Virus inconnus / Rapport hijackthis

bonjour et bonne année à tous,

Il me semble que mon PC est infecté par une virus ou un troyens (trojan).

J'ai lancer a-squarred free 4.0 et il me détecte un trojan.loader.AK!IK 7 fois et systématiquement sur le fichier svchost.exe dans le dossier system32. je ne peut donc pas le supprimer sans avaoir des problèmes car cela dépasse mes compétences informatiques.

J'ai lancer une analyse hijackthis, quelqu'un peux m'aider ??

Voici le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:11, on 2009-01-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\EzButton\EzButton.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ke.voila.fr/S/voila?kw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Li [...] SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {0C657A24-2C2F-4E94-A2A3-9EDF7CF2D773} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [EzButton.EXE] C:\Program Files\EzButton\EzButton.EXE
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [__GSCAdditionalInstallation__] "D:\Cossacks2Setup.exe" -AdditionalInstall
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O15 - Trusted Zone: http://www.orange.fr
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe

--
End of file - 9536 bytes

Répondre

Inscrivez-vous ou connectez-vous pour masquer ceci.

Bonjour,

Tu as l'emplacement de l'infection ?

------------------------------ Prévention & Protection||Vous m'aimez ? Cliquez :o
Répondre à Angeldark

le trojan est implanté sur svchost.exe

Répondre à eruo

Ça sent la fausse détection. Analyse le fichier sur VirusTotal.

------------------------------ Prévention & Protection||Vous m'aimez ? Cliquez :o
Répondre à Angeldark

Voici le résultat de l'analyse :

Antivirus Version MAJ Résultat
a-squared 4.0.0.73 2009.01.07 Trojan.Loader.AK!IK
AntiVir 7.9.0.45 2009.01.07 HEUR/Malware
Avast 4.8.1281.0 2009.01.07 Win32:Agent-ABMO
BitDefender 7.2 2009.01.07 Trojan.Loader.AK
CAT-QuickHeal 10.00 2009.01.06 (Suspicious) - DNAScan
F-Secure 8.0.14470.0 2009.01.07 Trojan-Downloader.Win32.Agent.adrd
GData 19 2009.01.07 Trojan.Loader.AK
Ikarus T3.1.1.45.0 2009.01.07 Trojan.Loader.AK
Kaspersky 7.0.0.125 2009.01.07 Trojan-Downloader.Win32.Agent.adrd
McAfee 5487 2009.01.07 New Win32.g4
McAfee+Artemis 5487 2009.01.06 New Win32.g4
Microsoft 1.4205 2009.01.07 Virus:Win32/Proscks.F
SecureWeb-Gateway 6.7.6 2009.01.07 Heuristic.Malware
ViRobot 2009.1.7.1548 2009.01.07 Trojan.Win32.Downloader.14336.BX

Que dois je faire ? Visiblement, il n'y a pas qu'une infection !!!

Merci

Répondre à eruo

Les noms sont différents, mais au final c'est la même chose
On va devoir remplacer le fichier par une copie saine.

! Désactive tes protections résidentes (antivirus, Spybot-S&D, etc.) !

Télécharge ComboFix (sUBs) sur ton Bureau.
Double clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\combofix.txt*) dans ta prochaine réponse.

AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer

------------------------------ Prévention & Protection||Vous m'aimez ? Cliquez :o
Répondre à Angeldark

Voici le rapport de combofix :

ComboFix 09-01-07.03 - utilisateur 2009-01-08 18:07:49.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.511.150 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\imgdoc2.dll
c:\documents and settings\utilisateur\Application Data\inst.exe
c:\program files\INSTALL.LOG
c:\windows\system32\_003682_.tmp.dll
c:\windows\system32\_003683_.tmp.dll
c:\windows\system32\_003684_.tmp.dll
c:\windows\system32\_003685_.tmp.dll
c:\windows\system32\_003692_.tmp.dll
c:\windows\system32\_003694_.tmp.dll
c:\windows\system32\_003695_.tmp.dll
c:\windows\system32\_003696_.tmp.dll
c:\windows\system32\_003697_.tmp.dll
c:\windows\system32\_003698_.tmp.dll
c:\windows\system32\_003699_.tmp.dll
c:\windows\system32\_003700_.tmp.dll
c:\windows\system32\_003701_.tmp.dll
c:\windows\system32\_003702_.tmp.dll
c:\windows\system32\_003703_.tmp.dll
c:\windows\system32\_003704_.tmp.dll
c:\windows\system32\_003705_.tmp.dll
c:\windows\system32\_003706_.tmp.dll
c:\windows\system32\_003707_.tmp.dll
c:\windows\system32\_003708_.tmp.dll
c:\windows\system32\_003709_.tmp.dll
c:\windows\system32\_003710_.tmp.dll
c:\windows\system32\_003711_.tmp.dll
c:\windows\system32\_003712_.tmp.dll
c:\windows\system32\_003713_.tmp.dll
c:\windows\system32\_003714_.tmp.dll
c:\windows\system32\_003715_.tmp.dll
c:\windows\system32\_003716_.tmp.dll
c:\windows\system32\_003717_.tmp.dll
c:\windows\system32\_003718_.tmp.dll
c:\windows\system32\_003719_.tmp.dll
c:\windows\system32\_003720_.tmp.dll
c:\windows\system32\_003721_.tmp.dll
c:\windows\system32\_003722_.tmp.dll
c:\windows\system32\_003723_.tmp.dll
c:\windows\system32\_003724_.tmp.dll
c:\windows\system32\_003726_.tmp.dll
c:\windows\system32\_003727_.tmp.dll
c:\windows\system32\_003728_.tmp.dll
c:\windows\system32\_003729_.tmp.dll
c:\windows\system32\_003730_.tmp.dll
c:\windows\system32\_003731_.tmp.dll
c:\windows\system32\_003732_.tmp.dll
c:\windows\system32\_003733_.tmp.dll
c:\windows\system32\_003734_.tmp.dll
c:\windows\system32\_003735_.tmp.dll
c:\windows\system32\_003736_.tmp.dll
c:\windows\system32\_003737_.tmp.dll
c:\windows\system32\_003738_.tmp.dll
c:\windows\system32\_003739_.tmp.dll
c:\windows\system32\_003740_.tmp.dll
c:\windows\system32\_003741_.tmp.dll
c:\windows\system32\_003742_.tmp.dll
c:\windows\system32\_003743_.tmp.dll
c:\windows\system32\_003744_.tmp.dll
c:\windows\system32\_003745_.tmp.dll
c:\windows\system32\_003746_.tmp.dll
c:\windows\system32\_003747_.tmp.dll
c:\windows\system32\_003748_.tmp.dll
c:\windows\system32\_003749_.tmp.dll
c:\windows\system32\_003750_.tmp.dll
c:\windows\system32\_003751_.tmp.dll
c:\windows\system32\_003752_.tmp.dll
c:\windows\system32\_003753_.tmp.dll
c:\windows\system32\_003754_.tmp.dll
c:\windows\system32\_003755_.tmp.dll
c:\windows\system32\_003756_.tmp.dll
c:\windows\system32\_003757_.tmp.dll
c:\windows\system32\_003758_.tmp.dll
c:\windows\system32\_003759_.tmp.dll
c:\windows\system32\_003760_.tmp.dll
c:\windows\system32\_003761_.tmp.dll
c:\windows\system32\_003762_.tmp.dll
c:\windows\system32\_003763_.tmp.dll
c:\windows\system32\_003764_.tmp.dll
c:\windows\system32\_003765_.tmp.dll
c:\windows\system32\_003766_.tmp.dll
c:\windows\system32\_003767_.tmp.dll
c:\windows\system32\_003768_.tmp.dll
c:\windows\system32\_003769_.tmp.dll
c:\windows\system32\_003770_.tmp.dll
c:\windows\system32\_003771_.tmp.dll
c:\windows\system32\_003772_.tmp.dll
c:\windows\system32\_003773_.tmp.dll
c:\windows\system32\_003774_.tmp.dll
c:\windows\system32\_003775_.tmp.dll
c:\windows\system32\_003776_.tmp.dll
c:\windows\system32\_003777_.tmp.dll
c:\windows\system32\_003778_.tmp.dll
c:\windows\system32\_003779_.tmp.dll
c:\windows\system32\_003780_.tmp.dll
c:\windows\system32\_003781_.tmp.dll
c:\windows\system32\_003782_.tmp.dll
c:\windows\system32\_003783_.tmp.dll
c:\windows\system32\_003784_.tmp.dll
c:\windows\system32\_003785_.tmp.dll
c:\windows\system32\_003786_.tmp.dll
c:\windows\system32\_003787_.tmp.dll
c:\windows\system32\_003788_.tmp.dll
c:\windows\system32\_003789_.tmp.dll
c:\windows\system32\_003790_.tmp.dll
c:\windows\system32\_003792_.tmp.dll
c:\windows\system32\_003793_.tmp.dll
c:\windows\system32\_003794_.tmp.dll
c:\windows\system32\_003795_.tmp.dll
c:\windows\system32\_003796_.tmp.dll
c:\windows\system32\_003797_.tmp.dll
c:\windows\system32\_003798_.tmp.dll
c:\windows\system32\_003799_.tmp.dll
c:\windows\system32\_003800_.tmp.dll
c:\windows\system32\_003801_.tmp.dll
c:\windows\system32\_003802_.tmp.dll
c:\windows\system32\_003803_.tmp.dll
c:\windows\system32\_003804_.tmp.dll
c:\windows\system32\_003805_.tmp.dll
c:\windows\system32\_003806_.tmp.dll
c:\windows\system32\_003807_.tmp.dll
c:\windows\system32\_003808_.tmp.dll
c:\windows\system32\_003809_.tmp.dll
c:\windows\system32\_003810_.tmp.dll
c:\windows\system32\_003811_.tmp.dll
c:\windows\system32\_003812_.tmp.dll
c:\windows\system32\_003813_.tmp.dll
c:\windows\system32\_003814_.tmp.dll
c:\windows\system32\_003815_.tmp.dll
c:\windows\system32\_003816_.tmp.dll
c:\windows\system32\_003817_.tmp.dll
c:\windows\system32\_003818_.tmp.dll
c:\windows\system32\_003819_.tmp.dll
c:\windows\system32\_003820_.tmp.dll
c:\windows\system32\_003821_.tmp.dll
c:\windows\system32\_003822_.tmp.dll
c:\windows\system32\_003823_.tmp.dll
c:\windows\system32\_003825_.tmp.dll
c:\windows\system32\_003826_.tmp.dll
c:\windows\system32\_003827_.tmp.dll
c:\windows\system32\_003828_.tmp.dll
c:\windows\system32\_003829_.tmp.dll
c:\windows\system32\_003830_.tmp.dll
c:\windows\system32\_003831_.tmp.dll
c:\windows\system32\_003833_.tmp.dll
c:\windows\system32\_003834_.tmp.dll
c:\windows\system32\_003835_.tmp.dll
c:\windows\system32\_003836_.tmp.dll
c:\windows\system32\_003837_.tmp.dll
c:\windows\system32\_003838_.tmp.dll
c:\windows\system32\_003839_.tmp.dll
c:\windows\system32\_003840_.tmp.dll
c:\windows\system32\_003841_.tmp.dll
c:\windows\system32\_003842_.tmp.dll
c:\windows\system32\_003843_.tmp.dll
c:\windows\system32\_003844_.tmp.dll
c:\windows\system32\_003845_.tmp.dll
c:\windows\system32\_003846_.tmp.dll
c:\windows\system32\_003847_.tmp.dll
c:\windows\system32\_003848_.tmp.dll
c:\windows\system32\_003849_.tmp.dll
c:\windows\system32\_003851_.tmp.dll
c:\windows\system32\_003852_.tmp.dll
c:\windows\system32\_003853_.tmp.dll
c:\windows\system32\_003854_.tmp.dll
c:\windows\system32\_003855_.tmp.dll
c:\windows\system32\_003858_.tmp.dll
c:\windows\system32\_003859_.tmp.dll
c:\windows\system32\_003860_.tmp.dll
c:\windows\system32\_003861_.tmp.dll
c:\windows\system32\_003862_.tmp.dll
c:\windows\system32\_003863_.tmp.dll
c:\windows\system32\_003864_.tmp.dll
c:\windows\system32\_003866_.tmp.dll
c:\windows\system32\_003867_.tmp.dll
c:\windows\system32\_003868_.tmp.dll
c:\windows\system32\_003869_.tmp.dll
c:\windows\system32\_003870_.tmp.dll
c:\windows\system32\_003871_.tmp.dll
c:\windows\system32\_003872_.tmp.dll
c:\windows\system32\_003873_.tmp.dll
c:\windows\system32\_003874_.tmp.dll
c:\windows\system32\_003875_.tmp.dll
c:\windows\system32\_003876_.tmp.dll
c:\windows\system32\_003877_.tmp.dll
c:\windows\system32\_003879_.tmp.dll
c:\windows\system32\_003880_.tmp.dll
c:\windows\system32\_003881_.tmp.dll
c:\windows\system32\_003882_.tmp.dll
c:\windows\system32\_003884_.tmp.dll
c:\windows\system32\_003885_.tmp.dll
c:\windows\system32\_003886_.tmp.dll
c:\windows\system32\_003887_.tmp.dll
c:\windows\system32\_003888_.tmp.dll
c:\windows\system32\_003891_.tmp.dll
c:\windows\system32\_003892_.tmp.dll
c:\windows\system32\_003893_.tmp.dll
c:\windows\system32\_003894_.tmp.dll
c:\windows\system32\_003895_.tmp.dll
c:\windows\system32\_003896_.tmp.dll
c:\windows\system32\_003897_.tmp.dll
c:\windows\system32\_003899_.tmp.dll
c:\windows\system32\_003900_.tmp.dll
c:\windows\system32\_003901_.tmp.dll
c:\windows\system32\_003902_.tmp.dll
c:\windows\system32\_003903_.tmp.dll
c:\windows\system32\_003904_.tmp.dll
c:\windows\system32\_003905_.tmp.dll
c:\windows\system32\_003906_.tmp.dll
c:\windows\system32\_003908_.tmp.dll
c:\windows\system32\_003909_.tmp.dll
c:\windows\system32\_003910_.tmp.dll
c:\windows\system32\_003913_.tmp.dll
c:\windows\system32\_003914_.tmp.dll
c:\windows\system32\_003918_.tmp.dll
c:\windows\system32\_003919_.tmp.dll
c:\windows\system32\_003921_.tmp.dll
c:\windows\system32\_003924_.tmp.dll
c:\windows\system32\_003926_.tmp.dll
c:\windows\system32\_003927_.tmp.dll
c:\windows\system32\_003928_.tmp.dll
c:\windows\system32\_003929_.tmp.dll
c:\windows\system32\_003932_.tmp.dll
c:\windows\system32\_003933_.tmp.dll
c:\windows\system32\_003934_.tmp.dll
c:\windows\system32\_003935_.tmp.dll
c:\windows\system32\_003936_.tmp.dll
c:\windows\system32\_003941_.tmp.dll
c:\windows\system32\_003943_.tmp.dll
c:\windows\system32\TDfLoUvw.ini2

[color=blue]Une copie infectée de c:\windows\system32\svchost.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\qoobox\Quarantine\C\WINDOWS\system32\svchost.exe.vir[/COLOR]

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-08 au 2009-01-08 ))))))))))))))))))))))))))))))))))))
.

2009-01-04 11:25 . 2009-01-08 16:54 <REP> d-------- c:\program files\Trojan Remover
2009-01-04 11:25 . 2009-01-04 11:25 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Simply Super Software
2009-01-04 11:25 . 2009-01-04 11:25 <REP> d-------- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-01-04 11:25 . 2006-05-25 14:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll
2009-01-04 11:25 . 2003-02-02 19:06 153,088 --a------ c:\windows\system32\UNRAR3.dll
2009-01-04 11:25 . 2005-08-26 00:50 77,312 --a------ c:\windows\system32\ztvunace26.dll
2009-01-04 11:25 . 2002-03-06 00:00 75,264 --a------ c:\windows\system32\unacev2.dll
2009-01-04 11:25 . 2006-06-19 12:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll
2009-01-01 11:34 . 2009-01-01 11:34 45 ---h----- c:\windows\dsez8617.dat
2009-01-01 11:33 . 2009-01-01 11:39 <REP> d-------- c:\program files\PhotoFiltre Studio
2008-12-30 20:19 . 2004-08-20 00:09 3,555,328 --a------ c:\windows\system32\dllcache\moviemk.exe
2008-12-30 20:18 . 2007-10-25 17:43 8,516,608 --a------ c:\windows\system32\dllcache\shell32.dll
2008-12-30 20:17 . 2008-08-14 14:44 2,138,112 --a------ c:\windows\system32\ntoskrnl.exe
2008-12-30 20:02 . 2008-04-14 03:34 1,037,824 --a------ c:\windows\SET4CA.tmp
2008-12-30 00:40 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2008-12-30 00:38 . 2008-12-30 00:38 <REP> d-------- c:\program files\Panda Security
2008-12-29 17:53 . 2008-12-29 17:53 <REP> d-------- c:\program files\GSC Game World
2008-12-15 18:10 . 2008-12-15 18:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Apple Computer
2008-12-15 18:09 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-15 18:09 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-15 18:08 . 2008-12-15 18:08 <REP> d-------- c:\program files\iPod
2008-12-15 18:07 . 2008-12-15 18:09 <REP> d-------- c:\program files\iTunes
2008-12-15 18:07 . 2008-12-15 18:09 <REP> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-15 18:02 . 2009-01-05 15:43 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-12-15 15:28 . 2008-12-16 10:11 <REP> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-12-14 12:30 . 2008-12-15 18:05 <REP> d-------- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-08 15:57 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-08 15:56 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-08 09:37 --------- d-----w c:\documents and settings\utilisateur\Application Data\uTorrent
2009-01-05 15:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-04 17:38 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-04 17:38 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-12-29 22:17 --------- d-----w c:\program files\CCleaner
2008-12-19 21:21 --------- d-----w c:\program files\a-squared Free
2008-12-15 22:52 --------- d-----w c:\documents and settings\utilisateur\Application Data\Vso
2008-12-15 17:03 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-15 14:40 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-12-14 13:02 --------- d-----w c:\program files\palmOne
2008-12-14 13:00 --------- d-----w c:\program files\DivX
2008-12-10 23:56 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-22 13:53 --------- d-----w c:\program files\Microprose
2008-11-13 09:01 --------- d-----w c:\program files\MSXML 4.0
2008-11-08 08:15 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-07-11 16:37 94,208 ----a-w c:\documents and settings\utilisateur\Application Data\ezplay.sys
2008-07-11 16:37 47,360 ----a-w c:\documents and settings\utilisateur\Application Data\pcouffin.sys
2007-05-15 20:28 62,752 ----a-w c:\documents and settings\utilisateur\Application Data\GDIPFONTCACHEV1.DAT
2006-03-17 21:14 10,680 ----a-w c:\documents and settings\utilisateur\Application Data\wklnhst.dat
2008-09-25 11:38 16,384 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
2008-09-22 19:34 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008091520080922\index.dat
2008-09-22 20:48 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008092220080923\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-20 15360]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-15 65536]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"__GSCAdditionalInstallation__"="D:\Cossacks2Setup.exe" [2005-03-25 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EzButton.EXE"="c:\program files\EzButton\EzButton.EXE" [2004-01-12 712704]
"SystrayORAHSS"="c:\program files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]
"ORAHSSSessionManager"="c:\program files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2008-12-10 1230728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-20 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2007-05-28 09:14 528384 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Boonty Games"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" /background

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Fichiers communs\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Microprose\\The Test of Time\\civ2.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 BatteryChecker;Battery Checker Driver;c:\windows\system32\drivers\BtryChkr.sys [2004-03-17 5392]
R0 BsStor;B.H.A Storage Helper Driver;c:\windows\system32\drivers\BsStor.sys [2005-11-24 10112]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-30 28544]
S1 aswSP;avast! Self Protection; [x]
S3 P1171VID;Creative WebCam Notebook #2;c:\windows\system32\drivers\P1171Vid.sys [2006-01-27 91392]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);c:\windows\system32\drivers\s716bus.sys [2008-07-24 83208]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;c:\windows\system32\drivers\s716mdfl.sys [2008-07-24 15112]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;c:\windows\system32\drivers\s716mdm.sys [2008-07-24 108552]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s716mgmt.sys [2008-07-24 100360]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);c:\windows\system32\drivers\s716nd5.sys [2008-07-24 23176]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;c:\windows\system32\drivers\s716obex.sys [2008-07-24 98568]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);c:\windows\system32\drivers\s716unic.sys [2008-07-24 98952]
S3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;c:\windows\system32\drivers\WlanUZXP.sys [2005-05-12 260608]
S3 ZDCndis5;ZDCndis5 Protocol Driver; [x]
S4 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25589692-68d6-11dc-9958-009096f23781}]
\Shell\Auto\command - cmd /C launch.bat
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4623a2ee-6151-11dd-9ca0-009096f23781}]
\shell\verb1\command - E:\PeSrvr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e8a1f94-c372-11dc-9b07-009096f23781}]
\Shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'

2009-01-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe []

2009-01-05 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{0C657A24-2C2F-4E94-A2A3-9EDF7CF2D773} - (no file)
Notify-dimsntfy - (no file)
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\oscan81.ocx_x - c:\windows\bdoscandellang.ini
c:\windows\bdoscandel.exe
c:\windows\Downloaded Program Files\live.ini
c:\windows\Downloaded Program Files\scanoptions.tsi
c:\windows\Downloaded Program Files\lang.ini
c:\windows\Downloaded Program Files\ipsupd.dll
c:\windows\Downloaded Program Files\bdupd.dll
c:\windows\Downloaded Program Files\libfn.dll
c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\oscan8.ocx
O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
hxxp://www.zebulon.fr/scan8/oscan8.cab
c:\windows\Downloaded Program Files\oscan8.inf
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\3uw1xnaw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:fr-FRfficial
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll

---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: browser.shell.checkDefaultBrowser - false
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-08 18:16:25
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*NULL*]
"OODEFRAG08.00.00.01WORKSTATION"="B2FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667C038D530D6EB3452C038D530D6EB34528EDD5E5BE2F6E667810EC62DEC9C38C227DA1A0F159752A9623F76761EAEA833F187619FEE61AE430B63B8873424FD0994D190E7021061FDA18A53B6BB979DF44E8342C2555217385F88B654DADB3F36B954C2E9D13856C3A24C12785FD07B66D9B927C6CA010E377BA6E152C92E5C4DB0B657C498F2263DBCA17DFAE7D76BABC7AEA19D9DA290E50D4BADC2DBAAC7934730C72BDE4958F3F70BB483AC4EABAD004A93B98F90312E7BEAE3EBDE840993FE5BE1D4A0E588B0176D2A57F6F70D979C5CB596554916BB5DDA21171611BA1B0DB747FACD1BE8838891A343023F745A6E15932E1B6E790001D5D691384C8D3DDA2A6DDB4B5ABBBF7522BD187F2FDA29F80A8C02FCC52A32E579492CF156C3CF07F71F3C6FBCDA7B37B1E5A8947A4EFCF2B456178DB90AC740C890BE616FB46C62CE7960077DB1935CB2DF4C5AF3EF9248F1767654581002782A1A2298804C71713BEE15D1FCBFA628FE42DDDD17F468180449AB4952C5DEACE7A7B220138901EFB3432805409B178F51F63E9FFD2743378FFE485C7EC8A42C30CBD372D7FE02490E93EA476C6B0DBF4C3ED116EB62AB2C1F1C60EC574C5CFB95F0EAFDA0551D2084CAB5B4506C7294F229FDA7C41A6E329EF60D53F81754D28F54E0A6E246424A39AB63DE596F77222E1FB0B490511AB9DF3B6AD9A7829B20F68423433C22A250AD4C51C79DD78FAEC9DA570BFDA204E51AE999BB47FC09030BE7A31E6A4C34EFC9956368D21DF0B4766CE7725D3AC48D6356BE2EE189B44F6DB759F6CFBAB11B59C6FEADD6CD16E2C835D722235BB6BD3C280455273D7C8EA57FBB01F3FA98770B708F752908409A39EBA4486859FAB4835B934C674301FD1D204A62022AABDD72780316EC817173A31C4D05E99E75E501BE202098D9288B23CF85B7C7FB70DC08194DD56A017038C8A4556D0AA7CF7ADCF6DD5355539A5E6995F30EB839B134A55FE4F18DE449E6CD38440B4B07F34CA4FB855BDA15454D864F1FE96DBBFD5B0B2E4399669BC9B1B9DBA5DA57E093EAC99952A38B1A5966F4AD93429D7226FBDC3AE7F1A82A0700796C0A4D7C6EA19BA0EF0709EC704DE8133463812A61C071A00E5511AB2957EB5E1904C7A9FCD7D2E370E65E293BD7C923BD2686162028CEC30712856CC4D4C39BE1AB24F46EB0BE3266BA690EAF7832CB75722407D97B5A13D7A8CC0A3D600B4AA09D2E97386D3F0AEAD0630F196F7C975C68A2C9CD1B0BC40428DCC9E59BF6E6FDF727EDE292E552EE767ABE54C0BBF348A73B4C4FAE906F68A39C9129EDF1507ADD45F78BE6FA54B484D1595437B33461589F9F4420CB8C30B0686F01"
"OOCC06.00.00.01WSSV"="E6A63918509F3748FE0A5F3D84DD009690955EB33A17F9BBE2E021A3CA2B1D0019865ED602C45AC8D7219C3F8AFA29FD079ABE4370CC974B96CF246CB6E777A75B015452F6C38F39FB8D3E68180964F9E28A0C0A0AC810BA5520F8E41F0526E9033A44AB698A2B35358A3197B01C9A728AD493C2F3E27DDEBE966C47FABE94A705EE9DB6F85B88CBF5E8235FBE1AB4440600E3DB01C67C02920D907DA527303A7D6E127E28CB0803508B07050D3E25C18225D2F9E476ABE239F3BAA9DB23E9EA2A1C19405FC58951FCED15044C965DAE5071F6733A4232B2BB4B83A0C16A37F96D6F6A6D6906F6245899480C91085744E4252E557CD2B79746ABC769FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933BA7FD869164D67948EDD5E5BE2F6E6675D575E7D6A3B9808AAAEAE00F6EDD4669D22940E09049C9687E6F52892BB7E4E5F1EDE60A85FEDB7A1E8A504075F3EE950E6FBD45572C30F87F7989984027ED6A0DBEEF538F2DB3C6095F098432D829ABF246ABAAC033512B80E66E654DC3B382CB8A31B113D65A4D30E1D31F50E96BC42F81F1E1545E45DF92DEFFBDF50CB500C3C81E80B58618A4A81C03212D130C690DADF5039DB0DE88CAD4AB6A9F2082FA8450F6AA36FEBBBFAF2F073ACD6CE64C88F7519E47CA9D9183E10E95A708F9BD384571FF7C264BCFC39CA43FD9330756BB32BB00B707D0F26DCDD5EBB08440FBF81E7FCCD28EB424B7E6DE262125A0E5E37D2C6C2178B18A5E0D6CDBB0C4CB68494D2EA0D06EBB748C17D85DB6F93F46CDD40FAC3649F39E9701FE66FE491731DEBB04540D90EBAB756A1560FDB6826BFBECC656D5B44EBA68B614E0C0FC25C690A9B5A9933421F426285F0431DAACF6C47540FC1174CDB78004B996D1752B82C443170E937BBEAF3E1D867E70DEB5767B5B877E6484CE9DD740ED3902175090D44153E2C9CF0D8BCA250BD0D980754091E5E0FA42E1D2BB7E05FFB1BE5A57C97076D71FAB11D57F146A26DE6C016109068AC3C6BA1DCE64E13F806D2AE24793B5F65281655BF084B450B63CE9AF90C9CCF91D9CB0B6C9ACAA99858235DEF19CAF2AAF660FB9C42E56A4901C150D6FBB5E5FC35FB686FF63B1C7F4F996250297EBB71E6642DB91141D3221B619E9545438C6410D5CD515F133173B7E9C64F2CF0076FF1CB08E23242735C7B7057E085937C3F205761BD6D28073ED56A243BD523F5DE0B6739A6983292C3DC595F2A8B57410B11225B276D358D2EDF962C2691F5807F132B8759693CC9A872A82FA45BA4BAC77F7C8BC0DE588994028E20E67AB3ED1364AFCA918171885D61905549AB741C7B7ECF548578149346DA9258966484DD60C9AEEE2A6EC4123A4163725468A36E2E93AA2C31A0CE191EFC"
"OODEFRAG11.00.00.01WORKSTATION"="FC00F575EC0E2311BCB1A7443871E5BC9AA317E5289C8A2F353CC545451DDC16543FAD2A0E77623A731759FC2FF15C9127BCC71A09840C514E1EA0358D4ED71C8B1F3746E014B03C1FA9E3145AE2D1EF7FCAA1C2482B4F3F50DF877388006DEB9C588DFA725951E66C019C248EE87AE0A3E5F6001E0593DBB1BCED4B769C0AE012E5DEDB283E7D2F9DF98FA973AC7B11AB6C53DA970B8B2E7FB176ECE88C8DF90D858CE1B5BD622E07B47D8483DBED54BFFDF13C95BBFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A6A0AC4980AC7933C038D530D6EB3452768719A8ABC880E2C4DB9DC4420A5B714A8506250FB23672F93CF17D3AFE307F90294AF98D1D28CA94EB1D23D6FD428420B6D1461B36C150FBF8A87B9D78AE51121B0A29B30BD23926C3A8AE68E77D715E3BF00A70D49FD7A84E4A9AF11CB3F7DECB26EE154C73F1C80E63A16A8B6450E5967AC8A0F72E8B0CB8837784A0C10CCF518046DC7D533DC49783F7860EA5B70B6D1A2270709E7A26D59370D91C2EA830658DF0EA218E685352D1F3997AC148910D0FF65AF07630EB6B51A8A68DA66CC464D6F2D39C1245A1552F1A333F0DA137632C6E8B1010BFC4E122085653277C3FCD7813DD38252653598BB3192FB0E9A9025873E44B1AC00C43833808B1047F4AC8A5DE05A1DDE57D3C6E4FC18029CA0D228F327C8094CD134106A90D53E3A0041DA225F76BA75FA90170BBDBCCC671779DE01D9C7355841D2ECD0EEBC24112F93749FA9B89C274574DC28FC7932F91F373EF6BC1CB0809628312DE5F70E9853429863887D5430AF7E9252397B55A5D8246F3179E14A8800F5C21D5D6B18332AAA65C79858E900770C57094967B1691145D37DD17BC0A17437859F174BD81D44B89DD1F965467D99CF20CC3C08D02EA92239942C598517912BA30F68E33B02DF4CD364C6E2C557248A6F757C4FB142B56A60F0AF65F775C042DACEAAF8FAF7D7E15A2E8F280BF45383BC43889381416301B1EBFAE2D4CF595FAEC9A16B8EF8FB124F323C19EDECA202E9B9226191F7862D7E2B120FEF000B6F39F9334763AACC9E48E68A837BD012BA134586858A69DA3560B71353A5AB9CB8B8AAAB1F6A7A6F7E1EDEFACDF3C66775BDDBD4F15EDD8A0365C540D2752652CDA84F56748A74FE1CD9D2F04128E021645FA3D10518FFD76BBAB76776E774AA31C7950E4E07D7FA07D3F639A2B3B5B0E6D029213737667B84B65B5F9A13BB272AFEB596D183E1241E8090D10EC9E7E5907FB4075C5E4746F7208B2CFB3E26D4D1AEDF4F52957E7C32E42EFB8FB697DE5E4090A07F66F84945E28D4E4FA884D5B832A48A9B685E39E0D4A149AE29E6B94845A7A4D197E7D96E0EBC6DA349B28B8B6"
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\TOSHIBA\Power Management\CeEPwrSvc.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\DVDRAMSV.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\RAMASST.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
c:\windows\system32\notepad.exe
.
**************************************************************************
.
Heure de fin: 2009-01-08 18:23:20 - La machine a redémarré [utilisateur]
ComboFix-quarantined-files.txt 2009-01-08 17:23:15

Avant-CF: 18,768,097,280 octets libres
AprÞs-CF: 18,584,137,728 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
463 --- E O F --- 2008-12-31 09:02:52

Répondre à eruo

Le fichier a été restauré.

Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
AIDE : Redémarrer en mode sans échec

Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
Afin de lancer la recherche, clic sur"Rechercher".
Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :

-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.

AIDE : Tuto en images sur MBAM

------------------------------ Prévention & Protection||Vous m'aimez ? Cliquez :o
Répondre à Angeldark

Malwarebytes antimalware n'a rien trouver, C'est bon ou je dois encore faire une analyse ?

Merci d'avance

Répondre à eruo

Re,

Tu as encore des soucis ?

------------------------------ Prévention & Protection||Vous m'aimez ? Cliquez :o
Répondre à Angeldark

Virus inconnus / Rapport hijackthis

Forum Sécurité - Virus : Virus inconnus / Rapport hijackthis

Attention