44:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:e3,73,38,7d,77,8f,82,7e,c7,72,75,45,13,41,8d,66,f5,b5,e2,fe,30,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,86,b2,97,24,8e,3c,7f,43,7a,56,b4,2a,56,60,65,18,68,..
"khjeh"=hex:36,c4,b6,9b,4f,eb,d1,19,c7,b8,f1,5a,0b,ae,55,c4,0b,63,e2,2d,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:3a,48,57,2f,a3,c7,2b,68,d0,fa,88,e9,d4,fd,6c,a1,8a,59,cc,79,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:e3,73,38,7d,77,8f,82,7e,c7,72,75,45,13,41,8d,66,f5,b5,e2,fe,30,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,86,b2,97,24,8e,3c,7f,43,7a,56,b4,2a,56,60,65,18,68,..
"khjeh"=hex:36,c4,b6,9b,4f,eb,d1,19,c7,b8,f1,5a,0b,ae,55,c4,0b,63,e2,2d,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:3a,48,57,2f,a3,c7,2b,68,d0,fa,88,e9,d4,fd,6c,a1,8a,59,cc,79,bd,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"D:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="D:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"D:\\Program Files\\LimeWire\\LimeWire.exe"="D:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 24 Jul 2008 72 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti1049.tmp"
Wed 16 Jul 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\02fcd9cda045f9dd46a861d251f6b7b1\BIT11.tmp"
Mon 7 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT8.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5b68a8371325b092494be04cd7222f7e\BITD.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7779524ce1b472c62f1b0f1a192676ad\BITF.tmp"
Mon 7 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8171d23d6d072d8b50d065ca55a754fb\BITA.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8f29a7a40b2d9aecc6dd8c0d708fef07\BITC.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9664ff6405d9e0e32778ca8618d4be26\BITB.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\97de84be36b27af6e66a0586433cda52\BITA.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bea0ec052f9fb30876ce0b314fb5e9e8\BITE.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bf110da611ffb0b3c1fd41a83ef95fc6\BIT12.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb1cc7c8ed3868a5a32ffb677fe0fde8\BIT10.tmp"

Finished!


Merci de me répondre

voilà :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:59: VIRUS ALERT!, on 27/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Program Files\QuickTime\QTTask.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
D:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Microsoft Office\Office12\GROOVE.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.p [...] Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
O4 - HKLM\..\Run: [ROAD ITCH AMOK PING] C:\Documents and Settings\All Users\Application Data\Long slow road itch\LOUD WAIT.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "D:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Error fork] C:\DOCUME~1\Sylvain\APPLIC~1\MP3SEC~1\City Play.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Microsoft Office Groove.lnk = D:\Program Files\Microsoft Office\Office12\GROOVE.EXE
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com [...] _0_2_0.cab
O16 - DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} (Jolly Bear Games Player) - http://games.bigfishgames.com/fr_b [...] Player.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 10637 bytes


(Je l'ai fait sur ma session tandis que se que j'ai décris au début je l'avais réalisé sur la session de ma mère donc c'est fort probable que ce rapport soit le même pour la session de mon père et de mon petit fère du moins je pense).

et je peux que Redémarrer, Arrêter ou Mettre en veille en cliquant sur Arrêter l'ordinateur.(Et je n'ai pas Fermer la session)

Re,

Alors voici le rapport : (scan fait sur la session de ma mère)



--------------------\\ Lop S&D 4.2.2-4 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Nadine ] [ "C:\Lop SD" ] [ Selection : 1 ]
[ 27/07/2008 | 20:47:54,18 ] [ PC : FAMILLE-49DNM2J ]
[ MAJ : 25-07-2008 | 17:45 ]

--------------------\\ Listing des dossiers dans APPLIC~1

[07/07/2008|15:57] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[07/07/2008|14:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[27/07/2008|18:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla

[08/07/2008|13:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[22/07/2008|12:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[10/07/2008|15:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Astar Games
[07/07/2008|16:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
[07/07/2008|21:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BigFishGamesCache
[07/07/2008|15:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[16/07/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
[22/07/2008|14:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[09/07/2008|17:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Flood Light Games
[07/07/2008|15:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
[07/07/2008|15:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
[07/07/2008|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[09/07/2008|00:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[08/07/2008|11:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterAction studios
[13/07/2008|12:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
[08/07/2008|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
[16/07/2008|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LauncherAccess.dt
[24/07/2008|16:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch
[23/07/2008|15:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
[24/07/2008|18:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[19/07/2008|23:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[23/07/2008|11:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[08/07/2008|13:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[07/07/2008|19:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[21/07/2008|15:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[08/07/2008|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
[08/07/2008|18:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
[07/07/2008|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[07/07/2008|16:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[07/07/2008|15:57] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[07/07/2008|14:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[14/07/2008|18:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[08/07/2008|11:28] C:\DOCUME~1\Nadine\APPLIC~1\Adobe
[22/07/2008|12:46] C:\DOCUME~1\Nadine\APPLIC~1\Apple Computer
[07/07/2008|14:24] C:\DOCUME~1\Nadine\APPLIC~1\ATI
[12/07/2008|13:34] C:\DOCUME~1\Nadine\APPLIC~1\Big Fish Games
[07/07/2008|15:57] C:\DOCUME~1\Nadine\APPLIC~1\desktop.ini
[09/07/2008|17:23] C:\DOCUME~1\Nadine\APPLIC~1\Flood Light Games
[07/07/2008|20:55] C:\DOCUME~1\Nadine\APPLIC~1\F-Secure
[07/07/2008|15:49] C:\DOCUME~1\Nadine\APPLIC~1\Google
[07/07/2008|14:16] C:\DOCUME~1\Nadine\APPLIC~1\Identities
[07/07/2008|15:59] C:\DOCUME~1\Nadine\APPLIC~1\InstallShield
[07/07/2008|15:14] C:\DOCUME~1\Nadine\APPLIC~1\Macromedia
[20/07/2008|12:47] C:\DOCUME~1\Nadine\APPLIC~1\Microsoft
[09/07/2008|11:07] C:\DOCUME~1\Nadine\APPLIC~1\Mozilla
[26/07/2008|16:57] C:\DOCUME~1\Nadine\APPLIC~1\mp3second
[26/07/2008|17:52] C:\DOCUME~1\Nadine\APPLIC~1\Skinux
[13/06/2007|15:22] C:\DOCUME~1\Nadine\APPLIC~1\system.dat
[26/07/2008|08:31] C:\DOCUME~1\Nadine\APPLIC~1\TmpRecentIcons
[07/07/2008|19:46] C:\DOCUME~1\Nadine\APPLIC~1\TomTom
[07/07/2008|19:03] C:\DOCUME~1\Nadine\APPLIC~1\wklnhst.dat

[07/07/2008|14:07] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[11/07/2008|18:48] C:\DOCUME~1\Pierre\APPLIC~1\Adobe
[08/07/2008|11:30] C:\DOCUME~1\Pierre\APPLIC~1\ATI
[07/07/2008|15:57] C:\DOCUME~1\Pierre\APPLIC~1\desktop.ini
[12/07/2008|18:43] C:\DOCUME~1\Pierre\APPLIC~1\Google
[07/07/2008|14:16] C:\DOCUME~1\Pierre\APPLIC~1\Identities
[11/07/2008|18:48] C:\DOCUME~1\Pierre\APPLIC~1\Macromedia
[23/07/2008|22:49] C:\DOCUME~1\Pierre\APPLIC~1\Microsoft
[11/07/2008|18:46] C:\DOCUME~1\Pierre\APPLIC~1\Mozilla
[11/07/2008|18:45] C:\DOCUME~1\Pierre\APPLIC~1\Skinux
[13/06/2007|15:22] C:\DOCUME~1\Pierre\APPLIC~1\system.dat

[11/07/2008|20:26] C:\DOCUME~1\RMY~1\APPLIC~1\Adobe
[07/07/2008|17:48] C:\DOCUME~1\RMY~1\APPLIC~1\ATI
[07/07/2008|15:57] C:\DOCUME~1\RMY~1\APPLIC~1\desktop.ini
[15/07/2008|06:53] C:\DOCUME~1\RMY~1\APPLIC~1\Google
[07/07/2008|14:17] C:\DOCUME~1\RMY~1\APPLIC~1\Identities
[11/07/2008|20:26] C:\DOCUME~1\RMY~1\APPLIC~1\Macromedia
[11/07/2008|20:39] C:\DOCUME~1\RMY~1\APPLIC~1\Microsoft
[11/07/2008|20:49] C:\DOCUME~1\RMY~1\APPLIC~1\Mozilla
[11/07/2008|20:25] C:\DOCUME~1\RMY~1\APPLIC~1\Skinux

[08/07/2008|11:31] C:\DOCUME~1\Sylvain\APPLIC~1\Adobe
[12/07/2008|23:49] C:\DOCUME~1\Sylvain\APPLIC~1\Ahead
[08/07/2008|15:28] C:\DOCUME~1\Sylvain\APPLIC~1\Apple Computer
[08/07/2008|11:29] C:\DOCUME~1\Sylvain\APPLIC~1\ATI
[17/07/2008|22:26] C:\DOCUME~1\Sylvain\APPLIC~1\DAEMON Tools
[07/07/2008|15:57] C:\DOCUME~1\Sylvain\APPLIC~1\desktop.ini
[16/07/2008|15:55] C:\DOCUME~1\Sylvain\APPLIC~1\F-Secure
[08/07/2008|11:32] C:\DOCUME~1\Sylvain\APPLIC~1\Google
[12/07/2008|15:15] C:\DOCUME~1\Sylvain\APPLIC~1\Help
[07/07/2008|14:17] C:\DOCUME~1\Sylvain\APPLIC~1\Identities
[12/07/2008|15:29] C:\DOCUME~1\Sylvain\APPLIC~1\InstallShield Installation Information
[17/07/2008|23:02] C:\DOCUME~1\Sylvain\APPLIC~1\Jasc Software Inc
[22/07/2008|13:13] C:\DOCUME~1\Sylvain\APPLIC~1\LimeWire
[08/07/2008|11:31] C:\DOCUME~1\Sylvain\APPLIC~1\Macromedia
[19/07/2008|23:32] C:\DOCUME~1\Sylvain\APPLIC~1\Microsoft
[08/07/2008|13:44] C:\DOCUME~1\Sylvain\APPLIC~1\Mozilla
[24/07/2008|16:40] C:\DOCUME~1\Sylvain\APPLIC~1\mp3second
[12/07/2008|15:33] C:\DOCUME~1\Sylvain\APPLIC~1\My Games
[08/07/2008|15:18] C:\DOCUME~1\Sylvain\APPLIC~1\Samsung
[27/07/2008|19:22] C:\DOCUME~1\Sylvain\APPLIC~1\Skinux
[13/06/2007|15:22] C:\DOCUME~1\Sylvain\APPLIC~1\system.dat
[08/07/2008|13:22] C:\DOCUME~1\Sylvain\APPLIC~1\Template
[26/07/2008|08:31] C:\DOCUME~1\Sylvain\APPLIC~1\TmpRecentIcons
[08/07/2008|16:52] C:\DOCUME~1\Sylvain\APPLIC~1\TomTom
[08/07/2008|13:22] C:\DOCUME~1\Sylvain\APPLIC~1\wklnhst.dat

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[27/07/2008 02:05][--a------] C:\WINDOWS\tasks\Scheduled scanning task.job
[27/07/2008 20:00][--ah-----] C:\WINDOWS\tasks\BB9D8FD597A63F05.job
[22/07/2008 08:31][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[22/07/2008 13:48][--a------] C:\WINDOWS\tasks\EasyShare Registration Task.job
[27/07/2008 19:32][--ah-----] C:\WINDOWS\tasks\SA.DAT
[10/08/2004 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( BB9D8FD597A63F05.job )=( c:\docume~1\sylvain\applic~1\mp3sec~1\knobsafelong.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[07/07/2008|15:48] C:\Program Files\ATI Technologies
[24/07/2008|12:09] C:\Program Files\AviSynth 2.5
[07/07/2008|21:10] C:\Program Files\bfgclient
[23/07/2008|11:52] C:\Program Files\Bonjour
[24/07/2008|16:39] C:\Program Files\Circle Developement
[07/07/2008|14:02] C:\Program Files\ComPlus Applications
[07/07/2008|14:31] C:\Program Files\Dell
[25/07/2008|17:31] C:\Program Files\directx
[23/07/2008|15:43] C:\Program Files\Fichiers communs
[07/07/2008|14:11] C:\Program Files\FrenchOtto
[07/07/2008|14:11] C:\Program Files\GemMasterFrench
[07/07/2008|15:55] C:\Program Files\Google
[25/07/2008|17:29] C:\Program Files\InstallShield Installation Information
[07/07/2008|14:33] C:\Program Files\Intel
[24/07/2008|16:18] C:\Program Files\InterActual
[07/07/2008|16:53] C:\Program Files\Internet Explorer
[23/07/2008|11:41] C:\Program Files\iPod
[23/07/2008|11:50] C:\Program Files\iTunes
[17/07/2008|22:08] C:\Program Files\Jasc Software Inc
[23/07/2008|12:12] C:\Program Files\Java
[08/07/2008|13:52] C:\Program Files\Kodak
[23/07/2008|15:50] C:\Program Files\Lexmark X1100 Series
[07/07/2008|19:41] C:\Program Files\Messenger
[07/07/2008|14:05] C:\Program Files\microsoft frontpage
[07/07/2008|19:02] C:\Program Files\Microsoft Office
[19/07/2008|23:12] C:\Program Files\Microsoft Visual Studio
[19/07/2008|23:09] C:\Program Files\Microsoft Visual Studio 8
[19/07/2008|23:13] C:\Program Files\Microsoft Works
[19/07/2008|23:11] C:\Program Files\Microsoft.NET
[07/07/2008|14:35] C:\Program Files\Modem Helper
[07/07/2008|14:03] C:\Program Files\Movie Maker
[27/07/2008|20:44] C:\Program Files\Mozilla Firefox
[24/07/2008|16:39] C:\Program Files\mp3second
[19/07/2008|23:12] C:\Program Files\MSBuild
[07/07/2008|14:01] C:\Program Files\MSN
[07/07/2008|14:01] C:\Program Files\MSN Gaming Zone
[08/07/2008|22:55] C:\Program Files\MSXML 4.0
[08/07/2008|13:35] C:\Program Files\Nero
[07/07/2008|14:03] C:\Program Files\NetMeeting
[07/07/2008|15:07] C:\Program Files\Neuf
[07/07/2008|14:02] C:\Program Files\Online Services
[07/07/2008|14:35] C:\Program Files\Outil de diagnostic de modem
[07/07/2008|19:40] C:\Program Files\Outlook Express
[07/07/2008|15:31] C:\Program Files\Pack Securite
[08/07/2008|13:15] C:\Program Files\ReflexiveArcade
[23/07/2008|11:50] C:\Program Files\Safari
[07/07/2008|14:04] C:\Program Files\Services en ligne
[07/07/2008|14:25] C:\Program Files\SigmaTel
[07/07/2008|20:57] C:\Program Files\temp01
[08/07/2008|16:41] C:\Program Files\TomTom DesktopSuite
[07/07/2008|14:16] C:\Program Files\Uninstall Information
[16/07/2008|16:08] C:\Program Files\VirginMega
[23/07/2008|15:53] C:\Program Files\Windows Live
[16/07/2008|16:02] C:\Program Files\Windows Media Connect 2
[27/07/2008|19:26] C:\Program Files\Windows Media Player
[07/07/2008|14:01] C:\Program Files\Windows NT
[07/07/2008|14:02] C:\Program Files\Windows Plus
[07/07/2008|14:04] C:\Program Files\WindowsUpdate
[07/07/2008|19:26] C:\Program Files\WinRAR
[07/07/2008|14:05] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[08/07/2008|13:36] C:\Program Files\Fichiers communs\Ahead
[22/07/2008|12:45] C:\Program Files\Fichiers communs\Apple
[19/07/2008|23:12] C:\Program Files\Fichiers communs\DESIGNER
[09/07/2008|00:51] C:\Program Files\Fichiers communs\InstallShield
[17/07/2008|22:07] C:\Program Files\Fichiers communs\Jasc Software Inc
[07/07/2008|14:34] C:\Program Files\Fichiers communs\Java
[08/07/2008|13:51] C:\Program Files\Fichiers communs\Kodak
[19/07/2008|23:13] C:\Program Files\Fichiers communs\Microsoft Shared
[07/07/2008|14:03] C:\Program Files\Fichiers communs\MSSoap
[07/07/2008|15:57] C:\Program Files\Fichiers communs\ODBC
[07/07/2008|14:03] C:\Program Files\Fichiers communs\Services
[07/07/2008|15:57] C:\Program Files\Fichiers communs\SpeechEngines
[23/07/2008|15:44] C:\Program Files\Fichiers communs\System
[23/07/2008|15:43] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 55 Processus )

iexplore.exe ~ [1048]
iexplore.exe ~ [1032]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch\LOUD WAIT.exe
C:\DOCUME~1\Nadine\APPLIC~1\mp3sec~1
C:\DOCUME~1\Nadine\APPLIC~1\mp3sec~1\City Play.exe
C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1
C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\bzuzgugn.exe
C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\City Play.exe
C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\Coal acid send seek.exe
C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\knobsafelong.exe
C:\Program Files\mp3sec~1
C:\Program Files\Circle Developement
C:\Program Files\Circle Developement\Uninstall.exe
C:\WINDOWS\Tasks\BB9D8FD597A63F05.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Error fork"="C:\\DOCUME~1\\Nadine\\APPLIC~1\\MP3SEC~1\\City Play.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ROAD ITCH AMOK PING"="C:\\Documents and Settings\\All Users\\Application Data\\Long slow road itch\\LOUD WAIT.exe"

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-27 20:48:42
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:11][D:45]-> C:\DOCUME~1\Nadine\LOCALS~1\Temp
[F:162][D:0]-> C:\DOCUME~1\Nadine\Cookies
[F:7988][D:9]-> C:\DOCUME~1\Nadine\LOCALS~1\TEMPOR~1\content.IE5

--------------------\\ Fin du rapport a 20:49:13,90

Salut,

Voici le rapport :


--------------------\\ Lop S&D 4.2.2-4 XP/Vista

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Nadine ] [ "C:\Lop SD" ] [ Selection : 2 ]
[ 28/07/2008 | 12:28:25,06 ] [ PC : FAMILLE-49DNM2J ]
[ MAJ : 25-07-2008 | 17:45 ]


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch\LOUD WAIT.exe
Supprime! - C:\DOCUME~1\Nadine\APPLIC~1\mp3sec~1\City Play.exe
Supprime! - C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\bzuzgugn.exe
Supprime! - C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\City Play.exe
Supprime! - C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\Coal acid send seek.exe
Supprime! - C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1\knobsafelong.exe
Supprime! - C:\Program Files\Circle Developement\Uninstall.exe
Supprime! - C:\WINDOWS\Tasks\BB9D8FD597A63F05.job
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch
Supprime! - C:\DOCUME~1\Nadine\APPLIC~1\mp3sec~1
Supprime! - C:\DOCUME~1\Sylvain\APPLIC~1\mp3sec~1
Supprime! - C:\Program Files\mp3sec~1
Supprime! - C:\Program Files\Circle Developement
RestaurÚ! - Fichier Hosts

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans APPLIC~1

[07/07/2008|15:57] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[07/07/2008|14:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[27/07/2008|18:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla

[08/07/2008|13:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[22/07/2008|12:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[10/07/2008|15:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Astar Games
[07/07/2008|16:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
[07/07/2008|21:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BigFishGamesCache
[07/07/2008|15:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[16/07/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
[22/07/2008|14:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[09/07/2008|17:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Flood Light Games
[07/07/2008|15:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
[07/07/2008|15:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
[07/07/2008|15:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[09/07/2008|00:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[08/07/2008|11:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InterAction studios
[13/07/2008|12:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
[08/07/2008|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
[16/07/2008|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LauncherAccess.dt
[23/07/2008|15:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
[24/07/2008|18:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[19/07/2008|23:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[23/07/2008|11:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
[08/07/2008|13:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[07/07/2008|19:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[21/07/2008|15:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[08/07/2008|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
[08/07/2008|18:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
[07/07/2008|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[07/07/2008|16:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[07/07/2008|15:57] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[07/07/2008|14:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[14/07/2008|18:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[08/07/2008|11:28] C:\DOCUME~1\Nadine\APPLIC~1\Adobe
[22/07/2008|12:46] C:\DOCUME~1\Nadine\APPLIC~1\Apple Computer
[07/07/2008|14:24] C:\DOCUME~1\Nadine\APPLIC~1\ATI
[12/07/2008|13:34] C:\DOCUME~1\Nadine\APPLIC~1\Big Fish Games
[07/07/2008|15:57] C:\DOCUME~1\Nadine\APPLIC~1\desktop.ini
[09/07/2008|17:23] C:\DOCUME~1\Nadine\APPLIC~1\Flood Light Games
[07/07/2008|20:55] C:\DOCUME~1\Nadine\APPLIC~1\F-Secure
[07/07/2008|15:49] C:\DOCUME~1\Nadine\APPLIC~1\Google
[07/07/2008|14:16] C:\DOCUME~1\Nadine\APPLIC~1\Identities
[07/07/2008|15:59] C:\DOCUME~1\Nadine\APPLIC~1\InstallShield
[07/07/2008|15:14] C:\DOCUME~1\Nadine\APPLIC~1\Macromedia
[20/07/2008|12:47] C:\DOCUME~1\Nadine\APPLIC~1\Microsoft
[09/07/2008|11:07] C:\DOCUME~1\Nadine\APPLIC~1\Mozilla
[26/07/2008|17:52] C:\DOCUME~1\Nadine\APPLIC~1\Skinux
[13/06/2007|15:22] C:\DOCUME~1\Nadine\APPLIC~1\system.dat
[26/07/2008|08:31] C:\DOCUME~1\Nadine\APPLIC~1\TmpRecentIcons
[07/07/2008|19:46] C:\DOCUME~1\Nadine\APPLIC~1\TomTom
[07/07/2008|19:03] C:\DOCUME~1\Nadine\APPLIC~1\wklnhst.dat

[07/07/2008|14:07] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[11/07/2008|18:48] C:\DOCUME~1\Pierre\APPLIC~1\Adobe
[08/07/2008|11:30] C:\DOCUME~1\Pierre\APPLIC~1\ATI
[07/07/2008|15:57] C:\DOCUME~1\Pierre\APPLIC~1\desktop.ini
[12/07/2008|18:43] C:\DOCUME~1\Pierre\APPLIC~1\Google
[07/07/2008|14:16] C:\DOCUME~1\Pierre\APPLIC~1\Identities
[11/07/2008|18:48] C:\DOCUME~1\Pierre\APPLIC~1\Macromedia
[23/07/2008|22:49] C:\DOCUME~1\Pierre\APPLIC~1\Microsoft
[11/07/2008|18:46] C:\DOCUME~1\Pierre\APPLIC~1\Mozilla
[11/07/2008|18:45] C:\DOCUME~1\Pierre\APPLIC~1\Skinux
[13/06/2007|15:22] C:\DOCUME~1\Pierre\APPLIC~1\system.dat

[11/07/2008|20:26] C:\DOCUME~1\RMY~1\APPLIC~1\Adobe
[07/07/2008|17:48] C:\DOCUME~1\RMY~1\APPLIC~1\ATI
[07/07/2008|15:57] C:\DOCUME~1\RMY~1\APPLIC~1\desktop.ini
[15/07/2008|06:53] C:\DOCUME~1\RMY~1\APPLIC~1\Google
[07/07/2008|14:17] C:\DOCUME~1\RMY~1\APPLIC~1\Identities
[11/07/2008|20:26] C:\DOCUME~1\RMY~1\APPLIC~1\Macromedia
[11/07/2008|20:39] C:\DOCUME~1\RMY~1\APPLIC~1\Microsoft
[11/07/2008|20:49] C:\DOCUME~1\RMY~1\APPLIC~1\Mozilla
[11/07/2008|20:25] C:\DOCUME~1\RMY~1\APPLIC~1\Skinux

[08/07/2008|11:31] C:\DOCUME~1\Sylvain\APPLIC~1\Adobe
[12/07/2008|23:49] C:\DOCUME~1\Sylvain\APPLIC~1\Ahead
[08/07/2008|15:28] C:\DOCUME~1\Sylvain\APPLIC~1\Apple Computer
[08/07/2008|11:29] C:\DOCUME~1\Sylvain\APPLIC~1\ATI
[17/07/2008|22:26] C:\DOCUME~1\Sylvain\APPLIC~1\DAEMON Tools
[07/07/2008|15:57] C:\DOCUME~1\Sylvain\APPLIC~1\desktop.ini
[16/07/2008|15:55] C:\DOCUME~1\Sylvain\APPLIC~1\F-Secure
[08/07/2008|11:32] C:\DOCUME~1\Sylvain\APPLIC~1\Google
[12/07/2008|15:15] C:\DOCUME~1\Sylvain\APPLIC~1\Help
[07/07/2008|14:17] C:\DOCUME~1\Sylvain\APPLIC~1\Identities
[12/07/2008|15:29] C:\DOCUME~1\Sylvain\APPLIC~1\InstallShield Installation Information
[17/07/2008|23:02] C:\DOCUME~1\Sylvain\APPLIC~1\Jasc Software Inc
[22/07/2008|13:13] C:\DOCUME~1\Sylvain\APPLIC~1\LimeWire
[08/07/2008|11:31] C:\DOCUME~1\Sylvain\APPLIC~1\Macromedia
[19/07/2008|23:32] C:\DOCUME~1\Sylvain\APPLIC~1\Microsoft
[08/07/2008|13:44] C:\DOCUME~1\Sylvain\APPLIC~1\Mozilla
[12/07/2008|15:33] C:\DOCUME~1\Sylvain\APPLIC~1\My Games
[08/07/2008|15:18] C:\DOCUME~1\Sylvain\APPLIC~1\Samsung
[27/07/2008|19:22] C:\DOCUME~1\Sylvain\APPLIC~1\Skinux
[13/06/2007|15:22] C:\DOCUME~1\Sylvain\APPLIC~1\system.dat
[08/07/2008|13:22] C:\DOCUME~1\Sylvain\APPLIC~1\Template
[26/07/2008|08:31] C:\DOCUME~1\Sylvain\APPLIC~1\TmpRecentIcons
[08/07/2008|16:52] C:\DOCUME~1\Sylvain\APPLIC~1\TomTom
[08/07/2008|13:22] C:\DOCUME~1\Sylvain\APPLIC~1\wklnhst.dat

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[28/07/2008 02:02][--a------] C:\WINDOWS\tasks\Scheduled scanning task.job
[22/07/2008 08:31][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[22/07/2008 13:48][--a------] C:\WINDOWS\tasks\EasyShare Registration Task.job
[27/07/2008 19:32][--ah-----] C:\WINDOWS\tasks\SA.DAT
[10/08/2004 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[07/07/2008|15:48] C:\Program Files\ATI Technologies
[24/07/2008|12:09] C:\Program Files\AviSynth 2.5
[07/07/2008|21:10] C:\Program Files\bfgclient
[23/07/2008|11:52] C:\Program Files\Bonjour
[07/07/2008|14:02] C:\Program Files\ComPlus Applications
[07/07/2008|14:31] C:\Program Files\Dell
[25/07/2008|17:31] C:\Program Files\directx
[23/07/2008|15:43] C:\Program Files\Fichiers communs
[07/07/2008|14:11] C:\Program Files\FrenchOtto
[07/07/2008|14:11] C:\Program Files\GemMasterFrench
[07/07/2008|15:55] C:\Program Files\Google
[25/07/2008|17:29] C:\Program Files\InstallShield Installation Information
[07/07/2008|14:33] C:\Program Files\Intel
[24/07/2008|16:18] C:\Program Files\InterActual
[07/07/2008|16:53] C:\Program Files\Internet Explorer
[23/07/2008|11:41] C:\Program Files\iPod
[23/07/2008|11:50] C:\Program Files\iTunes
[17/07/2008|22:08] C:\Program Files\Jasc Software Inc
[23/07/2008|12:12] C:\Program Files\Java
[08/07/2008|13:52] C:\Program Files\Kodak
[23/07/2008|15:50] C:\Program Files\Lexmark X1100 Series
[07/07/2008|19:41] C:\Program Files\Messenger
[07/07/2008|14:05] C:\Program Files\microsoft frontpage
[07/07/2008|19:02] C:\Program Files\Microsoft Office
[19/07/2008|23:12] C:\Program Files\Microsoft Visual Studio
[19/07/2008|23:09] C:\Program Files\Microsoft Visual Studio 8
[19/07/2008|23:13] C:\Program Files\Microsoft Works
[19/07/2008|23:11] C:\Program Files\Microsoft.NET
[07/07/2008|14:35] C:\Program Files\Modem Helper
[07/07/2008|14:03] C:\Program Files\Movie Maker
[28/07/2008|12:12] C:\Program Files\Mozilla Firefox
[19/07/2008|23:12] C:\Program Files\MSBuild
[07/07/2008|14:01] C:\Program Files\MSN
[07/07/2008|14:01] C:\Program Files\MSN Gaming Zone
[08/07/2008|22:55] C:\Program Files\MSXML 4.0
[08/07/2008|13:35] C:\Program Files\Nero
[07/07/2008|14:03] C:\Program Files\NetMeeting
[07/07/2008|15:07] C:\Program Files\Neuf
[07/07/2008|14:02] C:\Program Files\Online Services
[07/07/2008|14:35] C:\Program Files\Outil de diagnostic de modem
[07/07/2008|19:40] C:\Program Files\Outlook Express
[07/07/2008|15:31] C:\Program Files\Pack Securite
[08/07/2008|13:15] C:\Program Files\ReflexiveArcade
[23/07/2008|11:50] C:\Program Files\Safari
[07/07/2008|14:04] C:\Program Files\Services en ligne
[07/07/2008|14:25] C:\Program Files\SigmaTel
[07/07/2008|20:57] C:\Program Files\temp01
[08/07/2008|16:41] C:\Program Files\TomTom DesktopSuite
[07/07/2008|14:16] C:\Program Files\Uninstall Information
[16/07/2008|16:08] C:\Program Files\VirginMega
[23/07/2008|15:53] C:\Program Files\Windows Live
[16/07/2008|16:02] C:\Program Files\Windows Media Connect 2
[27/07/2008|19:26] C:\Program Files\Windows Media Player
[07/07/2008|14:01] C:\Program Files\Windows NT
[07/07/2008|14:02] C:\Program Files\Windows Plus
[07/07/2008|14:04] C:\Program Files\WindowsUpdate
[07/07/2008|19:26] C:\Program Files\WinRAR
[07/07/2008|14:05] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[08/07/2008|13:36] C:\Program Files\Fichiers communs\Ahead
[22/07/2008|12:45] C:\Program Files\Fichiers communs\Apple
[19/07/2008|23:12] C:\Program Files\Fichiers communs\DESIGNER
[09/07/2008|00:51] C:\Program Files\Fichiers communs\InstallShield
[17/07/2008|22:07] C:\Program Files\Fichiers communs\Jasc Software Inc
[07/07/2008|14:34] C:\Program Files\Fichiers communs\Java
[08/07/2008|13:51] C:\Program Files\Fichiers communs\Kodak
[19/07/2008|23:13] C:\Program Files\Fichiers communs\Microsoft Shared
[07/07/2008|14:03] C:\Program Files\Fichiers communs\MSSoap
[07/07/2008|15:57] C:\Program Files\Fichiers communs\ODBC
[07/07/2008|14:03] C:\Program Files\Fichiers communs\Services
[07/07/2008|15:57] C:\Program Files\Fichiers communs\SpeechEngines
[23/07/2008|15:44] C:\Program Files\Fichiers communs\System
[23/07/2008|15:43] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 85 Processus )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-28 12:29:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:12][D:46]-> C:\DOCUME~1\Nadine\LOCALS~1\Temp
[F:172][D:0]-> C:\DOCUME~1\Nadine\Cookies
[F:8153][D:9]-> C:\DOCUME~1\Nadine\LOCALS~1\TEMPOR~1\content.IE5

--------------------\\ Fin du rapport a 12:30:09,85


dsl mais je ne pourrais plus te répondre avant demain car je travaille d'après midi et je rentre que vers minuit.

Encore merci de ton aide

Slt,

Alors voilà le rapport de SDFix :



SDFix: Version 1.208
Run by Nadine on 29/07/2008 at 14:10

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-29 14:14:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:e3,73,38,7d,77,8f,82,7e,c7,72,75,45,13,41,8d,66,f5,b5,e2,fe,30,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,86,b2,97,24,8e,3c,7f,43,7a,56,b4,2a,56,60,65,18,68,..
"khjeh"=hex:36,c4,b6,9b,4f,eb,d1,19,c7,b8,f1,5a,0b,ae,55,c4,0b,63,e2,2d,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:3a,48,57,2f,a3,c7,2b,68,d0,fa,88,e9,d4,fd,6c,a1,8a,59,cc,79,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:e3,73,38,7d,77,8f,82,7e,c7,72,75,45,13,41,8d,66,f5,b5,e2,fe,30,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,86,b2,97,24,8e,3c,7f,43,7a,56,b4,2a,56,60,65,18,68,..
"khjeh"=hex:36,c4,b6,9b,4f,eb,d1,19,c7,b8,f1,5a,0b,ae,55,c4,0b,63,e2,2d,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:3a,48,57,2f,a3,c7,2b,68,d0,fa,88,e9,d4,fd,6c,a1,8a,59,cc,79,bd,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"D:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="D:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"D:\\Program Files\\LimeWire\\LimeWire.exe"="D:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="D:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="D:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Enabled:LEXPPS.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Thu 24 Jul 2008 72 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti1049.tmp"
Wed 16 Jul 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\02fcd9cda045f9dd46a861d251f6b7b1\BIT11.tmp"
Mon 7 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT8.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5b68a8371325b092494be04cd7222f7e\BITD.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7779524ce1b472c62f1b0f1a192676ad\BITF.tmp"
Mon 7 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8171d23d6d072d8b50d065ca55a754fb\BITA.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8f29a7a40b2d9aecc6dd8c0d708fef07\BITC.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9664ff6405d9e0e32778ca8618d4be26\BITB.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\97de84be36b27af6e66a0586433cda52\BITA.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bea0ec052f9fb30876ce0b314fb5e9e8\BITE.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bf110da611ffb0b3c1fd41a83ef95fc6\BIT12.tmp"
Wed 23 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb1cc7c8ed3868a5a32ffb677fe0fde8\BIT10.tmp"

Finished!

voilà le rapport HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:20:37, on 29/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Program Files\QuickTime\QTTask.exe
D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "D:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com [...] _0_2_0.cab
O16 - DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} (Jolly Bear Games Player) - http://games.bigfishgames.com/fr_b [...] Player.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

--
End of file - 9487 bytes

Re,

Télécharge MalwareByte's Anti-Malware sur ton Bureau.

• Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées :

• Fais redémarrer ton ordinateur en mode sans échec

- Au démarrage, après le chargement du bios, appuie successivement sur la touche F8 (ou F5) de ton clavier jusqu'à l'apparition d'un menu sur fond noir. Une fois arrivé à ce stade, sélectionne à l'aide du clavier Mode sans Echec.
-- Dans ce mode, tu n'as pas accès à Internet, et tu te retrouves avec une configuration visuelle différente (pas de fond d'écran, icônes très grosses). Ne sois donc pas étonné.
--- C'est pour ces différentes raisons que je t'invite à imprimer, noter, ou enregistrer dans un document texte les informations suivantes afin de ne pas être perdu.
---- ! Ne fais pas démarrer ton ordinateur en mode sans échec via MSConfig ! Pourquoi ? Certaines infections cassent les clefs du mode sans échec, ce qui ferait crasher ton ordinateur.

• Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
• Afin de lancer la recherche, clic sur"Rechercher".
• Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :

~ Si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
~~ Si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau.
~~~~ Fais redémarrer ton ordinateur normalement et poste le rapport dans ta prochaine réponse.

REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.

Aide :

• Comment utiliser MBAM.
• Comment faire démarrer son ordinateur en mode sans échec.

Re,

Poste un nouveau rapport HijackThis.
Plus de soucis ?

C'est la restauration système, c'est rien.

Prévention :

- Nettoyage des fichiers temporaires :

Télécharge Ccleaner sur ton Bureau.

• Clique sur "download the latest version"
• Installe-le en laissant seulement les options suivantes cochées :

- Ajouter un raccourci sur le Bureau
- Contrôler automatiquement les mises à jour de CCleaner

• Lance le Nettoyage
• Clique sur Chercher des erreurs et sauvegarde si tu le souhaites.

Aide : Comment utiliser CCleaner.


Telecharge ATFcleaner sur ton Bureau.

• Double-clique sur l'exécutable téléchargé.
• Dans l'onglet Main, coche simplement la case Select All (toutes les cases vont se cocher) puis sur le bouton Empty Selected.
• Si tu possèdes Firefox ou Opera comme navigateur, pense à choisir ton navigateur en haut a gauche avant de sélectionner Select All puis Empty Selected.
• Puis réponds Non au message qui s'affiche, si tu ne souhaites pas perdre tes mots de passe.

Aide : Comment utiliser AFTCleaner.

-- Restauration Système :

Désactive-Réactive la restauration système.

Méthode XP :
Clique sur Démarrer, fais un clique droit sur le Poste de travail puis clique sur Propiétés. Sélectionne l'onglet Restauration du Système.
Dans cet onglet, coche la case Désactiver la Restauration du système sur tous les lecteurs.
Un message de confirmation va apparaître. Clique sur Oui, puis OK. Fais redémarrer ton ordinateur pour que les changements soient bien pris en compte.
Pour réactiver la restauration système, il suffit de décocher cette même case et de faire redémarrer ton ordinateur (en ayant suivi les mêmes étapes).

Méthode Vista :
Clique sur Démarrer, fais un clique droit sur Ordinateur, puis clique sur Propriétés. Clique à gauche sur Paramètres système avancés. Sélectionne l'onglet Protection du Système.
Dans cet onglet, décoche (une par une) tes partitions, un message de confirmation va apparaître, clique sur Désactiver la protection du système, Clique sur Appliquer, puis OK.
Fais redémarrer ton ordinateur pour que les changements soient bien pris en compte.
Pour réactiver la restauration système, il suffit de décocher cette même case et de faire redémarrer ton ordinateur (en ayant suivi les mêmes étapes).

Aide : Comment Désactiver-Réactiver la Restauration Système.

--- Affichage normal des fichiers :

Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
- Décoche Afficher les fichiers et dossiers cachés
- Coche Masquer les fichiers protégés du système d'exploitation (recommandé)
clique sur Appliquer, puis OK.

---- Suppression des outils installés :

Télécharge ToolsCleaner2 (de A.Rothstein)

• Installe le sur ton Bureau.
• Clique sur Recherche pour lancer le scan.
• Clique sur Supprimer pour nettoyer les outils utilisés.
• Clique sur Quitter.
• Supprime maintenant ToolsCleaner.

----- Remise en place des protections, protection du système avec les Mises à Jour ! :

Je t'invite maintenant à (ré)activer toutes tes protections résidentes (Antivirus, Antispyware, Firewall..).
Tu dois avoir accès à tes protections dans la zone systray à côté de la barre des tâches. Si tu as des difficultés, n'hésite pas à me questionner !
Si ce n'est pas fait, assure-toi que les Mises à jour Automatiques Windows soient activées !
Mets tes Softwares correctement à jour (Java, Adobe, Flash ..) grâce à Sotware Inspector (chez Secunia)

Un petit mot à propos de Java :

Une fois la nouvelle version téléchargée, installe-la et fais redémarrer ton ordinateur.
Hélas, les anciennes version de Java (qui contiennent des failles, donc dangereuses !) sont toujours présentes !
C'est donc très important que tu désinstalles les anciennes versions de Java.

• Va dans Démarrer, Panneau de Configuration, Ajout/Suppression de Programmes
• Déinstalles toutes les versions de Java exceptée la plus récente.

Aide : Comment utiliser Secunia Software Inspector.

------ Ton infection, tu la dénonces ? :

Tu n'es pas obligé mais ce serait bien que tu rapportes ton infection sur Malware Complaints

• Ton(tes) infection(s) : SmitFraud.
• Si tu ne la trouves pas dans la liste, poste dans Autres infections.

Aide : Comment dénoncer mon infection sur Malware Complaints.

Je t'invite maintenant à regarder ces dossiers très instructifs en terme de prévention !

- Sécurité/Prévention
- Conséquences de la multi-protection
- Toolbars : Inutilité et ralentissements

Bonne journée/soirée