A l'aide !!!! Pouvez-vous jeter un oeil sur des scans Ewido et Hijackthis ?

Bonsoir,

Pardon d'insister mais ma bécane rame ce qui m'agace franchement. Je ne parviens pas à me débarrasser d'un dossier irsvs contenant, entre autres, edmond.exe et desktop search qui sont, je suppose, à l'origine de mes problèmes. J'ai l'impression que l'une des actions visibles de cette gentille saleté est de bloquer la quasi intégralité du traffic internet. L'un d'entre vous sait-il comment se débarrasser de cette cochonnerie ? Ci-joint les scans d'Ewido et de Hijackthis.

---------------------------------------------------------
ewido security suite - Rapport de démarrage
---------------------------------------------------------

+ Créé le: 16:55:02, 18/05/2005
+ Somme de contrôle: 432E0405

Reg\HKLM\Run Desktop Search C:\WINDOWS\isrvs\desktop.exe
Reg\HKLM\Run EM_EXEC C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
Reg\HKLM\Run ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
Reg\HKLM\Run LVCOMS C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
Reg\HKLM\Run QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
Reg\HKLM\Run BDMCon C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
Reg\HKLM\Run BDNewsAgent C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
Reg\HKLM\Run BDOESRV C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
Reg\HKLM\Run BDSwitchAgent C:\Program Files\Softwin\BitDefender8\\bdswitch.exe
Reg\HKLM\Run ffis C:\WINDOWS\isrvs\ffisearch.exe
Reg\HKLM\Run NeroFilterCheck C:\WINDOWS\system32\NeroCheck.exe
Reg\HKLM\Run {0228e555-4f9c-4e35-a3ec-b109a192b4c2} C:\Program Files\Google\Gmail Notifier\gnotify.exe
Reg\HKCU\Run Update Service C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe /startup
Shell\CommonStartup Lancement rapide d'Adobe Reader.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
Shell\CommonStartup Microsoft Office.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk

---------------------------------------------------------
ewido security suite - Rapport de connection
---------------------------------------------------------

+ Créé le: 16:55:10, 18/05/2005
+ Somme de contrôle: 650361A0

TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:10110 0.0.0.0:0 LISTENING
TCP 82.230.88.252:139 0.0.0.0:0 LISTENING
TCP 82.230.88.252:1124 212.112.236.135:80 ESTABLISHED
TCP 82.230.88.252:1248 83.145.66.226:443 TIME_WAIT
TCP 82.230.88.252:1249 83.145.66.226:443 ESTABLISHED
TCP 82.230.88.252:1434 83.145.66.226:443 ESTABLISHED
TCP 82.230.88.252:1439 64.233.183.106:80 ESTABLISHED
TCP 127.0.0.1:1034 0.0.0.0:0 LISTENING
UDP 0.0.0.0:445
UDP 0.0.0.0:500
UDP 0.0.0.0:1026
UDP 0.0.0.0:4500
UDP 82.230.88.252:123
UDP 82.230.88.252:137
UDP 82.230.88.252:138
UDP 82.230.88.252:1900
UDP 127.0.0.1:123
UDP 127.0.0.1:1025
UDP 127.0.0.1:1042
UDP 127.0.0.1:1045
UDP 127.0.0.1:1900

---------------------------------------------------------
ewido security suite - Rapport des processus
---------------------------------------------------------

+ Créé le: 16:55:18, 18/05/2005
+ Somme de contrôle: B4617A0E

0: System Process
4: System Process
172: C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
220: C:\WINDOWS\System32\wdfmgr.exe
280: C:\WINDOWS\Explorer.EXE
444: C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
452: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
460: C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
484: C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
492: C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
516: C:\Program Files\Softwin\BitDefender8\bdswitch.exe
560: C:\Program Files\Google\Gmail Notifier\gnotify.exe
724: \SystemRoot\System32\smss.exe
772: \??\C:\WINDOWS\system32\csrss.exe
796: \??\C:\WINDOWS\system32\winlogon.exe
840: C:\WINDOWS\system32\services.exe
852: C:\WINDOWS\system32\lsass.exe
872: C:\Program Files\ewido\security suite\ewidoctrl.exe
976: C:\WINDOWS\system32\taskmgr.exe
1028: C:\WINDOWS\system32\svchost.exe
1040: C:\Program Files\Softwin\BitDefender8\vsserv.exe
1092: C:\WINDOWS\system32\svchost.exe
1100: C:\WINDOWS\system32\devldr32.exe
1152: C:\Program Files\ewido\security suite\ewidoguard.exe
1240: C:\WINDOWS\System32\svchost.exe
1300: C:\WINDOWS\System32\svchost.exe
1408: C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
1428: C:\WINDOWS\System32\svchost.exe
1464: C:\WINDOWS\system32\slserv.exe
1780: C:\WINDOWS\system32\spoolsv.exe
2032: C:\WINDOWS\System32\svchost.exe
2100: C:\WINDOWS\System32\alg.exe
2756: C:\Program Files\Internet Explorer\iexplore.exe
2824: C:\Program Files\ewido\security suite\SecuritySuite.exe
2948: C:\Program Files\Internet Explorer\iexplore.exe
4048: C:\WINDOWS\system32\NOTEPAD.EXE

Logfile of HijackThis v1.99.1
Scan saved at 16:56:35, on 18/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdswitch.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender8\vsserv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido\security suite\SecuritySuite.exe
C:\Documents and Settings\Menoni\Mes documents\Point exe's\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00000049-8F91-4D9C-9573-F016E7626484} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe /startup
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: sasrfc Service (sasrfcService) - Unknown owner - C:\Program Files\SAS Institute\SAS\V8\access\sasexe\sasrfc.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Lut

ICI