Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

[POUR CHARLES INGALS] Les rapports

toutoune

Par toutoune
dans Analyses et éradication malwares

 Partager

Messages recommandés

toutoune Mega Power Member

toutoune

Posté(e)
Posté(e) (modifié)

Salut charlie c déjà bcp mieux qu'hier !!

 

Voici SDFix :

 

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-18 01:58:22

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden services & system hive ...

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys�0a9417c51a]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:a14e0209

"s2"=dword:ad50b7b1

"h0"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:72,f8,c9,30,61,ef,af,d5,1a,a4,69,f5,66,83,c4,0f,f2,58,7d,d4,5a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4�000001]

"a0"=hex:20,01,00,00,ee,28,dc,42,87,b9,e9,b6,9a,76,7e,8a,ce,2f,39,03,00,..

"khjeh"=hex:14,f4,18,34,96,5f,fe,ca,e0,d6,3a,91,90,22,f5,cb,fe,34,1d,4c,7d,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4�000001Jf40]

"khjeh"=hex:1f,80,5b,47,d6,38,f9,1f,30,09,90,2d,b3,93,af,9f,d9,bb,bc,b8,a3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys�0a9417c51a]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:72,f8,c9,30,61,ef,af,d5,1a,a4,69,f5,66,83,c4,0f,f2,58,7d,d4,5a,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4�000001]

"a0"=hex:20,01,00,00,ee,28,dc,42,87,b9,e9,b6,9a,76,7e,8a,ce,2f,39,03,00,..

"khjeh"=hex:14,f4,18,34,96,5f,fe,ca,e0,d6,3a,91,90,22,f5,cb,fe,34,1d,4c,7d,..

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4�000001Jf40]

"khjeh"=hex:1f,80,5b,47,d6,38,f9,1f,30,09,90,2d,b3,93,af,9f,d9,bb,bc,b8,a3,..

 

scanning hidden registry entries ...

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]

"TracesProcessed"=dword:00000091

"TracesSuccessful"=dword:00000001

 

scanning hidden files ...

 

 

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 3081

 

C grave docteur ? :P

 

De plus un nouveau hijackthis :

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 13:02:29, on 18/01/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Media Player\WMPNetwk.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\XCSyncML.exe

C:\Program Files\NetLimiter\NetLimiter.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Norton Security Scan\Nss.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe

C:\WINDOWS\ClamWin Portable\db\iportable.sup.fr.exe

C:\Documents and Settings\mon compte\Bureau\ClamWinPortable.exe

C:\DOCUME~1\MONCOM~1\LOCALS~1\Temp\is-V7KQ0.tmp\is-CFFIC.tmp

C:\DOCUME~1\MONCOM~1\LOCALS~1\Temp\is-T2AHK.tmp\bin\ClamWin.exe

C:\Documents and Settings\mon compte\Mes documents\HijackThis.exe

c:\PROGRA~1\MESSEN~1\Msmsgs.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe

O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [updateCP] %windir%\ClamWin Portable\db\iportable.sup.fr.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2453882 14

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/cabs/ascstubie.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)

O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

 

merci d'avance pour ton suivi :P

Modifié par toutoune

Thanos Devil Member !

Thanos

Posté(e)
Posté(e)

salut :P

 

Je passe en coup de vent!

Le rapport SDFix n'est pas le bon! tu le trouveras dans le répertoire C:\SDFix et il se nomme Report.txt .

Il me faut voir son contenu pour constater s'il a éliminé la menace :P

 

Fais ce scan en ligne stp >

 

Assure toi que les contrôles activeX soient bien configurés dans les options internet comme décrit sur ce lien=> Cybersécurité

  • Fais un scan en ligne Kaspersky
  • Clique sur Accept
  • Une barre jaune va te demander si tu acceptes d'installer le Kavwebscan_Unicode.cab, installe l'Active X.
  • clique une nouvelle fois sur "Accept"
  • Les bases de mises à jour vont s'installer, patiente un moment
  • Clique sur Next.
  • Clique sur My Computer, le scan se met en route; attends la fin du scan sans fermer la fenêtre sinon il s'arrêtera.

A la fin du scan, si des objets infectés sont découverts, clique sur Save report as... Choisis bureau et nomme le rapport "rapport Kaspersky" et dans le champ d'enregistrement, choisis "fichiers texte" enregistre alors le rapport.

 

Copie/colle la totalité du fichier texte ouvert, par clic droit dessus, sélectionner tout/copier.

 

Colle ce rapport dans ta réponse sur le forum.

 

Aide en cas de problème :Cybersécurité

 

NOTE: Le scan est à faire avec Internet Explorer.

toutoune Mega Power Member

toutoune

Posté(e)
  • Auteur
Posté(e)

merci pour cette réponse Charlie, moi aussi j'avais un doute sur le rapport SDFix...

 

Le pauvre annihil, c'est pas pour rien qu'on l'appelle Régis :P

 

(ceux qui connaissent les Nuls comprendront, pour les autres -> http://video.google.fr/videoplay?docid=-17...h&plindex=3 )

 

Un peu d'humour dans ce monde de véroles :P

 

Enfin maintenant ya pu qu'à attendre Rég... annihil :P

 

A+ !

  • 2 semaines après...
annihilplus Junior Member

annihilplus

Posté(e)
Posté(e)

Salut Charles, voila la lecture que tu m a demandé bon courage et tiens moi au courant merci:

 

rapport hijackhis:

Logfile of HijackThis v1.99.1

Scan saved at 01:01:23, on 18/01/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\Explorer.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Media Player\WMPNetwk.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\XCSyncML.exe

C:\Program Files\NetLimiter\NetLimiter.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\DOCUME~1\MONCOM~1\LOCALS~1\Temp\services.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SuperCopier2\SuperCopier2.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Norton Internet Security\comHost.exe

c:\PROGRA~1\MESSEN~1\Msmsgs.exe

C:\Documents and Settings\mon compte\Mes documents\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\svchost.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe

O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s

O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Flash Player2] C:\DOCUME~1\MONCOM~1\LOCALS~1\Temp\services.exe

O4 - HKLM\..\Run: [updateCP] %windir%\ClamWin Portable\db\iportable.sup.fr.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2453882 14

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [superCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/cabs/ascstubie.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Generic Host Process for Win-32 Service - Unknown owner - C:\WINDOWS\svchost.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)

O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

 

rapport scan online:

KASPERSKY ONLINE SCANNER REPORT

Wednesday, January 30, 2008 3:51:59 PM

Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.98.0

Kaspersky Anti-Virus database last update: 30/01/2008

Kaspersky Anti-Virus database records: 537756

-------------------------------------------------------------------------------

 

Scan Settings:

Scan using the following antivirus database: extended

Scan Archives: true

Scan Mail Bases: true

 

Scan Target - My Computer:

C:\

D:\

E:\

F:\

G:\

H:\

I:\

J:\

 

Scan Statistics:

Total number of scanned objects: 100965

Number of viruses found: 8

Number of infected objects: 82

Number of suspicious objects: 0

Duration of the scan process: 01:38:56

 

Infected Object Name / Virus Name / Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-01-30_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine1076724.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine10A1120.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine4343DA5.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine43767A2.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine7E0799A.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine7E74D93.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineAA5108E.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineAAC6487.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineDE662FA.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineDE90CF6.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineF8C2690.exe Infected: Backdoor.Win32.SdBot.cqm skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1A087706.exe Infected: Backdoor.Win32.SdBot.cqm skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1ADC04B7.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1AE92CA9.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21773BFD.exe Infected: Backdoor.Win32.SdBot.cqm skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21DE67DC.exe Infected: Backdoor.Win32.VanBot.ej skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\221207A3.exe Infected: Backdoor.Win32.VanBot.ej skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\39083E5E.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\39123C54.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\392A2C26.exe Infected: not-a-virus:AdTool.Win32.WhenU.a skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3C1B44FC.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3C2118F5.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3F414785.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3F481B7D.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42781BFB.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\427F6FF4.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45A91C79.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45AF7071.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\48E644E8.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\48ED18E1.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4C131B69.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4C174565.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4D820025.tmp Infected: Backdoor.Win32.IRCBot.bal skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50C8203B.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50C8203B.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\540648AA.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5410469F.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\55E07CEE.tmp Infected: Backdoor.Win32.IRCBot.acd skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\577B3ADC.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\577E64D9.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AE62F19.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AED0312.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E0009B0.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5E0333AC.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\613A0823.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\613A0823.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64463AC8.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64463AC8.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\67731149.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\67773B46.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6AB139B8.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6AB139B8.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6DDB663D.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6DDE103A.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\713F0681.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\713F0681.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74423B31.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7445652E.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\776269C1.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\776513BD.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79F37252.tmp Infected: Backdoor.Win32.SdBot.cqm skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AA66629.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AA66629.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7DC614B8.cmt Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7DCD68B1.exe Infected: Trojan-Downloader.Win32.Agent.hql skipped

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Object is locked skipped

C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\mon compte\aetwtt.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\Application Data\MessengerSkinner\Userdata\Install_MessengerSkinner.zip/Msgskinner_setup.exe Infected: not-a-virus:AdWare.Win32.NaviPromo.aw skipped

C:\Documents and Settings\mon compte\Application Data\MessengerSkinner\Userdata\Install_MessengerSkinner.zip ZIP: infected - 1 skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\call256.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\callmember256.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\chat512.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\chatmember256.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\chatmsg256.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\chatmsg4096.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\chatmsg512.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\contactgroup256.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\dyncontent\bundle.dat Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\index2.dat Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\profile4096.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\transfer256.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\transfer512.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\user1024.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\user16384.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\user32768.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\user4096.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Skype\annihilplus\voicemail256.dbb Object is locked skipped

C:\Documents and Settings\mon compte\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped

C:\Documents and Settings\mon compte\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\mon compte\fgwakx.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Temp\Perflib_Perfdata_ad8.dat Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Temp\Perflib_Perfdata_b38.dat Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Temp\Perflib_Perfdata_bc4.dat Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\mon compte\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\mon compte\mamaxs.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\mbcujy.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\mgavdp.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\mon compte\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\mon compte\pjatac.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\ssqjbp.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\swmyrf.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\szvvjc.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\ualaqe.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\mon compte\vzjyop.exe Infected: Trojan-Downloader.Win32.Small.hsg skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\eengine\EPERSIST.DAT Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt277NAV~.TMP Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt383NAV~.TMP Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{C8E37647-F5C7-46F7-91E9-28AF9023E2B4}\RP360\A0065150.exe Infected: Backdoor.Win32.SdBot.cqm skipped

C:\System Volume Information\_restore{C8E37647-F5C7-46F7-91E9-28AF9023E2B4}\RP360\A0065157.exe Infected: Backdoor.Win32.SdBot.cqm skipped

C:\System Volume Information\_restore{C8E37647-F5C7-46F7-91E9-28AF9023E2B4}\RP363\A0065463.exe Infected: Backdoor.Win32.SdBot.cqm skipped

C:\System Volume Information\_restore{C8E37647-F5C7-46F7-91E9-28AF9023E2B4}\RP364\A0069415.exe Infected: Backdoor.Win32.SdBot.cqm skipped

C:\System Volume Information\_restore{C8E37647-F5C7-46F7-91E9-28AF9023E2B4}\RP369\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\ModemLog_Câble de communication entre deux ordinateurs.txt Object is locked skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{916D8A88-7530-409D-BAE1-E81C6A113392}.crmlog Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

 

Scan process completed.

Thanos Devil Member !

Thanos

Posté(e)
Posté(e)

salut :P

 

annihilplus: Désactive temporairement ton antivirus le temps de faire ce scan >

 

Télécharge combofix.exe de sUBs

  • Assure toi que tous les programmes sont fermés avant de lancer le fix!
  • Fait un double clique sur combofix.exe.
  • Clique sur Oui au message de Limitation de Garantie qui s'affiche.
  • Il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sure: accepte!
  • Note: Ne ferme pas la fenêtre qui vient de s'ouvrir , tu te retrouverais avec un bureau vide !
  • Lorsque le scan est terminé, un rapport sera généré : poste en le contenu dans ton prochain message.

Poste le rapport stp > si tu ne vois pas le rapport s'afficher, tu le trouveras dans le répertoire C:\ > il se nomme ComboFix.txt

 

@+

Thanos Devil Member !

Thanos

Posté(e)
Posté(e)

salut :P

 

Je remet ici ton rapport ComboFix pour un suivi plus facile! >

ComboFix 08-02.03.1 - mon compte 2008-02-03 13:31:25.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.863 [GMT 1:00]

Endroit: C:\Documents and Settings\mon compte\Bureau\ComboFix.exe

* Création d'un nouveau point de restauration

 

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Documents and Settings\mon compte\Application Data\MessengerSkinner

C:\Documents and Settings\mon compte\Application Data\MessengerSkinner\Userdata\defaultPack.cab

C:\Documents and Settings\mon compte\Application Data\MessengerSkinner\Userdata\Install_MessengerSkinner.zip

C:\Documents and Settings\mon compte\Application Data\MessengerSkinner\Userdata\languages.xml

C:\Documents and Settings\mon compte\Application Data\MessengerSkinner\Userdata\pack1.cab

C:\WINDOWS\Downloaded Program Files\Quarantine

C:\WINDOWS\pack.epk

C:\WINDOWS\system32\eflghj.dat

C:\WINDOWS\system32\eflghj_nav.dat

C:\WINDOWS\system32\eflghj_navps.dat

C:\WINDOWS\system32\iomyutrjl.dat

C:\WINDOWS\system32\iomyutrjl_nav.dat

C:\WINDOWS\system32\iomyutrjl_navps.dat

C:\WINDOWS\system32\jfuinbwlpe.dat

C:\WINDOWS\system32\jfuinbwlpe_nav.dat

C:\WINDOWS\system32\jfuinbwlpe_navps.dat

C:\WINDOWS\system32\nvs2.inf

 

.

((((((((((((((((((((((((((((( Fichiers créés 2008-01-03 to 2008-02-03 ))))))))))))))))))))))))))))))))))))

.

 

2008-02-01 00:14 . 2008-02-01 02:21 <REP> d-------- C:\WINDOWS\BDOSCAN8

2008-01-30 10:15 . 2008-01-30 10:15 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab

2008-01-30 10:15 . 2008-01-30 10:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab

2008-01-26 17:35 . 2008-01-26 17:35 <REP> d-------- C:\Program Files\Happyneuron

2008-01-22 13:35 . 2008-01-22 13:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-01-22 13:34 . 2008-01-22 13:34 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

2008-01-18 01:46 . 2008-01-18 01:47 <REP> d-------- C:\WINDOWS\ERUNT

2008-01-18 01:44 . 2006-03-28 14:04 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau

2008-01-18 01:44 . 2006-03-28 14:04 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression

2008-01-18 01:44 . 2006-03-28 12:09 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles

2008-01-18 01:44 . 2006-03-28 12:14 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents

2008-01-18 01:44 . 2006-03-28 12:55 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer

2008-01-18 01:44 . 2006-03-28 12:14 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris

2008-01-18 01:44 . 2008-01-18 01:49 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau

2008-01-18 01:44 . 2007-01-10 09:48 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Desperate Housewives

2008-01-18 01:44 . 2006-03-28 12:59 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\ATI

2008-01-18 01:30 . 2008-01-18 02:03 <REP> d-------- C:\SDFix

2008-01-18 00:12 . 2008-01-19 08:57 <REP> d-------- C:\WINDOWS\ClamWin Portable

2008-01-17 23:46 . 2008-01-17 23:47 <REP> d-------- C:\Program Files\Panda Security

2008-01-17 23:28 . 2008-01-17 23:39 <REP> d-------- C:\WINDOWS\system32\ActiveScan

2008-01-17 23:28 . 2008-01-17 23:44 30,590 --a------ C:\WINDOWS\system32\pavas.ico

2008-01-17 23:28 . 2008-01-17 23:44 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico

2008-01-17 23:28 . 2008-01-17 23:44 1,406 --a------ C:\WINDOWS\system32\Help.ico

2008-01-14 09:26 . 2008-01-14 09:26 <REP> d-------- C:\Documents and Settings\mon compte\Application Data\Earthsim

2008-01-13 15:36 . 2008-01-14 09:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Earthsim

2008-01-13 15:28 . 2007-12-05 14:17 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe

2008-01-13 15:27 . 2008-01-13 15:27 <REP> d-------- C:\ATI

2008-01-08 14:01 . 2008-01-08 14:01 <REP> d-------- C:\Program Files\Fichiers communs\Skype

2008-01-08 14:01 . 2008-02-03 10:19 <REP> d-------- C:\Documents and Settings\mon compte\Application Data\skypePM

2008-01-08 14:01 . 2008-01-08 14:01 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-03 12:28 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared

2008-02-03 12:28 --------- d-----w C:\Documents and Settings\mon compte\Application Data\Skype

2008-02-03 12:27 --------- d-----w C:\Program Files\Wanadoo

2008-02-03 10:24 --------- d-----w C:\Program Files\Everest Poker

2008-02-03 09:25 --------- d-----w C:\Program Files\Lx_cats

2008-02-02 20:10 --------- d-----w C:\Program Files\Norton Security Scan

2008-02-02 15:25 --------- d-----w C:\Program Files\Warcraft III

2008-01-25 19:08 --------- d-----w C:\Program Files\Norton Internet Security

2008-01-22 12:45 --------- d-----w C:\Program Files\Lavasoft

2008-01-22 12:45 --------- d-----w C:\Documents and Settings\mon compte\Application Data\Lavasoft

2008-01-22 09:15 --------- d-----w C:\Program Files\Apple Software Update

2008-01-14 08:50 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF

2008-01-14 08:50 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL

2008-01-14 08:50 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS

2008-01-14 08:50 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT

2008-01-14 08:50 --------- d-----w C:\Program Files\Symantec

2008-01-14 08:22 --------- d-----w C:\Program Files\ATI

2008-01-13 14:28 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-01-01 13:57 --------- d-----w C:\Program Files\Messenger Plus! Live

2008-01-01 13:48 --------- d-----w C:\Documents and Settings\mon compte\Application Data\ArcSoft

2008-01-01 13:42 --------- d-----w C:\Program Files\Fichiers communs\ArcSoft

2008-01-01 13:40 --------- d-----w C:\Program Files\Hercules

2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe

2007-12-13 17:01 --------- d-----w C:\Program Files\DAEMON Tools

2007-12-13 16:53 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2007-12-08 11:32 1,004,197 ----a-w C:\WINDOWS\system32\Tokio Hotel.scr

2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys

2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll

2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll

2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll

2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll

2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe

2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll

2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll

2007-12-05 02:54 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll

2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL

2007-12-05 02:53 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe

2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll

2007-12-05 02:44 3,175,584 ----a-w C:\WINDOWS\system32\ati3duag.dll

2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll

2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll

2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll

2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll

2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll

2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll

2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll

2007-11-07 09:50 733,696 ----a-w C:\WINDOWS\system32\lsasrv.dll

2007-04-19 11:45 24,112 ----a-w C:\Documents and Settings\mon compte\Application Data\GDIPFONTCACHEV1.DAT

.

 

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]

"fsc-reminder.exe"="C:\WINDOWS\reminder\fsc-reminder.exe" [2005-01-19 16:10 28672]

"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]

"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 11:38 68856]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 15:08 21686568]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:59 204288]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2006-01-24 15:46 15691264 C:\WINDOWS\RTHDCPL.EXE]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 13:43 45056]

"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2007-02-22 11:08 52840]

"XCSyncML"="C:\WINDOWS\system32\XCSyncML.exe" [2005-07-14 09:07 135168]

"LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-07-20 18:48 73728]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]

"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41 282624]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 08:14 270648]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-05 13:00 110592 C:\WINDOWS\system32\bthprops.cpl]

"Symantec PIF AlertEng"="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 09:22 517768]

"UpdateCP"="%windir%\ClamWin Portable\db\iportable.sup.fr.exe" [ ]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

 

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BlueSoleil.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\BlueSoleil.lnk

backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]

path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk

backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

--a------ 2006-01-24 15:46 69632 C:\WINDOWS\ALCMTR.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]

--a------ 2005-08-01 13:05 94208 C:\Program Files\Lexmark 2300 Series\ezprint.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]

--a------ 2005-07-12 14:36 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcgmon.exe]

--a------ 2005-07-21 07:07 200704 C:\Program Files\Lexmark 2300 Series\lxcgmon.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2007-04-27 08:41 282624 C:\Program Files\QuickTime\qttask.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]

--a------ 2005-01-07 16:07 61952 C:\WINDOWS\system32\HdAShCut.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

--a------ 2006-11-03 08:59 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe

 

R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 17:29]

R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 13:00]

S3 archbus;NEC WMC USB_BJ1 Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\archbus.sys [2005-08-30 12:17]

S3 archmdfl;NEC WMC USB_BJ1 Modem Filter;C:\WINDOWS\system32\DRIVERS\archmdfl.sys [2005-08-30 12:17]

S3 archmdm;NEC WMC USB_BJ1 Port Drivers;C:\WINDOWS\system32\DRIVERS\archmdm.sys [2005-08-30 12:17]

S3 ovt530;Webcam Classic;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 17:04]

S3 PAC207;SoC PC-Camer@;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]

 

*Newly Created Service* - COMHOST

.

Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

"2008-01-22 10:25:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2008-02-01 19:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Effectuer une analyse complète du système - mon compte.job"

- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:

"2008-02-03 12:30:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0A42DA85-665D-4301-959A-2AADC19D68C9}.job"

- C:\WINDOWS\system32\msfeedssync.exe

.

**************************************************************************

 

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-03 13:33:36

Windows 5.1.2600 Service Pack 2 NTFS

 

Balayage processus cachés ...

 

Balayage caché autostart entries ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCGCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

 

Balayage des fichiers cachés ...

 

Scan terminé avec succès

Les fichiers cachés: 0

 

**************************************************************************

.

Temps d'accomplissement: 2008-02-03 13:34:17

ComboFix-quarantined-files.txt 2008-02-03 12:34:13

.

2008-01-09 22:35:29 --- E O F ---

Je te prépare un petit script à éxécuter au post suivant...

Thanos Devil Member !

Thanos

Posté(e)
Posté(e)

ComboFix t'a débarrassé d'une infection très courante qui se nomme Magic Control Agent et qui provoque de nombreuses pubs lors des surfs: ca doit aller mieux du côté de la navigation internet maintenant.

 

Plus haut je te demandais ceci >

Le rapport SDFix n'est pas le bon! tu le trouveras dans le répertoire C:\SDFix et il se nomme Report.txt .

Il me faut voir son contenu pour constater s'il a éliminé la menace

Ca tient toujours! poste ce rapport stp....

 

La suite >

 

1) Rend toi sur cette page afin de télécharger le fichier CFScript sur ton bureau > http://www.sendspace.com/file/jrx37f

pour cela, clique sur le lien en bas de page > pointright.gifDownload Link: CFScript

  • Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
    CFScript.gif
  • Une fenêtre bleue va apparaitre: au message qui apparait ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
  • Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal!
    Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  • Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

2) Refais le scan en ligne Kaspersky et poste le rapport.

 

3) Poste un nouveau rapport avec hijackthis.

 

Voilà: ca te fait quatre rapports à produire > celui de ComboFix,SDFix,Kaspersky et hijackthis .

 

La manip avec ComboFix vise à éliminer les fichiers infectés trouvés par Kaspersky (dont le but est de détecter les menaces mais pas de les éliminer).

 

Info importante qu'il faut retenir pour ne pas retomber dans le piège (si c'est une autre personne qui a téléchargé le logiciel responsable de l'infection, communique lui l'info!!) >

 

L'infection qui a pourri tes surfs se nomme Magic Control Agent comme je te disait plus haut .

 

Cette infection est véhiculée par des logiciels qu'il faut fuir absolument!! en voici une liste non exhaustive pour ne pas tomber dans le piège à nouveau >

  • go-astro
  • GoRecord
  • HotTVPlayer
  • MailSkinner
  • Messenger Skinner
  • Instant Access
  • InternetGameBox
  • sudoplanet
  • Webmediaplayer sauf celui provenant du site suivant > http://www.azertysite.new.fr/

D'une manière générale, méfie toi des utilitaires que tu télécharges!!Utilise Google pour voir si c'e n'est pas un logiciel qui installe un spyware : une simple recherche de quelques minutes te permettra de te faire une idée.

Par exemple : fais une recherche sur MessengerSkinner que tu as installé et tu verras le nombre de discussion ou les gens se plaignent de publicité intempestives ....

Plus d'infos sur le site de Malekal Morte dont les infos sont tirées > http://www.malekal.com/popupsintempestives.php

 

Voilà une autre liste (chez Assiste.com)que tu peux consulter avant d'installer un antispyware si tu es amené à le faire : elle recense tout un tas de faux utilitaires qui n'ont aucune efficacité, et qui peuvent même être dangereux car pas fiables : http://assiste.com.free.fr/p/craptheque/craptheque.html

D'autres apparaissent chaque jour(ou presque) ! aussi une recherche encore une fois avant d'installer quoique ce soit!!

 

allez courage: il y a déjà du meiux :P

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...