limitation de droit

Malekal_morte · le 24 octobre 2007

Me demande ce qui est fait sur internet avec ce PC... parce que bonjour les infections....

Désactive les antispywares, surtout SpyBot.

Relance HijackThis, coche ces lignes :

O4 - HKLM\..\RunOnce: [spybotDeletingA6759] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKLM\..\RunOnce: [spybotDeletingC7413] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingB5809] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingD1789] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat

--> clic sur fix checked

- Ouvre le dossier DiagHelp.

- Double-clic sur catchme.exe (le .exe peut ne pas apparaître).

Une fenêtre va s'ouvrir, vas dans l'onglet Script.

Copie/colle ceci :

files to kill:
C:\WINDOWS\System32\drivers\Chhv65.sys

C:\WINDOWS\system32\drivers\symavc32.sys

C:\WINDOWS\system32\drivers\Kgqw66.sys

C:\WINDOWS\ekdia192.exe

C:\WINDOWS\ekdia167.exe

C:\WINDOWS\ekdia141.exe

C:\WINDOWS\ekdia123.exe

C:\WINDOWS\ekdia157.exe

Clic sur Run.

Redémarre l'ordinateur

Poste le rapport catchme qui se trouve sur ton bureau ici.

Télécharge Combofix sUBs : combofix.exe

et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider.

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Copie/colle un nouveau rapport HiJackThis avec.

timat · le 25 octobre 2007

Me demande ce qui est fait sur internet avec ce PC... parce que bonjour les infections....

Désactive les antispywares, surtout SpyBot.

Relance HijackThis, coche ces lignes :

O4 - HKLM\..\RunOnce: [spybotDeletingA6759] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKLM\..\RunOnce: [spybotDeletingC7413] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingB5809] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingD1789] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat

--> clic sur fix checked

- Ouvre le dossier DiagHelp.

- Double-clic sur catchme.exe (le .exe peut ne pas apparaître).

Une fenêtre va s'ouvrir, vas dans l'onglet Script.

Copie/colle ceci :

Clic sur Run.

Redémarre l'ordinateur

Poste le rapport catchme qui se trouve sur ton bureau ici.

Télécharge Combofix sUBs : combofix.exe

et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider.

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Copie/colle un nouveau rapport HiJackThis avec.

CI APRES les fichiers demandé

1-diag help

catchme 0.3.1160 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-24 17:29:40

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kgqw66]

"Type"=dword:00000001

"Tag"=dword:00000002

"Group"="System ReservedBoot Bus ExtenderSystem Bus ExtenderSCSI miniportPortPrimary DiskSCSI ClassSCSI CDROM ClassFSFilter InfrastructureFSFilter SystemFSFilter BottomFSFilter Copy ProtectionFSFilter Security EnhancerFSFilter Open FileFSFilter Physical Quota ManagementFSFilter EncryptionFSFilter CompressionFSFilter HSMFSFilter Cluster File SystemFSFilter System RecoveryFSFilter Quota ManagementFSFilter Content ScreenerFSFilter Continuous BackupFSFilter ReplicationFSFilter Anti-VirusFSFilter UndeleteFSFilter Activity MonitorFSFilter TopFilterBoot File SystemBasePointer PortKeyboard PortPointer ClassKeyboard ClassVideo InitVideoVideo SaveFile SystemEvent LogStreams DriversNDIS WrapperCOM InfrastructureUIGroupLocalValidationPlugPlayPNP_TDINDISTDINetBIOSGroupShellSvcGroupSchedulerGroupSpoolerGroupAudioGroupSmartCardGroupNetworkProviderRemoteValidationNetDDEGroupParallel arbitratorExtended BasePCI Configuration\"

"ErrorControl"=dword:00000001

"Start"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:2df9c43f

"s2"=dword:110480d0

"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:91,c7,df,2f,8a,0d,29,44,2a,fe,75,fa,b8,13,68,b2,95,6a,cb,c7,79,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001]

"a0"=hex:20,01,00,00,c9,49,e3,08,c6,be,d7,a6,a9,56,1e,b6,f7,92,e3,d9,ff,..

"khjeh"=hex:62,34,1b,91,1a,0c,63,69,08,d1,39,83,3f,a2,c7,92,bf,c4,45,59,ea,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf40]

"khjeh"=hex:8f,72,8d,ec,b6,21,38,00,b8,ae,0e,e4,7e,90,a7,ca,2c,dd,5c,bc,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf41]

"khjeh"=hex:f8,ee,da,4e,5d,24,41,16,64,d4,bc,4b,4b,62,cc,19,95,67,4c,d9,fe,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Kgqw66]

"Type"=dword:00000001

"Tag"=dword:00000002

"Group"="System ReservedBoot Bus ExtenderSystem Bus ExtenderSCSI miniportPortPrimary DiskSCSI ClassSCSI CDROM ClassFSFilter InfrastructureFSFilter SystemFSFilter BottomFSFilter Copy ProtectionFSFilter Security EnhancerFSFilter Open FileFSFilter Physical Quota ManagementFSFilter EncryptionFSFilter CompressionFSFilter HSMFSFilter Cluster File SystemFSFilter System RecoveryFSFilter Quota ManagementFSFilter Content ScreenerFSFilter Continuous BackupFSFilter ReplicationFSFilter Anti-VirusFSFilter UndeleteFSFilter Activity MonitorFSFilter TopFilterBoot File SystemBasePointer PortKeyboard PortPointer ClassKeyboard ClassVideo InitVideoVideo SaveFile SystemEvent LogStreams DriversNDIS WrapperCOM InfrastructureUIGroupLocalValidationPlugPlayPNP_TDINDISTDINetBIOSGroupShellSvcGroupSchedulerGroupSpoolerGroupAudioGroupSmartCardGroupNetworkProviderRemoteValidationNetDDEGroupParallel arbitratorExtended BasePCI Configuration\"

"ErrorControl"=dword:00000001

"Start"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:91,c7,df,2f,8a,0d,29,44,2a,fe,75,fa,b8,13,68,b2,95,6a,cb,c7,79,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001]

"a0"=hex:20,01,00,00,c9,49,e3,08,c6,be,d7,a6,a9,56,1e,b6,f7,92,e3,d9,ff,..

"khjeh"=hex:62,34,1b,91,1a,0c,63,69,08,d1,39,83,3f,a2,c7,92,bf,c4,45,59,ea,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf40]

"khjeh"=hex:8f,72,8d,ec,b6,21,38,00,b8,ae,0e,e4,7e,90,a7,ca,2c,dd,5c,bc,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4000001Jf41]

"khjeh"=hex:f8,ee,da,4e,5d,24,41,16,64,d4,bc,4b,4b,62,cc,19,95,67,4c,d9,fe,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]

"OOSAFEERASE03.00.00.01MSWINDOWS"="E7C15B72AB51428416D7E4CB2499135CDDF3FD68967A910D8D5C3B4B2310FE9D1F61E1FEAABE8BDE09F427C928B55FC79A0D84B692B434A56AD5177058AF0222553B1767DFB7B78D8DBAD64EA6360782B886555CDDFBBDD49C7C61EAA89E315561E94CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933FEBC9E127BECC74CC038D530D6EB34528EDD5E5BE2F6E6677C032297BB11B2F730177FD5A6EC06E7AD0F2D36B93540B6217A59216CF65B10C389E043F7C7459376C02A769988200F2D46D2BF1F2F5DB823B02FD9CBA79D8AE672104B09BFE39E30D06716DFA99F228B64ACED52887C5C4D372105F50C87BA626854E8682625775FDE88668B3F574CF095D8899910CAB28EED39A68477C5398719C375266C5262590C5039BFFDCC98D60966FE4EDBADB3A433F663A5FD3906FB35E870654AE906C87A770936DABAF68EF25BDEDDC33DB5A36B4B049BF776043773447C5CB91B6EA9CF2AEF399190BCB88AB0DF48614278F3019B78BC04C5F8850CC6E0D8F74D0B4F38082DAA2270224C8C54DA2498BE1B50DFC3D17303A38D0A3E5A87B70819AEDEE1A4277E4F314315B7A4CA9B0B6625C9F70FC53E9840D237CAD680EC30CB11D27E88E33D20DC21B14F7A51E9221E7F433F432EAF2F013A56F70EFD8078E84D784530100360311F941C1BB36009047774AC13896CF3FE98850E41578C32A364F0F00BFA7E1FA106836846DA66B066BDE9BE2A79315884AA345C2788C1EC673732417E98F52D55039A85AB54F2CCC9E7837526434A10140E28B4ECADE1014F8F87F66081C02526254845EFCE15D5E4EF73D499D19A1661C478EAAF0C45862F170DD9FDF14C602262CF80AD22ED872333C2E409329726D5B5945A030957DC8B5EB5B396C7977E8C914713F0C4B062A372CC34EF97CD428B2CBA5F6E3117A59ED6C6D45F8837E1DB7019DBBA55A82B3BD342533C5659AF55D3805C6CB19647D4DA598E7F5C53B2B91F853E809332E8F0DF2655CEE8ECF638414EB6EBDE7FEB5024DBB7920EA85B85211EA32B6440680006D0D3FEEDCF646BE9E25850AE8A81675210AAAA8E878BD1DEC9F417D1D53958156C6C97A6DB0BDA294CAFF0BC093B22680C47497054B5E426C32595878D301D43F9BD53787FBF283C71AC97475D0EBE4E386EE7EC06123AA699A56C5793E4A6ABCDEC676EBB1AA7470A460431FDB3AECE5509F2DFAA9BFE742F6DD3B52B347EC80F237836A779E14EA3F4E902782C971AF17F4948611095093C7AF9BB273E66FE390E219FEDFD13BD1DB76F64E9B7D24375413FC95F74153F4A4B7E2672E5D0121C5CEEA3CC0CAB632E8E30A6865EEEC119C19C2EEA8EC8D7B663F6550AD3E52ADB44E3DA96CCD0705D013BBC95E82B716BF69EDF63"

scanning hidden files ...

C:\WINDOWS\system32\drivers\symavc32.sys

C:\WINDOWS\system32\drivers\Kgqw66.sys

scan completed successfully

hidden services: 1

hidden files: 2

source file error: C:\WINDOWS\Systeme32\drivers\Chhv65.sys

source file error: C:\WINDOWS\systeme32\drivers\symavc32.sys

source file error: C:\WINDOWS\systeme32\drivers\Kgqw66.sys

file zipped: C:\WINDOWS\ekdia192.exe -> catchme.zip -> ekdia192.exe ( 15073 bytes )

PE file "C:\WINDOWS\ekdia192.exe" killed successfully

file zipped: C:\WINDOWS\ekdia167.exe -> catchme.zip -> ekdia167.exe ( 15073 bytes )

PE file "C:\WINDOWS\ekdia167.exe" killed successfully

file zipped: C:\WINDOWS\ekdia141.exe -> catchme.zip -> ekdia141.exe ( 15073 bytes )

PE file "C:\WINDOWS\ekdia141.exe" killed successfully

file zipped: C:\WINDOWS\ekdia123.exe -> catchme.zip -> ekdia123.exe ( 15073 bytes )

PE file "C:\WINDOWS\ekdia123.exe" killed successfully

file zipped: C:\WINDOWS\ekdia157.exe -> catchme.zip -> ekdia157.exe ( 15073 bytes )

PE file "C:\WINDOWS\ekdia157.exe" killed successfully

2combofix

ComboFix 07-10-23.1 - Bernard 2007-10-25 15:22:40.1 - NTFSx86

Microsoft Windows XP ?dition familiale 5.1.2600.2.1252.1.1036.18.253 [GMT 2:00]

Running from: C:\Documents and Settings\Bernard\Bureau\ComboFix.exe

* Created a new restore point

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\system32\3_exception.nls

C:\WINDOWS\system32\drivers\Chhv65.sys

C:\WINDOWS\system32\drivers\ip6fw.sys

C:\WINDOWS\system32\drivers\KGQW66.sys

C:\WINDOWS\system32\drivers\runtime2.sys

C:\WINDOWS\system32\drivers\symavc32.sys

C:\WINDOWS\system32\sulimo.dat

G:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\LEGACY_KGQW66

-------\LEGACY_RUNTIME

-------\LEGACY_RUNTIME2

-------\poof

((((((((((((((((((((((((((((( Fichiers créés 2007-09-25 to 2007-10-25 ))))))))))))))))))))))))))))))))))))

.

2007-10-25 15:21 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-10-25 11:42 16,384 --a------ C:\WINDOWS\xlavba6.exe

2007-10-24 18:11 15,585 --a------ C:\WINDOWS\ekdia165.exe

2007-10-24 18:10 20,992 --a------ C:\WINDOWS\oeimara.exe

2007-10-24 17:21 15,073 --a------ C:\WINDOWS\ekdia192.exe

2007-10-24 17:19 15,073 --a------ C:\WINDOWS\ekdia167.exe

2007-10-23 18:56 <REP> d-------- C:\WINDOWS\system32\AVGUARD_4720ed49

2007-10-23 17:31 15,073 --a------ C:\WINDOWS\ekdia141.exe

2007-10-23 17:31 15,073 --a------ C:\WINDOWS\ekdia123.exe

2007-10-23 17:30 15,073 --a------ C:\WINDOWS\ekdia157.exe

2007-10-23 17:06 15,073 --a------ C:\WINDOWS\ekdia118.exe

2007-10-23 17:03 <REP> d-------- C:\Documents and Settings\TIM\Application Data\vlc

2007-10-22 18:26 15,073 --a------ C:\WINDOWS\ekdia128.exe

2007-10-22 18:05 15,073 --a------ C:\WINDOWS\ekdia110.exe

2007-10-22 18:01 <REP> d-------- C:\WINDOWS\system32\AVGUARD_4720111a

2007-10-22 18:01 <REP> d-------- C:\Documents and Settings\TIM\WINDOWS

2007-10-22 18:01 <REP> d--h----- C:\Documents and Settings\TIM\Voisinage r‚seau

2007-10-22 18:01 <REP> d--h----- C:\Documents and Settings\TIM\Voisinage d'impression

2007-10-22 18:01 <REP> d--h----- C:\Documents and Settings\TIM\ModŠles

2007-10-22 18:01 <REP> dr------- C:\Documents and Settings\TIM\Mes documents

2007-10-22 18:01 <REP> dr------- C:\Documents and Settings\TIM\Menu D‚marrer

2007-10-22 18:01 <REP> dr------- C:\Documents and Settings\TIM\Favoris

2007-10-22 18:01 <REP> d-------- C:\Documents and Settings\TIM\Bureau

2007-10-22 18:01 <REP> d-------- C:\Documents and Settings\TIM\Application Data\Symantec

2007-10-22 18:01 <REP> d-------- C:\Documents and Settings\TIM\Application Data\Sony Corporation

2007-10-22 17:33 15,073 --a------ C:\WINDOWS\ekdia145.exe

2007-10-22 16:43 <REP> dr------- C:\Documents and Settings\LocalService\Favoris

2007-10-22 16:43 15,073 --a------ C:\WINDOWS\ekdia125.exe

2007-10-22 16:40 113,152 --a------ C:\WINDOWS\dravis.exe

2007-10-22 16:40 15,073 --a------ C:\WINDOWS\ekdia160.exe

2007-10-22 15:58 16,384 --a------ C:\WINDOWS\xlavba3.exe

2007-10-22 15:58 15,073 --a------ C:\WINDOWS\ekdia113.exe

2007-10-22 13:34 15,073 --a------ C:\WINDOWS\ekdia177.exe

2007-10-22 13:33 15,073 --a------ C:\WINDOWS\ekdia171.exe

2007-10-22 09:37 15,073 --a------ C:\WINDOWS\ekdia168.exe

2007-10-22 09:33 15,073 --a------ C:\WINDOWS\ekdia162.exe

2007-10-22 09:25 15,073 --a------ C:\WINDOWS\ekdia184.exe

2007-10-22 09:24 15,073 --a------ C:\WINDOWS\ekdia161.exe

2007-10-22 09:22 15,073 --a------ C:\WINDOWS\ekdia119.exe

2007-10-22 09:00 <REP> d-------- C:\WINDOWS\ERUNT

2007-10-22 08:58 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS

2007-10-22 08:58 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau

2007-10-22 08:58 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression

2007-10-22 08:58 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles

2007-10-22 08:58 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents

2007-10-22 08:58 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer

2007-10-22 08:58 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris

2007-10-22 08:58 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau

2007-10-22 08:58 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec

2007-10-22 08:58 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sony Corporation

2007-10-21 17:44 15,073 --a------ C:\WINDOWS\ekdia170.exe

2007-10-21 17:43 15,073 --a------ C:\WINDOWS\ekdia104.exe

2007-10-21 11:27 <REP> d-------- C:\Documents and Settings\Bernard\Application Data\Template

2007-10-21 10:13 <REP> d-------- C:\WINDOWS\system32\ActiveScan

2007-10-21 09:27 15,073 --a------ C:\WINDOWS\ekdia101.exe

2007-10-20 17:29 <REP> d-------- C:\Program Files\Trend Micro

2007-10-20 15:25 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

2007-10-19 11:49 15,073 --a------ C:\WINDOWS\ekdia146.exe

2007-10-18 17:20 15,073 --a------ C:\WINDOWS\ekdia143.exe

2007-10-18 17:11 <REP> d-------- C:\Program Files\Lavasoft

2007-10-17 17:53 15,073 --a------ C:\WINDOWS\ekdia197.exe

2007-10-16 18:54 15,073 --a------ C:\WINDOWS\ekdia194.exe

2007-10-16 18:51 15,073 --a------ C:\WINDOWS\ekdia116.exe

2007-10-16 18:44 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll

2007-10-16 17:35 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7

2007-10-16 17:35 <REP> d-------- C:\Documents and Settings\Bernard\Application Data\AVG7

2007-10-15 18:35 <REP> d-------- C:\Documents and Settings\Bernard\Application Data\Bitdefender(2)

2007-10-10 17:43 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll

2007-10-08 15:59 <REP> d-------- C:\Program Files\DVD Shrink

2007-10-04 18:31 <REP> d-------- C:\Program Files\Codemasters

2007-10-04 17:58 <REP> d-------- C:\WINDOWS\EPSON PhotoStarter Essential

2007-10-04 17:58 <REP> d-------- C:\WINDOWS\EPSON CardMonitor Essential

2007-10-04 17:38 <REP> d-------- C:\Documents and Settings\Bernard\Application Data\ArcSoft

2007-10-04 17:35 <REP> d-------- C:\Documents and Settings\Bernard\Application Data\Smart Panel

2007-10-04 17:29 131,072 --a------ C:\WINDOWS\system32\Epcmlib.dll

2007-10-04 17:28 <REP> d-------- C:\Program Files\ABBYY FineReader 5.0 Sprint

2007-10-04 17:26 <REP> d-------- C:\Program Files\ArcSoft

2007-10-04 17:26 212,480 --a------ C:\WINDOWS\pcdlib32.dll

2007-10-04 17:24 <REP> d-------- C:\Program Files\Smart Panel

2007-10-04 17:24 96,768 --a------ C:\WINDOWS\SlantAdj.dll

2007-10-04 17:24 73,216 --a------ C:\WINDOWS\ADE.DLL

2007-10-04 17:24 3,136 --a------ C:\WINDOWS\Ade001.bin

2007-10-04 17:18 <REP> d-------- C:\Program Files\EPSON

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-23 17:00 --------- d-----w C:\Program Files\Internet Sweeper Pro

2007-10-20 13:30 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys

2007-10-20 13:30 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys

2007-10-15 16:46 --------- d-----w C:\Program Files\Picasa2

2007-10-11 10:45 --------- d-----w C:\Documents and Settings\Bernard\Application Data\AdobeUM

2007-10-09 17:15 --------- d-----w C:\Program Files\eMule

2007-10-04 16:31 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-10-04 16:29 --------- d-----w C:\Program Files\Fichiers communs\InstallShield

2007-10-02 15:59 --------- d-----w C:\Documents and Settings\Bernard\Application Data\MSN6

2007-09-19 15:28 --------- d-----w C:\Program Files\DAEMON Tools

2007-09-18 15:37 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2007-09-15 07:24 --------- d-----w C:\Documents and Settings\Bernard\Application Data\InterVideo

2007-09-13 16:21 --------- d-----w C:\Program Files\Fichiers communs\Real

2007-09-12 16:15 --------- d-----w C:\Program Files\Google

2007-09-12 16:09 --------- d-----w C:\Program Files\Yahoo!

2007-09-10 16:35 --------- d-----w C:\Program Files\OO Software

2007-09-09 08:10 --------- d-----w C:\Program Files\Planetwide Games

2007-09-09 07:34 --------- d-----w C:\Program Files\Java

2007-09-08 16:43 --------- d-----w C:\Program Files\FrostWire

2007-09-08 16:41 --------- d-----w C:\Documents and Settings\Bernard\Application Data\FrostWire

2007-09-08 16:35 910 ----a-w C:\Program Files\INSTALL.LOG

2007-09-04 15:34 --------- d-----w C:\Documents and Settings\Bernard\Application Data\vlc

2007-09-04 15:32 --------- d-----w C:\Program Files\VideoLAN

2007-09-04 15:16 --------- d-----w C:\Program Files\CCleaner

2007-08-30 10:26 --------- d-----w C:\Documents and Settings\Bernard\Application Data\Drag'n Drop CD+DVD

2007-08-30 10:15 --------- d-----w C:\Program Files\Microsoft Works

2007-08-30 10:12 --------- d-----w C:\Program Files\sony

2007-08-30 10:12 --------- d-----w C:\Program Files\drag'n drop cd+dvd

2007-08-30 10:11 --------- d-----w C:\Program Files\Fichiers communs\Sony Shared

2007-08-30 10:06 --------- d-----w C:\Program Files\MoodLogic

2007-08-30 10:01 --------- d-----w C:\Program Files\Fichiers communs\Adobe

2007-08-30 09:54 --------- d-----w C:\Program Files\QuickTime

2007-08-30 09:50 0 ---ha-r C:\WINDOWS\system32\drivers\Sony_PCG-GRT916Z(FR)_.mrk

2007-03-19 18:13 6,422,611 ----a-w C:\Program Files\frostwire-4.13.1.6.windows.exe

.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-09-19 15:35]

"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-05-02 16:51]

"SigmaTel StacMon"="C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe" [2003-03-26 19:19]

"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 17:46 C:\WINDOWS\system32\ico.exe]

"HKSERV.EXE"="C:\Program Files\Sony\HotKey Utility\HKserv.exe" [2003-08-14 11:00]

"ezShieldProtector for Px"="C:\WINDOWS\System32\ezSP_Px.exe" [2002-08-20 11:29]

"ISP"="C:\Program Files\sony\ISPselector\ISPselector.exe" [2002-05-21 08:04]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23]

"EPSON Stylus Photo RX500"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.exe" [2003-09-12 05:00]

"NWEReboot"="" []

"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2006-01-18 15:52]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]

"SpybotDeletingB5809"=command /c del "C:\WINDOWS\system32\WinAvXX.exe"

"SpybotDeletingD1789"=cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys

R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys

R3 fhlppppoe;PPPOE/ADSL miniport;C:\WINDOWS\system32\DRIVERS\fhlpppoe.sys

R3 HSFHWSIS;HSFHWSIS;C:\WINDOWS\system32\DRIVERS\HSFHWSIS.sys

R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\system32\DRIVERS\SonyPI.sys

S3 BDSelfPr;BDSelfPr;\??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx scan

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

AutoRun\command - setup.exe

.

**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-25 15:28:37

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-10-25 15:29:29 - machine was rebooted

.

--- E O F ---

3-hidjack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:35:17, on 25/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe

C:\WINDOWS\system32\ICO.EXE

C:\Program Files\Sony\HotKey Utility\HKserv.exe

C:\WINDOWS\System32\ezSP_Px.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Sony\HotKey Utility\HKWnd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\powerpanel\Program\PcfMgr.exe

C:\Program Files\Apoint\Apntex.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sigmaTel StacMon] C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe

O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe

O4 - HKLM\..\Run: [iSP] C:\Program Files\sony\ISPselector\ISPselector.exe /SCHEDULER

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\RunOnce: [spybotDeletingA6759] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKLM\..\RunOnce: [spybotDeletingC7413] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\RunOnce: [spybotDeletingB5809] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingD1789] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: PowerPanel.lnk = C:\Program Files\powerpanel\Program\PcfMgr.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/

O15 - Trusted Zone: *.sony-europe.com

O15 - Trusted Zone: *.sonystyle-europe.com

O15 - Trusted Zone: *.vaio-link.com

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Internet Sweeper Pro\autocomp.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe

O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\sony\vaio media music server\SSSvr.exe

O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\vaio media platform\sv_httpd.exe

O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\vaio media platform\UPnPFramework.exe

O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exe

O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Sony Corporation - C:\Program Files\Fichiers communs\sony shared\vaio media platform\SV_Httpd.exe

O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Fichiers communs\sony shared\vaio media platform\UPnPFramework.exe

--

End of file - 7727 bytes

Malekal_morte · le 25 octobre 2007

Vas sur http://upload.malekal.com

clic sur parcourir et sélectionne le fichier : C:\WINDOWS\xlavba6.exe (clic sur poste de travail à gauche puis Disque C --> Dossier Windows --> xlavba6.exe )

Ne touche pas au champs "Choisir le dossier de destination"

Clic sur envoyer fichier

Recommence pour envoyer les fichiers suivants :

C:\WINDOWS\oeimara.exe

C:\WINDOWS\dravis.exe

[*]Télécharge OTMoveIt de OldTimer.

[*]Sauvegarde le sur ton Bureau.

[*]Double-Clique sur OTMoveIt.exe pour le lancer.

[*]Copie le chemin des fichiers suivants en selectionnant TOUT et en appuyant sur CTRL+C (ou, après avoir sélectionner, clique-droit et choisis Copier) :

C:\WINDOWS\xlavba6.exe
C:\WINDOWS\ekdia165.exe

C:\WINDOWS\oeimara.exe

C:\WINDOWS\ekdia192.exe

C:\WINDOWS\ekdia167.exe

C:\WINDOWS\ekdia141.exe

C:\WINDOWS\ekdia123.exe

C:\WINDOWS\ekdia157.exe

C:\WINDOWS\ekdia118.exe

C:\WINDOWS\ekdia128.exe

C:\WINDOWS\ekdia110.exe

C:\WINDOWS\ekdia145.exe

C:\WINDOWS\ekdia125.exe

C:\WINDOWS\dravis.exe

C:\WINDOWS\ekdia160.exe

C:\WINDOWS\xlavba3.exe

C:\WINDOWS\ekdia113.exe

C:\WINDOWS\ekdia177.exe

C:\WINDOWS\ekdia171.exe

C:\WINDOWS\ekdia168.exe

C:\WINDOWS\ekdia162.exe

C:\WINDOWS\ekdia184.exe

C:\WINDOWS\ekdia161.exe

C:\WINDOWS\ekdia119.exe

C:\WINDOWS\ekdia145.exe

C:\WINDOWS\ekdia125.exe

[*]Retourne dans OTMoveit, fais un clique-droit dans la fenêtre "Paste List of Files/Folders to be moved" et choisis Coller.

[*]Clique sur le bouton rouge Moveit!.

[*]Ferme OTMoveIt.

Note : Si un fichier ou un dossier ne peut être déplacer immédiatement il te sera demander de redémarrer ta machine pour finir le processus. Si c'est le cas, choisis Yes.

Poste nous le rapport de OTMoveIT dispo ici : C:\_OTMoveIt\MovedFiles

timat · le 25 octobre 2007

Vas sur http://upload.malekal.com
clic sur parcourir et sélectionne le fichier : C:\WINDOWS\xlavba6.exe (clic sur poste de travail à gauche puis Disque C --> Dossier Windows --> xlavba6.exe )

Ne touche pas au champs "Choisir le dossier de destination"

Clic sur envoyer fichier

Recommence pour envoyer les fichiers suivants :

C:\WINDOWS\oeimara.exe

C:\WINDOWS\dravis.exe

[*]Télécharge OTMoveIt de OldTimer.

[*]Sauvegarde le sur ton Bureau.

[*]Double-Clique sur OTMoveIt.exe pour le lancer.

[*]Copie le chemin des fichiers suivants en selectionnant TOUT et en appuyant sur CTRL+C (ou, après avoir sélectionner, clique-droit et choisis Copier) :

[*]Retourne dans OTMoveit, fais un clique-droit dans la fenêtre "Paste List of Files/Folders to be moved" et choisis Coller.

[*]Clique sur le bouton rouge Moveit!.

[*]Ferme OTMoveIt.

Note : Si un fichier ou un dossier ne peut être déplacer immédiatement il te sera demander de redémarrer ta machine pour finir le processus. Si c'est le cas, choisis Yes.

Poste nous le rapport de OTMoveIT dispo ici : C:\_OTMoveIt\MovedFiles

voici le rapport OTmovelt. Dis moi il me semble qu il y a un dialer

timat · le 25 octobre 2007

voici le rapport OTmovelt. Dis moi il me semble qu il y a un dialer

C:\WINDOWS\xlavba6.exe moved successfully.

C:\WINDOWS\ekdia165.exe moved successfully.

C:\WINDOWS\oeimara.exe moved successfully.

C:\WINDOWS\ekdia192.exe moved successfully.

C:\WINDOWS\ekdia167.exe moved successfully.

C:\WINDOWS\ekdia141.exe moved successfully.

C:\WINDOWS\ekdia123.exe moved successfully.

C:\WINDOWS\ekdia157.exe moved successfully.

C:\WINDOWS\ekdia118.exe moved successfully.

C:\WINDOWS\ekdia128.exe moved successfully.

C:\WINDOWS\ekdia110.exe moved successfully.

C:\WINDOWS\ekdia145.exe moved successfully.

C:\WINDOWS\ekdia125.exe moved successfully.

C:\WINDOWS\dravis.exe moved successfully.

C:\WINDOWS\ekdia160.exe moved successfully.

C:\WINDOWS\xlavba3.exe moved successfully.

C:\WINDOWS\ekdia113.exe moved successfully.

C:\WINDOWS\ekdia177.exe moved successfully.

C:\WINDOWS\ekdia171.exe moved successfully.

C:\WINDOWS\ekdia168.exe moved successfully.

C:\WINDOWS\ekdia162.exe moved successfully.

C:\WINDOWS\ekdia184.exe moved successfully.

C:\WINDOWS\ekdia161.exe moved successfully.

C:\WINDOWS\ekdia119.exe moved successfully.

File/Folder C:\WINDOWS\ekdia145.exe not found.

File/Folder C:\WINDOWS\ekdia125.exe not found.

Created on 10/25/2007 17:41:48

Malekal_morte · le 25 octobre 2007

Désactive tous les logiciels de protection surtout spybot et ad-aware

Relance HijackThis, coche ces lignes :

O4 - HKLM\..\RunOnce: [spybotDeletingA6759] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKLM\..\RunOnce: [spybotDeletingC7413] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingB5809] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingD1789] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

--> clic sur fix checked

Relance DiagHelp option 1 et poste un nouveau rapport HijackThis.

timat · le 26 octobre 2007

Désactive tous les logiciels de protection surtout spybot et ad-aware

Relance HijackThis, coche ces lignes :

O4 - HKLM\..\RunOnce: [spybotDeletingA6759] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKLM\..\RunOnce: [spybotDeletingC7413] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingB5809] command /c del "C:\WINDOWS\system32\WinAvXX.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingD1789] cmd /c del "C:\WINDOWS\system32\WinAvXX.exe"

--> clic sur fix checked

Relance DiagHelp option 1 et poste un nouveau rapport HijackThis.

salut,

voici le rapport hijack a propos j ai retrouvé le panneau de config!!!!!!!!!!!!!!!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:04:03, on 26/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe

C:\WINDOWS\system32\ICO.EXE

C:\Program Files\Sony\HotKey Utility\HKserv.exe

C:\WINDOWS\System32\ezSP_Px.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\powerpanel\Program\PcfMgr.exe

C:\Program Files\Sony\HotKey Utility\HKWnd.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sigmaTel StacMon] C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe

O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe

O4 - HKLM\..\Run: [iSP] C:\Program Files\sony\ISPselector\ISPselector.exe /SCHEDULER

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe