antivir XP 2008

TotOo · le 15 août 2008

Voila mon problème plusieurs fois expliquer par d'autre personnes ... je n'arrive pas à le désinstaller , à changer l'arrière plan que ce virus amène , le limewire qui souvre toute les minutes (mais que j'ai sésinstallé) ...

voila mon truc :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:14:14, on 15/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\WINDOWS\U2lsdmlhIEdFUkFSRA\command.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Network Monitor\netmon.exe

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe

C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe

D:\Program Files\HP\HP Software Update\HPWuSchd.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\Dit.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe

C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

C:\Program Files\Creative\Shared Files\CAMTRAY.EXE

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\lphccopj0ej0g.exe

C:\Program Files\rhc9opj0ej0g\rhc9opj0ej0g.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe

D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\WINDOWS\System32\alg.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe

C:\Program Files\Trend Micro\Internet Security\UfNavi.exe

C:\Program Files\Java\jre1.5.0_12\bin\jucheck.exe

C:\Program Files\Trend Micro\Internet Security\UfNavi.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\WINDOWS\System32\Rundll32.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\pphccopj0ej0g.exe

C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\AFJSY5XO\HiJackThis[1].exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a...&tbid=66006

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://orange.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/ServicesAcces.html

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: CodecPlugin Class - {098716A9-0310-4CBE-BD64-B790A9761158} - C:\WINDOWS\system32\RichVideoCodec.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {9C82FD94-D12A-47E7-BABC-A028F1EE094E} - C:\WINDOWS\system32\cd.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll

O2 - BHO: radbanner browser enhancer - {cf4d8f7b-3829-47c4-d94d-ad00cfa38129} - C:\WINDOWS\system32\dibsjfgcuxvqyouu.dll

O2 - BHO: (no name) - {E1BC7B00-0978-4DD4-8F0F-753E2D7FDFC6} - C:\WINDOWS\system32\ssqOFVNe.dll

O2 - BHO: mysidesearch search enhancer - {f08e9c31-93bd-9301-dddf-378459c3473a} - C:\WINDOWS\system32\gumpblneuhobw.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [HP Software Update] "D:\Program Files\HP\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [ufSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"

O4 - HKLM\..\Run: [Dit] Dit.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"

O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [lphccopj0ej0g] C:\WINDOWS\system32\lphccopj0ej0g.exe

O4 - HKLM\..\Run: [sMrhc9opj0ej0g] C:\Program Files\rhc9opj0ej0g\rhc9opj0ej0g.exe

O4 - HKLM\..\RunOnce: [TSC] "C:\Program Files\Trend Micro\Internet Security\tsc.exe" /HD

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [TrendSecure Remote File Lock] C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: ENJOY Plus!.lnk = C:\Program Files\ENJOY Plus!\ENJOY Plus!.exe

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1199887139734

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.fotodiscount.com/aurigma/ImageUploader4.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin...indows-i586.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/Gam...ronGameHost.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://jeuxenligne.orange.fr/GameShell/onl...aploader_v6.cab

O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.fotodiscount.com/aurigma/ImageUploader4.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{CC92A6ED-6259-46CA-85BA-9E701B8C1D23}: NameServer = 192.168.1.1

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 192.168.1.1

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 192.168.1.1

O20 - Winlogon Notify: ssqOFVNe - C:\WINDOWS\SYSTEM32\ssqOFVNe.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\U2lsdmlhIEdFUkFSRA\command.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Composant de commande centrale Trend Micro (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--

End of file - 14205 bytes

en espérent que vous pourrez m'aider...

j'ai trend micro internet sécurity 2008 comme enti virus et je suis en train de faire un scan avec ...

merci d'avance !

Falkra · le 15 août 2008

Bonjour, tu es victime d'un faux logiciel de sécurité. Soit tu l'as installé, car il se fait passer pour un vrai (ce n'est pas un reproche), soit il s'installe tout seul (c'est le plus courant) via une page piégée qui exploite des failles sur une machine vulnérable. Peu importe, on va nettoyer ça et sécuriser ta machine.

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

***Si le lien ne fonctionne pas, essaie celui-ci : http://download.bleepingcomputer.com/andymanchesta/SDFix.exe ***

Double clique sur SDFix.exe et choisis Install pour l'extraire à la racine de C:\. (cela donne C:\SDfix).

:!: Imprime ou note ce qui suit, tu n'auras pas accès à internet.

Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

Redémarre ton ordinateur.
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde suffit).
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Suis la liste des instructions ci-dessous :

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
Appuie sur Y pour commencer le nettoyage.
SDFix va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

Si SDfix ne se lance pas (ça arrive!)

* Démarrer->Exécuter
* Copie/colle ceci:
%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe
* Clique sur ok, et valide.
* Redémarre et essaye de nouveau de lancer SDfix.

TotOo · le 15 août 2008

voila c'est mieux ... j'ai accé à l'arrière plan ... l'antivirus n'a plus l'aire d'être la ... j'attend votre confirmation :

rapport :

SDFix: Version 1.216

Run by Propri‚taire on 15/08/2008 at 18:18

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Checking Services :

Name :

msliksurserv

Path :

\??\globalroot\systemroot\system32\drivers\msliksurserv.sys

msliksurserv - Deleted

Restoring Default Security Values

Restoring Default Hosts File

Restoring Default Desktop Wallpaper

Restoring Default ScreenSaver value

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\lphccopj0ej0g.exe - Deleted

C:\WINDOWS\system32\pphccopj0ej0g.exe - Deleted

C:\Program Files\rhc9opj0ej0g\database.dat - Deleted

C:\Program Files\rhc9opj0ej0g\license.txt - Deleted

C:\Program Files\rhc9opj0ej0g\MFC71.dll - Deleted

C:\Program Files\rhc9opj0ej0g\MFC71ENU.DLL - Deleted

C:\Program Files\rhc9opj0ej0g\msvcp71.dll - Deleted

C:\Program Files\rhc9opj0ej0g\msvcr71.dll - Deleted

C:\Program Files\rhc9opj0ej0g\rhc9opj0ej0g.exe - Deleted

C:\Program Files\rhc9opj0ej0g\rhc9opj0ej0g.exe.local - Deleted

C:\Program Files\rhc9opj0ej0g\Uninstall.exe - Deleted

C:\WINDOWS\SYSTEM32\PPHCCO~1.EXE - Deleted

C:\WINDOWS\system32\ssqOFVNe.dll - Deleted

C:\WINDOWS\system32\superiorads-uninst.exe - Deleted

C:\WINDOWS\system32\gumpblneuhobw.dll - Deleted

C:\WINDOWS\SYSTEM32\PHCCOP~1.BMP - Deleted

C:\WINDOWS\system32\blphccopj0ej0g.scr - Deleted

C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt - Deleted

C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt - Deleted

C:\Temp\1cb\syscheck.log - Deleted

C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt - Deleted

C:\Program Files\FBrowsingAdvisor\Logo.png - Deleted

C:\Program Files\FBrowsingAdvisor\main.db - Deleted

C:\Program Files\FBrowsingAdvisor\Thumbs.db - Deleted

C:\Program Files\FBrowsingAdvisor\unins000.dat - Deleted

C:\Program Files\FBrowsingAdvisor\unins000.exe - Deleted

C:\Program Files\FBrowsingAdvisor\XPCOMEvents.dll - Deleted

C:\Program Files\RichVideoCodec\MultiLoader.dll - Deleted

C:\Program Files\SunPorn\unins000.dat - Deleted

C:\Program Files\SunPorn\unins000.exe - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt114.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt134.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt136.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt138.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt29.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt2E.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt46.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt4C7.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt6.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt7.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt75A.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt9.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.ttA.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.ttAC8.tmp - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt114.tmp.vbs - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt6.tmp.vbs - Deleted

C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\.tt7.tmp.vbs - Deleted

C:\WINDOWS\system32\27.tmp - Deleted

C:\Program Files\Network Monitor\netmon.exe - Deleted

C:\Documents and Settings\Propri‚taire\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk - Deleted

C:\regxpcom.exe - Deleted

C:\WINDOWS\Fonts\Setup.exe - Deleted

C:\WINDOWS\system32\atmtd.dll - Deleted

C:\WINDOWS\system32\atmtd.dll._ - Deleted

C:\WINDOWS\system32\drivers\msliksurserv.sys - Deleted

C:\WINDOWS\system32\msliksurcredo.dll - Deleted

C:\WINDOWS\system32\msliksurdns.dll - Deleted

C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe - Deleted

C:\WINDOWS\system32\pac.txt - Deleted

C:\WINDOWS\system32\RichVideoCodec.dll - Deleted

C:\WINDOWS\system32\superiorads-uninst.exe - Deleted

C:\WINDOWS\uninstall_nmon.vbs - Deleted

Could Not Remove C:\Program Files\Trend Micro

Folder C:\Program Files\rhc9opj0ej0g - Removed

Folder C:\Documents and Settings\Propri‚taire\Application Data\rhc9opj0ej0g - Removed

Folder C:\Program Files\FBrowsingAdvisor - Removed

Folder C:\Program Files\Network Monitor - Removed

Folder C:\Program Files\RichVideoCodec - Removed

Folder C:\Program Files\SunPorn - Removed

Folder C:\Documents and Settings\LocalService\Application Data\NetMon - Removed

Folder C:\Temp\1cb - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-15 18:58:22

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\Propriétaire\Local Settings\Application Data\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : Boit@Look.lnk 1087 bytes hidden from API

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 1

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"

"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\Home Cinema\\PowerCinema\\PowerCinema.exe"="C:\\Program Files\\Home Cinema\\PowerCinema\\PowerCinema.exe:*:Enabled:PowerCinema"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"

"C:\\Program Files\\Cossacks - Back To War\\DMCR.EXE"="C:\\Program Files\\Cossacks - Back To War\\DMCR.EXE:*:Enabled:dmcr"

"C:\\Program Files\\Cossacks 2 - Battle for Europe\\Run\\Data\\engine.exe"="C:\\Program Files\\Cossacks 2 - Battle for Europe\\Run\\Data\\engine.exe:*:Enabled:Cossacks 2 - Battle for Europe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :

C:\Program Files\Trend Micro Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 3 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Fri 13 Aug 2004 1,953,792 ...HR --- "C:\Program Files\Microsoft Works Suite 2005\Setup\launcher.exe"

Fri 13 Aug 2004 53,760 ...HR --- "C:\Program Files\Microsoft Works Suite 2005\Setup\mnyinsta.dll"

Fri 13 Aug 2004 94,208 ...HR --- "C:\Program Files\Microsoft Works Suite 2005\Setup\RmvSuite.exe"

Mon 16 Aug 2004 35,328 ...HR --- "C:\Program Files\Microsoft Works Suite 2005\Setup\setuplng.dll"

Fri 13 Aug 2004 20,480 ...HR --- "C:\Program Files\Microsoft Works Suite 2005\Setup\unregwtr.exe"

Sat 29 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Fri 15 Aug 2008 108 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"

Wed 16 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT64.tmp"

Wed 16 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\download\BIT65.tmp"

Wed 4 Apr 2001 28,738 A..HR --- "C:\Documents and Settings\Propri‚taire\Bureau\Chanson … t‚l‚charger ! !\Microsoft Office XP PRO (word, excel, powerpoint, outlook, access, frontpage, Publisher 2007\MSDE2000\SQLRESLD.DLL"

Wed 4 Apr 2001 28,738 A..HR --- "C:\Documents and Settings\Propri‚taire\Bureau\Fabian\Webcam\MSDE2000\SQLRESLD.DLL"

Wed 4 Apr 2001 28,738 A..HR --- "C:\Documents and Settings\Propri‚taire\Bureau\Chanson … t‚l‚charger ! !\1111\Microsoft Office XP PRO 2007 (word, excel, powerpoint, outlook, access, frontpage)\MSDE2000\SQLRESLD.DLL"

Finished!

et l'autre :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:20:10, on 15/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe

D:\Program Files\HP\HP Software Update\HPWuSchd.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\Dit.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe

C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

C:\Program Files\Creative\Shared Files\CAMTRAY.EXE

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Trend Micro\TrendSecure\RemoteFileLock\FLMain.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe

C:\Program Files\ENJOY Plus!\ENJOY Plus!.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\WINDOWS\System32\Rundll32.exe

C:\Program Files\Java\jre1.5.0_12\bin\jucheck.exe

C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe