meufree

Bonjour, Après avoir fait de nombreuse recherches et aussi plusieurs tentative en vain pour nettoyer mon PC je compte maintenant sur votre expertise pour enfin y parvenir. A chaque démarrage, une fenêtre d'erreur EXPLORER.EXE s'affiche. le rapport: AppName : explorer.exe AppVer : 6.0.2900.5512 ModName: unknown ModVer: 0.0.0.0 Offset: 00000000 (petite precision, la version d'internet explorer installée sur mon system est la 7.0.5730.13 ) Lorsque je ferme cette fenêtre d'erreur, AVAST me signale un virus. Rapport : Nom du fichier : C:\windows\Hide.dll Nom du logiciel malveillant : Win32:Trojan-gen {Other} Type : Virus/ver Version VPS: 081215-1,15/12/2008 Là, Avast est incapable de déplacer, renommer, supprimer, réparer ou mettre en quarantaine. Cette fameuse dll Hide.dll peut être supprimée manuellement mais réapparait à chaque démarrage. En outre, mon PC fonctionne correctement. Mais ce Trojan ne ma dit rien de bon. J'ai testé plusieurs antivirus, en ligne, hors ligne, en mode sans echec ou non... Merci d'avance pour votre aide. Cordialement. Voici le rapport SDFIX : SDFix: Version 1.240 /b Run by Administrateur on 15/12/2008 at 16:42 Microsoft Windows XP [version 5.1.2600] Running From: C:\SDFix Checking Services /b: Restoring Default Security Values Restoring Default Hosts File Rebooting Checking Files /b: Trojan Files Found: C:\WINDOWS\system32\s.ico - Deleted Removing Temp Files ADS Check /b: C:\WINDOWS\system32 :unknown.exe 1981450 Total size: 1981450 bytes. system32: Accès refusé. Checking for remaining Streams C:\WINDOWS\system32 :unknown.exe 1981450 Total size: 1981450 bytes. Final Check /b: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 17:28:11 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... C:\WINDOWS\system32:unknown.exe 1981450 bytes executable scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 1 Remaining Services /b: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\CNAC1RPK.EXE"="C:\\WINDOWS\\system32\\CNAC1RPK.EXE:*:Enabled:Canon LASER SHOT LBP-2410 RPC Server Process" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" "C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-VGA.exe"="C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-VGA.exe:*:Enabled:Menu" "C:\\Program Files\\GigaByte\\VGA Utility Manager\\gvupdate.exe"="C:\\Program Files\\GigaByte\\VGA Utility Manager\\gvupdate.exe:*:Enabled:gvupdate" "C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP000.TMP\\SOUND_~1.EXE"="C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP000.TMP\\SOUND_~1.EXE:*:Enabled:Windows Application Service" "C:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"="C:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4" "C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP001.TMP\\SOUND_~1.EXE"="C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP001.TMP\\SOUND_~1.EXE:*:Enabled:Windows Application Service" "C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP002.TMP\\SOUND_~1.EXE"="C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP002.TMP\\SOUND_~1.EXE:*:Enabled:Windows Application Service" "C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP003.TMP\\SOUND_~1.EXE"="C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\IXP003.TMP\\SOUND_~1.EXE:*:Enabled:Windows Application Service" "C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\QZTEMP\\15102234\\Adobe Photoshop cs4 keygen.exe"="C:\\DOCUME~1\\GERARD\\LOCALS~1\\Temp\\QZTEMP\\15102234\\Adobe Photoshop cs4 keygen.exe:*:Enabled:Microsoft Windows Update Platform" "D:\\TELECHARGEMENTS\\COREL\\Adobe Photoshop cs4 keygen.exe"="D:\\TELECHARGEMENTS\\COREL\\Adobe Photoshop cs4 keygen.exe:*:Enabled:Microsoft Windows Update Platform" "C:\\Documents and Settings\\GERARD\\Application Data\\Adobe\\Adobe Photoshop CS4\\Adobe Photoshop cs4 keygen.exe"="C:\\Documents and Settings\\GERARD\\Application Data\\Adobe\\Adobe Photoshop CS4\\Adobe Photoshop cs4 keygen.exe:*:Enabled:Microsoft Windows Update Platform" "C:\\Program Files\\Adobe\\Adobe Photoshop CS4\\Adobe Photoshop cs4 keygen.exe"="C:\\Program Files\\Adobe\\Adobe Photoshop CS4\\Adobe Photoshop cs4 keygen.exe:*:Enabled:Microsoft Windows Update Platform" "C:\\WINDOWS\\system32:unknown.exe"="C:\\WINDOWS\\system32:unknown.exe:*:Enabled:Microsoft Windows Update Platform" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files /b: File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes /b: Fri 9 Sep 2005 7,680 A.SHR --- "C:\WINDOWS\Hide.dll" Sun 18 Jun 2006 101,888 A.SHR --- "C:\WINDOWS\Thumb.dll" Mon 14 Apr 2008 1,695,232 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Mon 14 Apr 2008 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll" Thu 14 Aug 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Wed 30 Jul 2008 4,891,984 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll" Fri 14 Nov 2008 88 ..SHR --- "C:\Documents and Settings\All Users\Application Data\2C250CB75F.sys" Thu 11 Dec 2008 3,140 A.SH. --- "C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys" Tue 13 Nov 2007 57,344 ...H. --- "C:\Documents and Settings\GERARD\Application Data\Microsoft\Word\~WRL0004.tmp" Fri 2 May 2008 3,493,888 A..H. --- "C:\Documents and Settings\GERARD\Application Data\U3\temp\Launchpad Removal.exe" Finished!/b Voici le rapport Hijack This : Logfile of HijackThis v1.99.1 Scan saved at 18:44:44, on 15/12/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Fichiers communs\Portrait Displays\Shared\dtsrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe c:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\CNAC1RPK.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe C:\WINDOWS\HPLiteSaver.exe C:\WINDOWS\system32\SearchIndexer.exe C:\PROGRA~1\MICROS~4\rapimgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Adobe\Adobe Photoshop CS4\Photoshop.exe C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\LVComsX.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\hijackthis\HijackThis.exe O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\FR\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=123008 serial=DR12WRS-8796594-FHE lang=FR O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ? O4 - Global Startup: HP Display LiteSaver Startup.lnk = C:\WINDOWS\HPLiteSaver.exe O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir au format PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS4 - Unknown owner - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" -win32service (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Fichiers communs\Portrait Displays\Shared\dtsrvc.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Fichiers communs\Portrait Displays\Drivers\pdisrvc.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Configuration: Windows XP familiale SP3 Firefox 3.0.3 IE 7 core duo 6420