spyware (MS)antivirus 2008/virus alert ! Besoin d'aide urgent

nico327 · le 7 septembre 2008

bonjour à tous, je suis nouveau sur ce site que j'ai découvert sur le net en cherchant une solution à mo problème.Le voici:

Comme beaucoup, je pense avoir attrapé un spyware/virus sur mon ordi !

J'ai la petite icone VIRUS ALERT ! en bas à côté de l'horloge, un "programme" qui se nomme ANTIVIRUS 2008 s'est installé et je n'ai plus accès à de nombreux programmes du menu démarrer. je n'ai également plus accès à mon gestionnaire des tâches.

j'ai cru comprendre que la première étape était le rapport HijackThis et son analyse donc je poste ici mon premier rapport .Merci de bien vouloir m'expliquer étape par étape (vu que j'ai cru comprendre que chaque ordinateur infecté avait sa propre solution)! J'ai besoin de vous ! Merci d'avance !

je précise qu'il plante souvent et je perd donc le contrôle de l'ordi.En plus j'ai le papier peint du bureau en "récupération active desktop".Et sachant que je n'ai pas accès au gestionnaire de tâche je pense que je ne pourrais pas m'assurer à 100% que tous les programmes soient correctement fermer si il y a lieu de le faire dans les prochaines étapes.

Merci pour votre aide rapide.

voici le rapport :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:43:54, on 07/09/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.exe

C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

C:\WINDOWS\services.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Acer\Empowering Technology\eLock\LockServ.exe

C:\WINDOWS\system32\lxddcoms.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\PROGRA~1\LAUNCH~1\LManager.exe

C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

C:\WINDOWS\BUtilityBar\BisonBar.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Lexmark 2500 Series\lxddmon.exe

C:\Program Files\Lexmark 2500 Series\lxddamon.exe

C:\Program Files\MSA\MSA.exe

C:\WINDOWS\system32\svchost.exe

C:\Windows\system32\YUR126.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\FinePixViewerS\QuickDCF2.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\DOCUME~1\Philippe\LOCALS~1\Temp\RtkBtMnt.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\WINDOWS\services.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:3128

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

O4 - HKLM\..\Run: [boot] C:\Acer\Empowering Technology\ePower\Boot.exe

O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe

O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

O4 - HKLM\..\Run: [bisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"

O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"

O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s

O4 - HKLM\..\Run: [ANTIVIRUS] C:\Program Files\MSA\MSA.exe

O4 - HKLM\..\Run: [\YUR25F.exe] C:\Windows\system32\YUR25F.exe

O4 - HKLM\..\Run: [\YUR110.exe] C:\Windows\system32\YUR110.exe

O4 - HKLM\..\Run: [\YUR117.exe] C:\Windows\system32\YUR117.exe

O4 - HKLM\..\Run: [\YUR126.exe] C:\Windows\system32\YUR126.exe

O4 - HKLM\..\Run: [d003f594] rundll32.exe "C:\WINDOWS\system32\omtqhfpm.dll",b

O4 - HKLM\..\Run: [\YUR13B.exe] C:\Windows\system32\YUR13B.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [\YUR110.exe] C:\Windows\system32\YUR110.exe

O4 - HKCU\..\Run: [\YUR117.exe] C:\Windows\system32\YUR117.exe

O4 - HKCU\..\Run: [\YUR126.exe] C:\Windows\system32\YUR126.exe

O4 - HKCU\..\Run: [\YUR13B.exe] C:\Windows\system32\YUR13B.exe

O4 - HKLM\..\Policies\Explorer\Run: [DirectX For Microsoft® Windows] C:\WINDOWS\system32\fservice.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Acer Empowering Technology.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Exif Launcher S.lnk = C:\Program Files\FinePixViewerS\QuickDCF2.exe

O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm

O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?f156991baca24e22beade2a60df2dc16

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?f156991baca24e22beade2a60df2dc16

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {91D4B4D5-E368-40AB-8F53-A37FA634B471} (Installer9Ctrl Class) - http://www2.tellmemorecampus.com/bin/tol9inst.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O20 - AppInit_DLLs: yjadso.dll

O21 - SSODL: dgksvbpn - {64B51759-A3C6-41D9-B71A-D7481D8CB1CF} - (no file)

O21 - SSODL: xrdwbfgn - {494CCC0C-8FB8-484D-B5A1-A9DA9EDBBE37} - C:\WINDOWS\xrdwbfgn.dll

O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.exe

O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe

O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--

End of file - 14989 bytes

Falkra · le 7 septembre 2008

Bonsoir, je confirme de multiples saletés.

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

***Si le lien ne fonctionne pas, essaie celui-ci : http://download.bleepingcomputer.com/andymanchesta/SDFix.exe ***

Double clique sur SDFix.exe et choisis Install pour l'extraire à la racine de C:\. (cela donne C:\SDfix).

:!: Imprime ou note ce qui suit, tu n'auras pas accès à internet.

Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

Redémarre ton ordinateur.
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde suffit).
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Suis la liste des instructions ci-dessous :

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
Appuie sur Y pour commencer le nettoyage.
SDFix va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

Si SDfix ne se lance pas (ça arrive!)

* Démarrer->Exécuter
* Copie/colle ceci:
%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe
* Clique sur ok, et valide.
* Redémarre et essaye de nouveau de lancer SDfix.

nico327 · le 7 septembre 2008

Merci pour ce début d'aide.J'ai donc installé sdfix comme prévu , démarer en mode sans échec lancé SDFix , puis y, et par contre SDFix a signalé qu'il devait redémarer le pc afin de libérer un trojan de la mémoire ou et qu'il fallait revenir après en mode sans échec pour relancé sdfix, j'ai donc cliqué sur ok, l'ordi a redémaré et j'ai relancé sdfix, l'analyse a débuté :

starting repairs

checking running processes and services

_

pendant les 5 premières minutes le disque dur semblait travailler et là depuis 5min plus rien, en gros j'attends depuis 10min sans rien de nouveau, j'ai l'impression que SDfix est bloqué malgré le tiret a la ligne qui cligonte!.

Merci de m'aider à débloquer cette situation.(je précise que je surfe avec un 2em ordi pendant ce temps).

nico327 · le 7 septembre 2008

bon, j'ai finalement retenté un SDfix en mode sans echec au bout de 20min sans rien dans le premier essaie et cette fois ci , ça c'est excatement déroulé comme décrit dans la procédure , je poste donc le fichier report.txt et le nouveau log Hijackthis !

le fichier report.txt

SDFix: Version 1.222

Run by Philippe on 08/09/2008 at 00:16

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Checking Services :

Rootkit:

C:\WINDOWS\system32\drivers\tdssserv.sys - Rootkit.Win32.Agent.cku

Name :

tdssserv

Path :

\systemroot\system32\drivers\TDSSserv.sys

tdssserv - Deleted

Restoring Default Security Values

Restoring Default Hosts File

Restoring Default HomePage Value

Restoring Default Desktop Components Value

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"aux1"="wdmaud.drv"

Restoring aux1 registry value to wdmaud.drv

Rebooting

Checking Files :

Trojan Files Found:

C:\autorun.inf - Deleted

C:\WINDOWS\privacy_danger\index.htm - Deleted

C:\WINDOWS\privacy_danger\images\capt.gif - Deleted

C:\WINDOWS\privacy_danger\images\danger.jpg - Deleted

C:\WINDOWS\privacy_danger\images\down.gif - Deleted

C:\WINDOWS\privacy_danger\images\spacer.gif - Deleted

C:\Program Files\PCHealthCenter\0.exe - Deleted

C:\Program Files\PCHealthCenter\0.gif - Deleted

C:\Program Files\PCHealthCenter\1.exe - Deleted

C:\Program Files\PCHealthCenter\1.gif - Deleted

C:\Program Files\PCHealthCenter\1.ico - Deleted

C:\Program Files\PCHealthCenter\2.exe - Deleted

C:\Program Files\PCHealthCenter\2.gif - Deleted

C:\Program Files\PCHealthCenter\2.ico - Deleted

C:\Program Files\PCHealthCenter\3.exe - Deleted

C:\Program Files\PCHealthCenter\3.gif - Deleted

C:\Program Files\PCHealthCenter\4.exe - Deleted

C:\Program Files\PCHealthCenter\5.exe - Deleted

C:\Program Files\PCHealthCenter\7.exe - Deleted

C:\Program Files\PCHealthCenter\sc.html - Deleted

C:\WINDOWS\vanwxemgkpv.dll - Deleted

C:\Program Files\MSA\msa0.dat - Deleted

C:\Program Files\MSA\msa1.dat - Deleted

C:\Program Files\MSA\MSA.cpl - Deleted

C:\Program Files\MSA\MSA.exe - Deleted

C:\Documents and Settings\Philippe\Application Data\TmpRecentIcons\MS Antivirus.lnk - Deleted

C:\WINDOWS\ktd32.atm - Deleted

C:\WINDOWS\rasqervy.dll - Deleted

C:\WINDOWS\sdfinacs.dll - Deleted

C:\WINDOWS\sdfixwcs.dll - Deleted

C:\WINDOWS\services.exe - Deleted

C:\WINDOWS\sxmaokgf.exe - Deleted

C:\WINDOWS\system\sservice.exe - Deleted

C:\WINDOWS\system32\1.ico - Deleted

C:\WINDOWS\system32\2.ico - Deleted

C:\WINDOWS\system32\fservice.exe - Deleted

C:\WINDOWS\system32\MSA.cpl - Deleted

C:\WINDOWS\system32\reginv.dll - Deleted

C:\WINDOWS\system32\winkey.dll - Deleted

C:\WINDOWS\wuasirvy.dll - Deleted

C:\WINDOWS\xrdwbfgn.dll - Deleted

C:\WINDOWS\system32\33755453211.CPX - Deleted

C:\WINDOWS\system32\337554532112.CPX - Deleted

C:\WINDOWS\system32\337554532121.CPX - Deleted

C:\WINDOWS\system32\337554532131.CPX - Deleted

C:\WINDOWS\system32\337554532151.CPX - Deleted

C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted

C:\WINDOWS\system32\tdssadw.dll - Deleted

C:\WINDOWS\system32\tdssinit.dll - Deleted

C:\WINDOWS\system32\tdssl.dll - Deleted

C:\WINDOWS\system32\tdsslog.dll - Deleted

C:\WINDOWS\system32\tdssmain.dll - Deleted

C:\WINDOWS\system32\tdssserf.dll - Deleted

C:\WINDOWS\system32\tdssservers.dat - Deleted

Folder C:\Program Files\PCHealthCenter - Removed

Folder C:\WINDOWS\privacy_danger - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-08 00:25:44

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]

"start"=dword:00000001

"type"=dword:00000001

"imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{651A82BD-082F-73B5-105E-DFE40D695A38}]

"nagfmiodablckncaiiicfnaanfgj"=hex:6b,61,62,67,6b,67,6e,63,63,66,69,6c,6c,6e,62,62,6b,6b,6a,69,70,..

"mamgchmgjdkgjdpcbdaagbapfo"=hex:6b,61,62,67,6b,67,6e,63,63,66,69,6c,6c,6e,62,62,6b,6b,6a,69,70,..

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\PROGRA~1\\boba\\boba2\\PODCAS~1.EXE"="C:\\PROGRA~1\\boba\\boba2\\PODCAS~1.EXE:*:Enabled:Share Streaming"

"C:\\Program Files\\boba\\boba2\\PodcastBar.exe"="C:\\Program Files\\boba\\boba2\\PodcastBar.exe:*:Enabled:Share Streaming"

"C:\\Program Files\\BitLord\\BitLord.exe"="C:\\Program Files\\BitLord\\BitLord.exe:*:Disabled:BitLord"

"C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"="C:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe:*:Enabled: "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Program Files\\Lexmark 2500 Series\\app4r.exe"="C:\\Program Files\\Lexmark 2500 Series\\App4R.exe:*:Enabled:Lexmark Imaging Studio"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 10 Aug 2004 16,384 ..SHR --- "C:\1weicxa.com"

Tue 10 Aug 2004 16,384 ..SHR --- "C:\80avp08.com"

Tue 11 Mar 2008 103,034 ..SHR --- "C:\b.com"

Fri 11 Jan 2008 107,309 ..SHR --- "C:\d.com"

Sat 29 Mar 2008 103,953 ..SHR --- "C:\gjn2pjlw.exe"

Wed 5 Mar 2008 107,146 ..SHR --- "C:\i.exe"

Sat 19 Jan 2008 106,956 ..SHR --- "C:\m1t8ta.com"

Tue 10 Aug 2004 16,384 ..SHR --- "C:\n1deiect.com"

Fri 7 Dec 2007 125,329 ..SHR --- "C:\nideiect.com"

Tue 4 Dec 2007 99,050 ..SHR --- "C:\ntde1ect.com"

Mon 25 Feb 2008 107,959 ..SHR --- "C:\oufddh.exe"

Tue 10 Aug 2004 16,384 ..SHR --- "C:\q.com"

Fri 4 Apr 2008 103,037 ..SHR --- "C:\ranvrgn.exe"

Mon 31 Mar 2008 103,624 ..SHR --- "C:\rthrw.com"

Sat 5 Jan 2008 104,595 ..SHR --- "C:\semo2x.exe"

Sun 6 Apr 2008 103,966 ..SHR --- "C:\t.com"

Tue 10 Aug 2004 16,384 ..SHR --- "C:\uisvkqr.exe"

Thu 14 Feb 2008 102,211 ..SHR --- "C:\x.com"

Sat 29 Dec 2007 104,507 ..SHR --- "C:\xfoolavp.com"

Sat 19 Jan 2008 106,956 ..SHR --- "C:\xn1i9x.com"

Thu 6 Mar 2008 106,068 ..SHR --- "C:\xpbkh.com"

Thu 3 Apr 2008 103,556 ..SHR --- "C:\xyw9tmdj.com"

Mon 3 Mar 2008 106,476 ..SHR --- "C:\y82td3td.com"

Mon 28 Jan 2008 104,734 ..SHR --- "C:\ylr.exe"

Fri 14 Mar 2008 101,025 ..SHR --- "C:\yo2mq6.exe"

Sun 6 Apr 2008 103,966 ..SHR --- "C:\WINDOWS\system32\amvo.exe"

Mon 8 Sep 2008 70,656 ..SHR --- "C:\WINDOWS\system32\amvo0.dll"

Sun 6 Apr 2008 70,656 ..SHR --- "C:\WINDOWS\system32\amvo1.dll"

Tue 4 Dec 2007 32,732 ..SHR --- "C:\WINDOWS\system32\avpo1.dll"

Wed 30 Aug 2006 1,024 A..HR --- "C:\WINDOWS\system32\NTIBUN4.dll"

Wed 30 Aug 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"

Wed 30 Aug 2006 1,024 A..HR --- "C:\WINDOWS\system32\NTIFCD3.dll"

Wed 30 Aug 2006 1,024 A..HR --- "C:\WINDOWS\system32\NTIMP3.dll"

Wed 30 Aug 2006 1,024 A..HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"

Sun 8 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Thu 14 Dec 2006 9,506 A.SH. --- "C:\Documents and Settings\Philippe\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

Tue 2 Sep 2008 864,256 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL0136.tmp"

Wed 3 Sep 2008 5,926,912 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL1161.tmp"

Wed 3 Sep 2008 942,080 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL1566.tmp"

Wed 3 Sep 2008 5,926,400 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL1843.tmp"

Tue 2 Sep 2008 865,792 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL2196.tmp"

Tue 2 Sep 2008 5,254,656 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL2264.tmp"

Wed 3 Sep 2008 939,520 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL2399.tmp"

Wed 3 Sep 2008 940,544 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\G‚n‚rale\documents\~WRL3999.tmp"

Mon 14 Apr 2008 159,232 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL0132.tmp"

Tue 15 Apr 2008 308,224 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL0249.tmp"

Tue 15 Apr 2008 4,692,992 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL0948.tmp"

Tue 15 Apr 2008 226,816 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL0974.tmp"

Mon 14 Apr 2008 157,696 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL1250.tmp"

Sat 22 Mar 2008 149,504 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL1298.tmp"

Tue 15 Apr 2008 229,888 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL1323.tmp"

Tue 15 Apr 2008 4,862,464 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL1344.tmp"

Tue 15 Apr 2008 3,005,952 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL1402.tmp"

Tue 15 Apr 2008 651,776 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL1885.tmp"

Mon 14 Apr 2008 197,120 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL1980.tmp"

Tue 15 Apr 2008 275,968 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL2108.tmp"

Tue 15 Apr 2008 255,488 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL2552.tmp"

Tue 15 Apr 2008 1,615,360 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL2748.tmp"

Tue 15 Apr 2008 1,615,872 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL3043.tmp"

Tue 15 Apr 2008 4,692,992 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL3298.tmp"

Tue 15 Apr 2008 4,692,992 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL3349.tmp"

Tue 15 Apr 2008 255,488 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL3745.tmp"

Tue 15 Apr 2008 269,312 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\CAO\~WRL3871.tmp"

Sat 29 Mar 2008 6,900,224 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0075.tmp"

Sat 29 Mar 2008 148,992 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0109.tmp"

Sat 29 Mar 2008 6,899,712 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0177.tmp"

Sat 29 Mar 2008 6,707,712 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0350.tmp"

Sat 29 Mar 2008 7,526,912 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0417.tmp"

Sat 29 Mar 2008 2,665,472 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0589.tmp"

Sat 29 Mar 2008 116,224 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0818.tmp"

Sat 29 Mar 2008 151,552 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0836.tmp"

Sat 29 Mar 2008 118,272 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL0883.tmp"

Sat 29 Mar 2008 115,200 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1045.tmp"

Sat 29 Mar 2008 145,920 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1101.tmp"

Sat 29 Mar 2008 6,898,688 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1147.tmp"

Sat 29 Mar 2008 128,000 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1187.tmp"

Sat 29 Mar 2008 125,952 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1196.tmp"

Sat 29 Mar 2008 145,920 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1237.tmp"

Sat 29 Mar 2008 5,646,336 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1256.tmp"

Sat 29 Mar 2008 146,944 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1420.tmp"

Sat 29 Mar 2008 129,536 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1493.tmp"

Sat 29 Mar 2008 145,920 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1496.tmp"

Sat 29 Mar 2008 118,272 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1695.tmp"

Sat 29 Mar 2008 6,899,712 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1699.tmp"

Sat 29 Mar 2008 118,272 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1885.tmp"

Sat 29 Mar 2008 135,168 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1922.tmp"

Sat 29 Mar 2008 146,432 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1940.tmp"

Sat 29 Mar 2008 132,608 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL1958.tmp"

Sat 29 Mar 2008 7,528,448 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2154.tmp"

Sat 29 Mar 2008 152,064 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2244.tmp"

Sat 29 Mar 2008 6,709,760 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2327.tmp"

Sat 29 Mar 2008 119,808 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2541.tmp"

Sat 29 Mar 2008 6,897,664 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2596.tmp"

Sat 29 Mar 2008 7,364,096 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2676.tmp"

Sat 29 Mar 2008 6,896,640 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2714.tmp"

Sat 29 Mar 2008 7,526,912 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2755.tmp"

Sat 29 Mar 2008 809,984 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2812.tmp"

Sat 29 Mar 2008 571,904 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2924.tmp"

Sat 29 Mar 2008 126,464 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL2984.tmp"

Sat 29 Mar 2008 139,264 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3081.tmp"

Sat 29 Mar 2008 3,286,528 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3223.tmp"

Sat 29 Mar 2008 121,344 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3234.tmp"

Sat 29 Mar 2008 3,943,424 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3235.tmp"

Sat 29 Mar 2008 7,527,936 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3247.tmp"

Sat 29 Mar 2008 118,272 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3266.tmp"

Sat 29 Mar 2008 6,707,200 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3307.tmp"

Sat 29 Mar 2008 6,897,664 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3381.tmp"

Sat 29 Mar 2008 6,269,440 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3388.tmp"

Sat 29 Mar 2008 115,200 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3467.tmp"

Sat 29 Mar 2008 7,346,688 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3693.tmp"

Sat 29 Mar 2008 133,120 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3696.tmp"

Sat 29 Mar 2008 7,346,176 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3712.tmp"

Sat 29 Mar 2008 115,712 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3722.tmp"

Sat 29 Mar 2008 152,576 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3799.tmp"

Sat 29 Mar 2008 7,526,912 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3841.tmp"

Sat 29 Mar 2008 122,880 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3887.tmp"

Sat 29 Mar 2008 125,952 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL3977.tmp"

Sat 29 Mar 2008 6,898,688 ...H. --- "C:\Documents and Settings\Philippe\Mes documents\Formation Ing‚\Microelectronique\Stage_Rennes\~WRL4029.tmp"

Finished!

et le nouveau log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:30:36, on 08/09/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.exe

C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Acer\Empowering Technology\eLock\LockServ.exe

C:\WINDOWS\system32\lxddcoms.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\notepad.exe