doudou27

Ah ba non ca a l air de fonctionner correctement/ ... Y a t il des choses a installer pour ne plus avoir ce genre de probleme...... En tout cas je te remercie vraiment pour le temps que tu m as consacré. Et je retiendrai la procedure au cas ou y ai d autre probleme...merci encore et bonne continuaion

------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, December 14, 2007 8:05:25 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 13/12/2007 Kaspersky Anti-Virus database records: 481736 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 65149 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 01:08:41 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.76.Crwl Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.76.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles010002.ci Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles010002.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles010002.wsb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles010012.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles010013.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy18.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf1.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf2.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_bc.dat Object is locked skipped C:\Documents and Settings\Doudou\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Desktop Search\Logs\OTFSMonLog.txt Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\dfsr.db Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\fsr.log Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\fsrtmp.log Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\tmp.edb Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Windows Live Contacts\damien_ruiz@hotmail.com\real\members.stg Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Historique\History.IE5\MSHist012007121320071214\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temp\~DF2E91.tmp Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temp\~DF2F6A.tmp Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temp\~DF3C46.tmp Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temporary Internet Files\Content.IE5\BQ6DR4IQ\set_awesome[1].xml Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temporary Internet Files\Content.IE5\PLHROBCP\swf_Camp_pdts_Word_t%C3%A9l%C3%A9chargez_728x90_02oct[1].swf Object is locked skipped C:\Documents and Settings\Doudou\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Doudou\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP225\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SDA026C86.tmp Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\bdss.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\tmp0000535f\tmp00000000 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed.

J ai suivi toute la procedure voici les rapports : RAPPORT AVG : --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 11:03:50 13/12/2007 + Résultat de l'analyse: C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023178.exe -> Adware.CommAd : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023179.dll -> Adware.CommAd : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\RG91ZG91\asappsrv.dll.vir -> Adware.CommAd : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\RG91ZG91\command.exe.vir -> Adware.CommAd : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023181.exe -> Adware.ZQuest : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\tk58.exe.vir -> Adware.ZQuest : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023168.exe -> Downloader.Agent.erf : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\b122.exe.vir -> Downloader.Agent.erf : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023166.exe -> Downloader.Agent.fuc : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023167.exe -> Downloader.Agent.fuc : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP220\A0023251.exe -> Downloader.Agent.fuc : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\17PHolmes572.exe.vir -> Downloader.Agent.fuc : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\mrofinu1000106.exe.vir -> Downloader.Agent.fuc : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\mrofinu572.exe.tmp.vir -> Downloader.Agent.fuc : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\mrofinu572.exe.vir -> Downloader.Agent.fuc : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP221\A0023473.exe -> Downloader.Small.buy : Nettoyé. D:\Telechargement\Cinema4D.rar/Cinema4D Architecture Edition\Cinema4D Architecture\keygen\mus3_c4dr10_archi-engin.exe -> Downloader.Small.eoi : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023169.dll -> Hijacker.StartPage : Nettoyé. C:\qoobox\Quarantine\C\Program Files\Services en ligne\qudasu.dll.vir -> Hijacker.StartPage : Nettoyé. C:\qoobox\Quarantine\C\Program Files\WindowsUpdate\mero4444.dll.vir -> Not-A-Virus.Adware.TTC : Nettoyé. C:\qoobox\Quarantine\C\Program Files\WindowsUpdate\mero83122.dll.vir -> Not-A-Virus.Adware.TTC : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@www.adtrak[2].txt -> TrackingCookie.Adtrak : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@adviva[1].txt -> TrackingCookie.Adviva : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@atdmt[1].txt -> TrackingCookie.Atdmt : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@estat[1].txt -> TrackingCookie.Estat : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@fastclick[1].txt -> TrackingCookie.Fastclick : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@ads.infinite-ads[2].txt -> TrackingCookie.Infinite-ads : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@banners.searchingbooth[1].txt -> TrackingCookie.Searchingbooth : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé. C:\Documents and Settings\Doudou\Cookies\doudou@zedo[1].txt -> TrackingCookie.Zedo : Nettoyé. C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023180.vbs -> Trojan.Small : Nettoyé. C:\qoobox\Quarantine\C\WINDOWS\RG91ZG91\l36Yt36Y.vbs.vir -> Trojan.Small : Nettoyé. Fin du rapport RAPPORT KAPERSKY : ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, December 13, 2007 2:20:35 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 13/12/2007 Kaspersky Anti-Virus database records: 481504 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 59992 Number of viruses found: 7 Number of infected objects: 25 Number of suspicious objects: 0 Duration of the scan process: 01:17:20 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.76.Crwl Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.76.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles01000D.ci Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles01000D.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles01000D.wsb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles010011.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy18.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf1.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf2.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_bc.dat Object is locked skipped C:\Documents and Settings\Doudou\Bureau\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Doudou\Bureau\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Doudou\Bureau\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Doudou\Bureau\SmitfraudFix.exe RarSFX: infected - 2 skipped C:\Documents and Settings\Doudou\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Desktop Search\Logs\OTFSMonLog.txt Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\dfsr.db Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\fsr.log Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\fsrtmp.log Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Messenger\damien_ruiz@hotmail.com\SharingMetadata\Working\database_E450_F35F_50F3_3740\tmp.edb Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Application Data\Microsoft\Windows Live Contacts\damien_ruiz@hotmail.com\real\members.stg Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Historique\History.IE5\MSHist012007121320071214\index.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temp\~DF2E91.tmp Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temp\~DF2F6A.tmp Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temp\~DF3C46.tmp Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Doudou\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Doudou\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Doudou\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\qoobox\Quarantine\C\Program Files\Services en ligne\rtemehdo.html.vir Infected: Trojan-Clicker.HTML.IFrame.dn skipped C:\qoobox\Quarantine\C\WINDOWS\system32\efccdca.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjr skipped C:\qoobox\Quarantine\C\WINDOWS\system32\embqahcn.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped C:\qoobox\Quarantine\C\WINDOWS\system32\gfuonogd.dll.vir Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped C:\qoobox\Quarantine\C\WINDOWS\system32\gyriynnm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\qoobox\Quarantine\C\WINDOWS\system32\hggedbb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjr skipped C:\qoobox\Quarantine\C\WINDOWS\system32\qomliih.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjr skipped C:\qoobox\Quarantine\C\WINDOWS\system32\qzysvjqj.dll.vir Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped C:\qoobox\Quarantine\C\WINDOWS\TTC-4444.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\qoobox\Quarantine\C\WINDOWS\TTC-4444.exe.vir NSIS: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023170.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjr skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023171.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023172.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023173.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023174.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjr skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023176.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjr skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023177.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023182.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP219\A0023182.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP221\A0023472.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP221\A0023472.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP221\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SDA026C86.tmp Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\bdss.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\tmp00003548\tmp00000000 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{0884834E-145D-4416-83DC-F23B1E528B1F}\RP221\change.log Object is locked skipped Scan process completed.

Merci je vais essayer de faire ca d ici demain car c est la journée des enfants et il faut aller au cinema. Peut etre ce soir... merci encore je tient au courant dès que j attaque la procedure

Raport combofix ComboFix 07-12-10.2 - Doudou 2007-12-11 18:21:10.5 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.979 [GMT 1:00] Running from: C:\Documents and Settings\Doudou\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Doudou\Bureau\CFScript.txt * Created a new restore point FILE C:\Program Files\WindowsUpdate\mero4444.dll C:\WINDOWS\17PHolmes572.exe C:\WINDOWS\mrofinu572.exe.tmp C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\yesmessenger.ini . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Doudou\Application Data\MenacesProtection C:\Documents and Settings\Doudou\Application Data\MenacesProtection\avtasks.dat C:\Documents and Settings\Doudou\Application Data\MenacesProtection\Logs\av.log C:\Documents and Settings\Doudou\Application Data\MenacesProtection\Logs\ga6Support.log C:\Program Files\Fichiers communs\MenacesProtection C:\Program Files\WindowsUpdate\mero4444.dll C:\WINDOWS\17PHolmes572.exe C:\WINDOWS\mrofinu572.exe.tmp C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\yesmessenger.ini . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-11 to 2007-12-11 )))))))))))))))))))))))))))))))))))) . 2007-12-11 13:23 . 2007-12-11 13:23 2,282 --a------ C:\WINDOWS\system32\tmp.reg 2007-12-11 13:22 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-11 13:22 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-11 13:22 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-11 13:22 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-11 13:22 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-11 13:13 . 2005-01-31 15:05 17,920 --a------ C:\WINDOWS\system32\wnaspi32.dll 2007-12-11 13:11 . 2007-12-11 13:13 <REP> d-------- C:\Program Files\ISOpen 2007-12-11 11:49 . 2007-12-11 11:49 <REP> d-------- C:\Program Files\CCleaner 2007-12-10 19:43 . 2007-12-11 14:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-10 06:52 . 2007-12-10 06:52 <REP> d-------- C:\Program Files\Trend Micro 2007-12-10 06:36 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-12-10 06:34 . 2007-12-10 06:34 <REP> d-------- C:\WINDOWS\system32\zec2 2007-12-10 06:34 . 2007-12-10 06:34 <REP> d-------- C:\WINDOWS\system32\lab3 2007-12-10 06:34 . 2007-12-10 06:34 <REP> d-------- C:\WINDOWS\system32\daSgo01 2007-12-10 06:34 . 2007-12-11 14:37 <REP> d-------- C:\Temp 2007-12-02 19:18 . 2007-12-02 19:18 <REP> d-------- C:\Program Files\MAXON 2007-11-29 15:53 . 2007-11-29 15:53 <REP> d-------- C:\TempDVD 2007-11-29 15:53 . 2007-11-29 15:56 <REP> d-------- C:\Program Files\dvdSanta 2007-11-15 09:55 . 2007-08-20 10:59 6,058,496 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-11-15 09:55 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2007-11-15 09:55 . 2007-03-08 06:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2007-11-15 09:55 . 2007-08-20 10:59 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-11-15 09:55 . 2007-08-20 10:59 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-11-15 09:55 . 2007-08-20 10:59 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-11-15 09:55 . 2007-08-20 10:59 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2007-11-15 09:55 . 2007-08-20 10:59 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-11-15 09:55 . 2007-08-17 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-11 16:58 --------- d-----w C:\Documents and Settings\Doudou\Application Data\uTorrent 2007-12-11 13:37 --------- d-----w C:\Program Files\Services en ligne 2007-11-30 15:35 --------- d-----w C:\Program Files\eMule 2007-11-28 02:00 --------- d-----w C:\Program Files\Windows Live 2007-11-16 16:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink 2007-11-14 02:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-11-09 19:31 --------- d-----w C:\Program Files\SlySoft 2007-11-09 19:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft 2007-11-06 15:34 --------- d-----w C:\Program Files\DVD Shrink 2007-11-05 12:18 --------- d-----w C:\Program Files\Azureus 2007-11-05 12:11 --------- d-----w C:\Program Files\uTorrent 2007-11-05 12:07 --------- d-----w C:\Documents and Settings\Doudou\Application Data\Azureus 2007-11-05 11:43 --------- d-----w C:\Program Files\BitTorrent 2007-11-02 11:21 --------- d-----w C:\Documents and Settings\Doudou\Application Data\BitTorrent 2007-10-29 11:44 --------- d-----w C:\Documents and Settings\Doudou\Application Data\DivX 2007-10-28 17:16 96,832 ----a-w C:\WINDOWS\system32\drivers\AnyDVD.sys 2007-10-16 10:03 --------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-10-16 10:02 --------- d-----w C:\Program Files\DivX . ((((((((((((((((((((((((((((( snapshot@2007-12-11_14.44.07.56 ))))))))))))))))))))))))))))))))))))))))) . - 2007-12-11 13:37:49 81,984 ----a-w C:\WINDOWS\system32\bdod.bin + 2007-12-11 17:23:26 81,984 ----a-w C:\WINDOWS\system32\bdod.bin . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-30 09:26] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2007-11-05 13:05] "ChristmasTree"="C:\Program Files\ChristmasTree\ChristmasTree.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="RunDll32 cmicnfg.cpl" [] "PRISMSTA.EXE"="PRISMSTA.exe" [2003-08-04 14:54 C:\WINDOWS\system32\PRISMSTA.exe] "BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 15:48] "BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 14:49] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=sockspy.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD] 2007-10-28 18:51 1600448 --a------ C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] C:\Program Files\BitTorrent\bittorrent.exe --force_start_minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2007-11-05 13:05 219952 --a------ C:\Program Files\uTorrent\uTorrent.exe R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys R3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\system32\DRIVERS\ctxs51.sys R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys S3 PRISM_A00;PRISM 802.11g Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-11 18:25:24 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-11 18:27:28 - machine was rebooted C:\ComboFix2.txt ... 2007-12-11 14:44 . --- E O F --- 2007-11-28 02:00:54 nouveau rapport Hitajick Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:30:01, on 11/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\PRISMSTA.EXE C:\Program Files\Softwin\BitDefender10\bdmcon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [ChristmasTree] C:\Program Files\ChristmasTree\ChristmasTree.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe -- End of file - 6311 bytes

rapport combofix ComboFix 07-12-10.2 - Doudou 2007-12-11 14:41:44.4 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1087 [GMT 1:00] Running from: C:\Documents and Settings\Doudou\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Documents and Settings\All Users\Application Data.\salesmonitor C:\Program Files\mcroso~1 C:\Program Files\Services en ligne\qudasu.dll C:\Program Files\Services en ligne\rtemehdo.html C:\Program Files\WindowsUpdate\mero83122.dll C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\bkR11 C:\Temp\bkR11\ftCa.log C:\WINDOWS\b122.exe C:\WINDOWS\mrofinu1000106.exe C:\WINDOWS\mrofinu572.exe C:\WINDOWS\RG91ZG91\ C:\WINDOWS\RG91ZG91\\asappsrv.dll C:\WINDOWS\RG91ZG91\\command.exe C:\WINDOWS\RG91ZG91\\l36Yt36Y.vbs C:\WINDOWS\RG91ZG91\command.exe C:\WINDOWS\sks~1 C:\WINDOWS\system32\atmtd.dll C:\WINDOWS\system32\atmtd.dll._ C:\WINDOWS\system32\efccdca.dll C:\WINDOWS\system32\embqahcn.dll C:\WINDOWS\system32\gfuonogd.dll C:\WINDOWS\system32\gjjlm.ini C:\WINDOWS\system32\gjjlm.ini2 C:\WINDOWS\system32\gyriynnm.dll C:\WINDOWS\system32\hggedbb.dll C:\WINDOWS\system32\mljjg.dll C:\WINDOWS\system32\mnnyiryg.ini C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\qomliih.dll C:\WINDOWS\system32\qzysvjqj.dll C:\WINDOWS\system32\qzysvjqj.dllbox C:\WINDOWS\tk58.exe C:\WINDOWS\TTC-4444.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_NETWORK_MONITOR -------\cmdService ((((((((((((((((((((((((((((( Fichiers créés 2007-11-11 to 2007-12-11 )))))))))))))))))))))))))))))))))))) . 2007-12-11 13:23 . 2007-12-11 13:23 2,282 --a------ C:\WINDOWS\system32\tmp.reg 2007-12-11 13:22 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-12-11 13:22 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-12-11 13:22 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-12-11 13:22 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-12-11 13:22 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-12-11 13:13 . 2005-01-31 15:05 17,920 --a------ C:\WINDOWS\system32\wnaspi32.dll 2007-12-11 13:11 . 2007-12-11 13:13 <REP> d-------- C:\Program Files\ISOpen 2007-12-11 11:49 . 2007-12-11 11:49 <REP> d-------- C:\Program Files\CCleaner 2007-12-10 19:43 . 2007-12-11 14:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-10 19:36 . 2007-12-10 20:56 143 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-12-10 06:52 . 2007-12-10 06:52 <REP> d-------- C:\Program Files\Trend Micro 2007-12-10 06:38 . 2007-12-10 06:38 35,840 --a------ C:\WINDOWS\17PHolmes572.exe 2007-12-10 06:37 . 2007-12-10 06:37 <REP> d-------- C:\Documents and Settings\Doudou\Application Data\MenacesProtection 2007-12-10 06:36 . 2007-12-10 06:45 <REP> d-------- C:\Program Files\Fichiers communs\MenacesProtection 2007-12-10 06:36 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-12-10 06:34 . 2007-12-10 06:34 <REP> d-------- C:\WINDOWS\system32\zec2 2007-12-10 06:34 . 2007-12-10 06:34 <REP> d-------- C:\WINDOWS\system32\lab3 2007-12-10 06:34 . 2007-12-10 06:34 <REP> d-------- C:\WINDOWS\system32\daSgo01 2007-12-10 06:34 . 2007-12-11 14:37 <REP> d-------- C:\Temp 2007-12-10 06:34 . 2007-12-10 06:34 35,840 --a------ C:\WINDOWS\mrofinu572.exe.tmp 2007-12-04 20:56 . 2007-12-04 20:56 65 --a------ C:\WINDOWS\yesmessenger.ini 2007-12-02 19:18 . 2007-12-02 19:18 <REP> d-------- C:\Program Files\MAXON 2007-11-29 15:53 . 2007-11-29 15:53 <REP> d-------- C:\TempDVD 2007-11-29 15:53 . 2007-11-29 15:56 <REP> d-------- C:\Program Files\dvdSanta 2007-11-15 09:55 . 2007-08-20 10:59 6,058,496 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-11-15 09:55 . 2007-04-17 10:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2007-11-15 09:55 . 2007-03-08 06:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2007-11-15 09:55 . 2007-08-20 10:59 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-11-15 09:55 . 2007-08-20 10:59 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-11-15 09:55 . 2007-08-20 10:59 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-11-15 09:55 . 2007-08-20 10:59 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2007-11-15 09:55 . 2007-08-20 10:59 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-11-15 09:55 . 2007-08-17 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-11 13:40 --------- d-----w C:\Documents and Settings\Doudou\Application Data\uTorrent 2007-12-11 13:37 81,984 ----a-w C:\WINDOWS\system32\bdod.bin 2007-12-11 13:37 --------- d-----w C:\Program Files\Services en ligne 2007-11-30 15:35 --------- d-----w C:\Program Files\eMule 2007-11-28 02:00 --------- d-----w C:\Program Files\Windows Live 2007-11-16 16:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink 2007-11-14 02:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-11-09 19:31 --------- d-----w C:\Program Files\SlySoft 2007-11-09 19:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft 2007-11-06 15:34 --------- d-----w C:\Program Files\DVD Shrink 2007-11-05 12:18 --------- d-----w C:\Program Files\Azureus 2007-11-05 12:11 --------- d-----w C:\Program Files\uTorrent 2007-11-05 12:07 --------- d-----w C:\Documents and Settings\Doudou\Application Data\Azureus 2007-11-05 11:43 --------- d-----w C:\Program Files\BitTorrent 2007-11-02 11:21 --------- d-----w C:\Documents and Settings\Doudou\Application Data\BitTorrent 2007-10-29 11:44 --------- d-----w C:\Documents and Settings\Doudou\Application Data\DivX 2007-10-28 17:16 96,832 ----a-w C:\WINDOWS\system32\drivers\AnyDVD.sys 2007-10-16 10:03 --------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-10-16 10:02 --------- d-----w C:\Program Files\DivX 2007-09-11 23:14 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0AE5D205-F5F7-475B-BC6D-C843A62AB8A5}] 2007-08-02 14:43 282624 --a------ C:\Program Files\WindowsUpdate\mero4444.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-30 09:26] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2007-11-05 13:05] "ChristmasTree"="C:\Program Files\ChristmasTree\ChristmasTree.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="RunDll32 cmicnfg.cpl" [] "PRISMSTA.EXE"="PRISMSTA.exe" [2003-08-04 14:54 C:\WINDOWS\system32\PRISMSTA.exe] "BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 15:48] "BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 14:49] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 14:40:46] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=sockspy.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD] 2007-10-28 18:51 1600448 --a------ C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] C:\Program Files\BitTorrent\bittorrent.exe --force_start_minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2007-11-05 13:05 219952 --a------ C:\Program Files\uTorrent\uTorrent.exe R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys R3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\system32\DRIVERS\ctxs51.sys R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys S3 PRISM_A00;PRISM 802.11g Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-11 14:43:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-11 14:44:41 . --- E O F --- 2007-11-28 02:00:54

Rappoçrt Vundo VundoFix V6.7.0 Checking Java version... Scan started at 13:31:05 2007-12-11 Listing files found while scanning.... C:\windows\system32\gfuonogd.dll C:\windows\system32\gjjlm.ini C:\windows\system32\gjjlm.ini2 C:\windows\system32\mljjg.dll C:\WINDOWS\system32\qzysvjqj.dll C:\windows\system32\qzysvjqj.dllbox Beginning removal... Attempting to delete C:\windows\system32\gfuonogd.dll C:\windows\system32\gfuonogd.dll Could not be deleted. Attempting to delete C:\windows\system32\gjjlm.ini C:\windows\system32\gjjlm.ini Could not be deleted. Attempting to delete C:\windows\system32\gjjlm.ini2 C:\windows\system32\gjjlm.ini2 Could not be deleted. Attempting to delete C:\windows\system32\mljjg.dll C:\windows\system32\mljjg.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\qzysvjqj.dll C:\WINDOWS\system32\qzysvjqj.dll Could not be deleted. Attempting to delete C:\windows\system32\qzysvjqj.dllbox C:\windows\system32\qzysvjqj.dllbox Could not be deleted. Performing Repairs to the registry. Done!

Ah ok pas de probleme.... L aalyse vundo est en cours je l a poste dès que c est fini

Merci pour ce repônse si rapide. vola le premier rapport :SmitfraudFix SmitFraudFix v2.261 Rapport fait à 13:23:21.57, 2007-12-11 Executé à partir de C:\Documents and Settings\Doudou\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est NTFS Fix executé en mode normal »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RG91ZG91\command.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\PRISMSTA.EXE C:\Program Files\Softwin\BitDefender10\bdmcon.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\ISOpen\ISOpen.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\System32\wbem\wmiprvse.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Doudou »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Doudou\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Doudou\Favoris »»»»»»»»»»»»»»»»»»»»»»»» Bureau »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components] "Source"="C:\\Program Files\\Services en ligne\\rtemehdo.html" "SubscribedURL"="" "FriendlyName"="" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="sockspy.dll" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: VIA VT6105 Rhine III Fast Ethernet Adapter #2 - Miniport d'ordonnancement de paquets DNS Server Search Order: 192.168.30.1 DNS Server Search Order: 0.0.0.0 Description: VIA VT6105 Rhine III Fast Ethernet Adapter #2 - Miniport d'ordonnancement de paquets DNS Server Search Order: 192.168.30.1 DNS Server Search Order: 0.0.0.0 HKLM\SYSTEM\CCS\Services\Tcpip\..\{3036EE09-0B1F-4C26-A68A-7A9A396D94A2}: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CCS\Services\Tcpip\..\{77C97F36-7D42-4DC1-8092-DAEF76A38781}: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CS1\Services\Tcpip\..\{3036EE09-0B1F-4C26-A68A-7A9A396D94A2}: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CS1\Services\Tcpip\..\{77C97F36-7D42-4DC1-8092-DAEF76A38781}: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CS3\Services\Tcpip\..\{3036EE09-0B1F-4C26-A68A-7A9A396D94A2}: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CS3\Services\Tcpip\..\{77C97F36-7D42-4DC1-8092-DAEF76A38781}: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.30.1 0.0.0.0 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.30.1 0.0.0.0 »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll »»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonjour a tous et a toutes. Depuis hier j ai de gros souci avec mon pc. Il marche carrement au ralenti. A chaque demarrage il me modifie tous. Pages d accueil internet, options du bureau, ja i meme des ombre bleu sur les element du bureau ( horrible) . Donc j essaye des truc au fur e a mesur mais je galere . J arrive pas trop a m en sortir. Si quelqu un aurait le temps de m aider. J ai lu au fur et a mesure des forums que beaucoups m etait un rapport . Donc j ai suivi la procedure et je vous le donne de suite ( meme si je comprend pa strop a quoi sa sert) . merci a tous ceux qui m aiderons Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:32, on 2007-12-11 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RG91ZG91\command.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\PRISMSTA.EXE C:\Program Files\Softwin\BitDefender10\bdmcon.exe C:\Program Files\Softwin\BitDefender10\bdagent.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\WINDOWS\System32\alg.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\explorer.exe C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\qzysvjqj.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [50f337ef] rundll32.exe "C:\WINDOWS\system32\gyriynnm.dll",b O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RG91ZG91\command.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe O24 - Desktop Component 0: (no name) - C:\Program Files\Services en ligne\rtemehdo.html -- End of file - 6712 bytes