!!! VIRUS ALERT !!! sa fait mal :(
Forum Sécurité - Virus : !!! VIRUS ALERT !!! sa fait mal :(
bonjour
j'ai chopé un virus de dingue " 
""VIRUS ALERT!"" " il a completement infecté mon pc!!!
il y a quelques jours par un programme que je connais pas. J'ai virus alert! qui est écrit dans la barre de tâche à coté de l'horloge !!, le menu démarrer a été modifié(peux plus aller dans programmes), et une page rouge avec un message écrit dessus a pris la place de mon fond d'écran. Des icones sur mon bureau ont carément disparus, et j'ai bien l'impression que plus le temps passe plus mon PC est infecté!!!!
j'ai fais des recherches sur le net , il y a des gens qui ont les problemes du meme style mais chez moi c bien plus grave!
et je ne peux utiliser mon PC ou INTERNET qu'en mode sans échec!
en mode normal le windows xp il demarr meme pas 
aider moi please!!! je vous en prix aider moi 
merci d'avance
bonjour
merci pour votre réponse si rapide 
En fait avant de lire votre message j'avais installer sur mon PC (en mode sans echec avec prise en charge reseau) le logiciel "MALWAREBYTES ANTI MAL WARE" et j'ai effectué un scan complet du PC, il ma trouver 55 infections!
je vous met quand même son rapport :
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1340
Windows 5.1.2600 Service Pack 3
2008-10-30 16:48:09
mbam-log-2008-10-30 (16-48-02).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 483609
Temps écoulé: 1 hour(s), 17 minute(s), 48 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 6
Clé(s) du Registre infectée(s): 38
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 15
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 45
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\geBuRkiF.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\vygmftrg.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\ppcmnv.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\awttUNdD.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ypeclqyp.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\jyizkf.dll (Trojan.Vundo) -> No action taken.
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{338cf144-a9ed-4eea-8dc4-4a6a3ca69d8b} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awttundd (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{338cf144-a9ed-4eea-8dc4-4a6a3ca69d8b} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{369bf4ed-b8b4-453e-b495-37758c4032cc} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{369bf4ed-b8b4-453e-b495-37758c4032cc} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf0f8062-9d32-42b0-882f-7bcd86e34cb5} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{bf0f8062-9d32-42b0-882f-7bcd86e34cb5} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\lospn (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c420cf9f-d9d6-421f-958f-aa59906c2b12} (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c420cf9f-d9d6-421f-958f-aa59906c2b12} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{10026069-7a5f-4531-811e-c8df20643bee} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d71c4af2-9e0d-4eb3-98a6-f542e6f360d9} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e52c17c7-8498-4d09-93b8-0c9227d10aeb} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\lsksaq.bho (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{02ab27ba-a69b-415f-a422-6acc22666360} (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{53932e5f-2df6-4dc0-a12f-75a109403f64} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\total secure 2009 (Rogue.TotalSecure) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{97f9c9f8-3bb4-4380-a174-1954e487659e} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{f803e10b-ac96-405f-aae4-a8faa68bdde1} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{07f59883-f1d0-4008-ac16-80b2d8c745de} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{9f1e1fde-b3fd-447e-9536-42db60ba6206} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{4b87885d-104a-4c24-a9bb-7d795b8039a2} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{f8bcb609-1f2b-48b3-b3f4-1a92c4ed8ac9} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2164bd8b-eb1f-4e3d-8548-cf3e528b2a31} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8e45fab5-0ac1-4c58-bcb1-448330d55b97} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b4482a16-44e2-4cf1-bf8e-a80ec3de9770} (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b4482a16-44e2-4cf1-bf8e-a80ec3de9770} (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\wvfsrqab.bfba (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\wvfsrqab.toolbar.1 (Trojan.FakeAlert) -> No action taken.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f45ef945 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{338cf144-a9ed-4eea-8dc4-4a6a3ca69d8b} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\wfexqnrp (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\wvbegpqs (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4b87885d-104a-4c24-a9bb-7d795b8039a2} (Trojan.FakeAlert) -> No action taken.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\geburkif -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\geburkif -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76412-OEM-0011903-00106) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
Dossier(s) infecté(s):
C:\Program Files\TS-2009 (Rogue.TotalSecure) -> No action taken.
Fichier(s) infecté(s):
C:\WINDOWS\system32\awttUNdD.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\jyizkf.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\geBuRkiF.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\FikRuBeg.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\FikRuBeg.ini2 (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\kmdodxnc.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\cnxdodmk.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\vygmftrg.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\grtfmgyv.ini (Trojan.Vundo.H) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application Data\qvwzghq_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application Data\qvwzghq_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application Data\qvwzghq.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application Data\qvwzghq.exe (Adware.Navipromo.H) -> No action taken.
C:\WINDOWS\system32\ppcmnv.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ypeclqyp.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\sysbase32.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temp\pwrmgr.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temp\smchk.exe (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\E1MTW5K3\CAOHE3KD (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\E1MTW5K3\nd82m0[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\RZPB394W\upd105320[1] (Trojan.Vundo) -> No action taken.
C:\Program Files\TS-2009\scan.exe (Rogue.TotalSecure) -> No action taken.
C:\WINDOWS\eltd.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\wfexqnrp.dll (Trojan.Zlob) -> No action taken.
C:\WINDOWS\system32\pmnoOigH.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\uqyknvrd.dll (Trojan.Vundo) -> No action taken.
C:\Program Files\TS-2009\totalsecure.s2 (Rogue.TotalSecure) -> No action taken.
C:\Program Files\TS-2009\totalsecure.s3 (Rogue.TotalSecure) -> No action taken.
C:\Program Files\TS-2009\totalsecure.s6 (Rogue.TotalSecure) -> No action taken.
C:\Program Files\TS-2009\uninstall.exe (Rogue.TotalSecure) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temp\TDSS6c8c.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temp\TDSS6c9b.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\emnvoqgx.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\wvbegpqs.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\wvfsrqab.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\rsdgbtkqbsa.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\k.txt (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temp\s1402.php (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temp\Setup_ver1.1674.0.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Application Data\TmpRecentIcons\Total Secure 2009.lnk (Rogue.Link) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Bureau\Protect Your Privacy.url (Rogue.Link) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Bureau\Malware Defender.url (Rogue.Link) -> No action taken.
C:\Documents and Settings\Compaq_Propriétaire\Bureau\System Error Fixer.url (Rogue.Link) -> No action taken.
C:\WINDOWS\system32\TDSSoity.dll (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\TDSSmplt.sys (Rootkit.Agent) -> No action taken.
et maintenant je vais suivre votre indication avec COMBOFIX
merci encore!
oui j'ai bien supprimer les infections avec MBAM,
ensuite j'ai fais se que vous m'avez demander avec COMBOFIX
et voici le rapport:
ComboFix 08-10-30.06 - Compaq_Propriétaire 2008-10-30 17:20:42.1 - NTFSx86 NETWORK
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.327 [GMT 1:00]
Lancé depuis: C:\Documents and Settings\Compaq_Propriétaire\Bureau\DWL\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Compaq_Propriétaire\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\Compaq_Propriétaire\Application Data\mgsnhDemo_32.dll
D:\Autorun.inf
----- BITS: Il y a peut-être des sites infectés -----
hxxp://megauplinkbindinstaller.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
.
2008-10-30 15:16 . 2008-10-30 15:16 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-30 15:16 . 2008-10-30 15:16 <REP> d-------- C:\Documents and Settings\Compaq_Propriétaire\Application Data\Malwarebytes
2008-10-30 15:16 . 2008-10-30 15:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-30 15:16 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-30 15:16 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-30 15:07 . 2008-10-30 15:07 <REP> d-------- C:\Program Files\Trend Micro
2008-10-29 15:54 . 2008-10-29 15:54 20 --ahs---- C:\ntuser.ini
2008-10-29 12:23 . 2008-10-29 12:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-29 12:23 . 2008-10-29 12:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-29 12:23 . 2008-10-29 12:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-29 12:23 . 2008-10-29 12:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-29 12:22 . 2008-10-29 12:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-29 12:21 . 2008-10-29 12:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-29 01:16 . 2008-10-29 01:23 <REP> d-------- C:\Program Files\SpeedFan
2008-10-29 01:16 . 2008-10-29 01:16 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2008-10-28 23:00 . 2008-10-28 23:00 <REP> d-------- C:\Program Files\Lavalys
2008-10-26 21:23 . 2008-10-28 17:04 <REP> d-------- C:\Program Files\Call of Duty Game of the Year Edition
2008-10-26 21:21 . 2008-10-28 12:27 766 --a------ C:\WINDOWS\CoD.INI
2008-10-24 11:41 . 2008-10-15 17:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-15 23:05 . 2008-08-14 14:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 23:05 . 2008-08-14 14:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 23:05 . 2008-08-14 14:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 23:05 . 2008-08-14 14:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 23:05 . 2008-09-15 16:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 23:05 . 2008-09-08 11:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-09-24 11:47 . 2008-09-24 11:47 <REP> d-------- C:\Program Files\Sierra Entertainment
2008-09-24 11:06 . 2008-06-14 18:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-24 11:05 . 2008-04-11 20:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-24 11:05 . 2008-05-08 15:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-24 10:53 . 2008-09-24 10:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-09-24 10:53 . 2008-09-24 10:53 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-24 10:53 . 2008-09-24 10:53 <REP> d-------- C:\WINDOWS\system32\bits
2008-09-24 10:53 . 2008-09-24 10:53 <REP> d-------- C:\WINDOWS\l2schemas
2008-09-24 10:48 . 2008-09-24 10:53 <REP> d-------- C:\WINDOWS\ServicePackFiles
2008-09-24 10:32 . 2008-09-24 10:32 <REP> d-------- C:\WINDOWS\EHome
2008-09-14 14:13 . 2008-10-29 13:53 <REP> d-------- C:\Documents and Settings\Compaq_Propriétaire\Application Data\OpenOffice.org2
2008-09-14 14:10 . 2008-09-14 14:11 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
2008-09-09 06:55 . 2004-08-03 23:38 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-09-09 06:43 . 2008-09-24 11:01 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-29 15:06 --------- d-----w C:\Program Files\Arovax AntiSpyware
2008-10-29 11:52 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire\Application Data\uTorrent
2008-10-29 09:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-10-28 20:04 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-10-28 20:04 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire\Application Data\SystemRequirementsLab
2008-10-26 11:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 11:47 --------- d-----w C:\Program Files\Activision
2008-10-21 11:30 --------- d-----w C:\Program Files\DkZ Studio
2008-10-10 11:31 --------- d-----w C:\Program Files\Lx_cats
2008-10-05 20:47 --------- d-----w C:\Program Files\KONAMI
2008-09-26 14:19 --------- d-----w C:\Program Files\adslTV
2008-09-24 10:35 --------- d-----w C:\Program Files\Cenega
2008-09-14 16:54 --------- d-----w C:\Program Files\DivX
2008-09-13 14:35 --------- d-----w C:\Program Files\Java
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Arovax AntiSpyware"="C:\Program Files\Arovax AntiSpyware\arovaxantispyware.exe" [2007-09-21 1966080]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2008-05-06 202088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 155648]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 61440]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-06-08 286720]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2003-09-12 98304]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2004-11-22 299008]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-02 98304]
"Symantec PIF AlertEng"="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 81920]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-15 368640]
"LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 69632]
"lxbumon.exe"="C:\Program Files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 196608]
"EzPrint"="C:\Program Files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 61440]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]
"SiSPower"="SiSPower.dll" [2004-09-24 C:\WINDOWS\system32\SiSPower.dll]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 C:\WINDOWS\AGRSMMSG.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 C:\WINDOWS\ALCXMNTR.EXE]
"nwiz"="nwiz.exe" [2004-09-29 C:\WINDOWS\system32\nwiz.exe]
C:\Documents and Settings\Compaq_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe [2007-07-20 2913584]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-21 45056]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=jyizkf.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"C:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2008-07-02 86792]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S0 uwim;uwim;C:\WINDOWS\system32\drivers\vmrwqm.sys [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c67c0038-dc10-11dc-a46f-0011d8857b24}]
\Shell\AutoRun\command - L:\InstallTomTomHOME.exe
.
Contenu du dossier 'Tâches planifiées'
2008-10-30 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-DXDllRegExe - C:\WINDOWS\system32\dxdllreg.exe
HKLM-Run-VTTimer - VTTimer.exe
SafeBoot-TDSSmplt.sys
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Compaq_Propriétaire\Application Data\Mozilla\Firefox\Profiles\wpyi9vha.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr
fficial
FF -: plugin - C:\Program Files\adslTV\npvlc.dll
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 17:35:40
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\WINDOWS\system32\lxbucoms.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.bin
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
.
**************************************************************************
.
Heure de fin: 2008-10-30 18:09:30 - La machine a redémarré [Compaq_Propriétaire]
ComboFix-quarantined-files.txt 2008-10-30 17:08:24
Avant-CF: 20,303,273,984 octets libres
Après-CF: 19,761,217,536 octets libres
205 --- E O F --- 2008-10-30 16:58:15
sa a pris bcp de temps après le redemarrage
qu'en posez vous de se rapport?
ok c'est fais, j'ai fixé la ligne 20 - AppInit_DLLs: jyizkf.dll
voici le rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:48, on 31/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lexmark 6200 Series\lxbumon.exe
C:\Program Files\Lexmark 6200 Series\ezprint.exe
C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe
C:\Program Files\Arovax AntiSpyware\arovaxantispyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\WINDOWS\system32\lxbucoms.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbumon.exe] "C:\Program Files\Lexmark 6200 Series\lxbumon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 6200 Series\ezprint.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
O4 - HKCU\..\Run: [Arovax AntiSpyware] C:\Program Files\Arovax AntiSpyware\arovaxantispyware.exe /s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr [...] NPUpld.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://vchat.evoicechat.com/talk.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driv [...] rtScan.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
--
End of file - 10462 bytes
qu'en posez vous?
merci encore
En tout cas le VIRUS ALERT vous me l'avez détruit pour de bon!
respect a vous, et merci encore
Bon surf 
Répondre à Angeldark
