[RESOLU] pc infecté

bitou · le 26 juillet 2006

Salut a tous,

Voici l’analyse HijackThis mon pc est infecté, mais je n’arrive pas a enlever c’est petite ****** lol

Logfile of HijackThis v1.99.1

Scan saved at 15:37:27, on 26/07/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ishost.exe

C:\WINDOWS\system32\isnotify.exe

C:\WINDOWS\system32\ismon.exe

C:\WINDOWS\system32\issearch.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\MSI\BToes Logiciel Bluetooth\BTTray.exe

C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\Raxco\PerfectDisk\PDSched.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\nicolas\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt0.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie_ctx.htm

O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1153554727562

O17 - HKLM\System\CCS\Services\Tcpip\..\{9FB36FB6-891E-4208-9E09-8B7B98ACFB48}: NameServer = 212.27.32.176,212.27.32.177

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSN Messenger\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: firewall\wl_hook.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: winjgf32 - C:\WINDOWS\SYSTEM32\winjgf32.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe

O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Donc j’ai passé un coup de spybot, nod32, adawar, easycleaner en mode normal puis la même chose en mode sans échec.

Et c’est toujours la même chose.

Si vous avez une petite idée …… :-P

Merci d’avance :-(

Modifié le 27 juillet 2006 par bitou

Malekal_morte · le 26 juillet 2006

Bonjour,

-- Télécharge SmitfraudFix

-- Fais un clic droit puis Extraire tout sur le fichier SmitfraudFix.zip, cela va tout décompresser dans un nouveau dossier SmitFraudfix

-- Ouvre le dossier SmitfraudFix double clic sur SmitfraudFix.cmd (ne

clique sur aucun autre fichier!!!)

-- Choisis l'option 1 et appuie sur Entrée

-- Réponds o (Oui) aux deux questions suivantes si elles sont posées

-- Un rapport sera généré sauvegarde le dans un dossier

-- Copie/colle le contenu du rapport ici

bitou · le 26 juillet 2006

heu voila

SmitFraudFix v2.75b

Rapport fait à 16:25:03,15, 26/07/2006

Executé à partir de C:\Documents and Settings\nicolas\Bureau\SmitfraudFix

OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT

Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ishost.exe PRESENT !

C:\WINDOWS\system32\ismon.exe PRESENT !

C:\WINDOWS\system32\isnotify.exe PRESENT !

C:\WINDOWS\system32\issearch.exe PRESENT !

C:\WINDOWS\system32\ixt?.dll PRESENT !

C:\WINDOWS\system32\ixt??.dll PRESENT !

C:\WINDOWS\system32\ot.ico PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\nicolas\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\nicolas\Favoris

C:\DOCUME~1\nicolas\Favoris\Antivirus Test Online.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

"Source"="About:Home"

"SubscribedURL"="About:Home"

"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

merci de ton aide

Modifié le 26 juillet 2006 par bitou

Malekal_morte · le 26 juillet 2006

Voici la manipulation à effectuer en entier

Si certains éléments ne sont pas trouvés, merci de le signaler mais de poursuivre les manipulations jusqu'au bout.

Sur HijackThis, refais un scan et coches les lignes suivantes :

O20 - AppInit_DLLs: firewall\wl_hook.dll

O20 - Winlogon Notify: winjgf32 - C:\WINDOWS\SYSTEM32\winjgf32.dll

---> puis clic sur le bouton "Fix Checked"

n'hésite pas à consulter l'aide HijackThis

- Télécharge et installe ewido

- Mets le à jour à partir du menu update en haut, n'hésite pas à consulter l'Aide ewido pour tout problème.

- Télécharge clean.zip, décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.

-- Redémarre en mode en mode sans échec, si tu sais pas comment on fait lis ceci

-- Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laisse la ouverte.

-- Ouvre le dossier SmitfraudFix double clic sur SmitfraudFix.cmd (ne

clique sur aucun autre fichier!!!)

-- Choisis l'option 2 et appuie sur Entrée

-- Réponds o (Oui) aux deux questions suivantes si elles sont posées

-- Un rapport sera généré sauvegarde le dans un dossier,

- Ouvre ewido et clic sur l'onglet Scanner en haut

- Démarre ewido et clique "Complete System Scan"

** Si un fichier est infecté, choisis l'option " Apply All Actions " en fin d'analyse **

Clique sur " Save Report " puis sur " Save Report As "

Enregistre ce fichier texte sur ton bureau.

N'hésite pas à consulter l'Aide ewido pour tout problème.

-- Redémarre en mode normal : Menu Démarrer / Arreter / Redémarre l'ordinateur

Attention : dans le cas où l'ordinateur redémarre en boucle en mode sans échec, faire la manipulation inverse en décochant l'option /SAFEBOOT à l'aide de msconfig : voir à nouveau cette page : cliquez-ici

-- Fais un scan en ligne avec Internet Explorer : Scan Kaspersky et colle le rapport ici. Si tu es perdu, tu peux suivre cette aide pour les scans en ligne

-- Copie/Colle ici les rapports :

- ewido

- le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt

- ainsi qu'un nouveau log HijackThis

bitou · le 27 juillet 2006

Re Malekal_morte

donc j'ai tous fait se que tu ma demandé,

je vais donc te donner tous les rapports.

donc voila deja ; SmitFraudFix

Rapport fait à 14:30:46,20, 27/07/2006

Executé à partir de C:\Documents and Settings\nicolas\Bureau\SmitfraudFix

OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT

Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\nicolas\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\nicolas\Favoris

C:\DOCUME~1\nicolas\Favoris\Antivirus Test Online.url PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

"Source"="About:Home"

"SubscribedURL"="About:Home"

"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

après celui de : ewido anti-spyware[/i]

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 14:47:45 27/07/2006

+ Scan result:

:mozilla.94:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.

:mozilla.95:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.

:mozilla.96:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.97:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.98:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.100:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.

:mozilla.101:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.

:mozilla.78:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.79:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.65:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.

:mozilla.238:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Belstat : Cleaned.

:mozilla.239:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Belstat : Cleaned.

:mozilla.23:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.

:mozilla.112:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Com : Cleaned.

:mozilla.220:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.

:mozilla.221:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.

:mozilla.222:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.

:mozilla.72:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.

:mozilla.42:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Estat : Cleaned.

:mozilla.89:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.

:mozilla.90:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.

:mozilla.91:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.

:mozilla.92:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.

:mozilla.93:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.

:mozilla.127:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned.

:mozilla.228:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.

:mozilla.229:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.

:mozilla.62:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.

:mozilla.64:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.

:mozilla.169:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.263:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.264:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.265:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.170:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.

:mozilla.66:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.67:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.68:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.69:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.71:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.73:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.74:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.75:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.76:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.77:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.

:mozilla.35:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.36:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.

:mozilla.175:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.

:mozilla.25:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.

:mozilla.26:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.

:mozilla.27:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.

:mozilla.187:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.

:mozilla.188:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.

:mozilla.197:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.198:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.199:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.192:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

:mozilla.193:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

:mozilla.194:C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

C:\Program Files\Steam\SteamApps\nicolas695\counter-strike\MVA_Cheat.exe -> Trojan.Mygot : Cleaned with backup (quarantined).

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\\kernel32.dll -> Trojan.Small : Cleaned with backup (quarantined).

::Report end

celui de clean

Script clean par Malekal_morte - http://www.malekal.com

*** SUPPRESSION DES FICHIERS

*** Suppressions de trojans/vers sur...

C:\WINDOWS\system32\bdod.bin FOUND

C:\WINDOWS\system32\ot.ico FOUND

C:\WINDOWS\system32\pxhpinst.exe FOUND

*** Suppressions des adware connus...

ensuite le rapport : KASPERSKY ONLINE SCANNER

Thursday, July 27, 2006 3:40:48 PM

Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 27/07/2006

Kaspersky Anti-Virus database records: 197755

Scan Settings

Scan using the following antivirus database standard

Scan Archives true

Scan Mail Bases true

Scan Target Folders

C:\

Scan Statistics

Total number of scanned objects 32266

Number of viruses found 0

Number of infected objects 0 / 0

Number of suspicious objects 0

Duration of the scan process 00:22:37

Infected Object Name Virus Name Last Action

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\cert8.db Object is locked skipped

C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\formhistory.dat Object is locked skipped

C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\history.dat Object is locked skipped

C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\key3.db Object is locked skipped

C:\Documents and Settings\nicolas\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\parent.lock Object is locked skipped

C:\Documents and Settings\nicolas\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Application Data\Mozilla\Firefox\Profiles\vn6rl8ir.default\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\nicolas\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\nicolas\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\nicolas\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Fichiers communs\Softwin\BitDefender Firewall\bdfirewall.txt Object is locked skipped

C:\Program Files\Softwin\BitDefender9\asdict.dat Object is locked skipped

C:\Program Files\Softwin\BitDefender9\aspdict.dat Object is locked skipped

C:\Program Files\Softwin\BitDefender9\Quarantine\winjgf32.dll Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptd6573.sys Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\tmp000038ef\tmp00000000 Object is locked skipped

Scan process completed.

et pour finir celui de HijackThis :

Logfile of HijackThis v1.99.1

Scan saved at 15:43:12, on 27/07/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Softwin\BitDefender9\bdoesrv.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Softwin\BitDefender9\bdnagent.exe

C:\Program Files\Softwin\BitDefender9\bdswitch.exe

C:\Program Files\MSI\BToes Logiciel Bluetooth\BTTray.exe

C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Raxco\PerfectDisk\PDSched.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

c:\program files\softwin\bitdefender9\bdmcon.exe

C:\Program Files\Softwin\BitDefender9\vsserv.exe

C:\Documents and Settings\nicolas\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt0.dll (file missing)

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"

O4 - HKLM\..\Run: [bDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"

O4 - HKLM\..\Run: [bDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"

O4 - HKLM\..\Run: [bDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"

O4 - HKCU\..\Run: [LClock] lclock.exe