Trojan Pandex

bezulon · le 28 septembre 2008

Bonjour,

Mon antivirus Norton me signale la présence du Trojan Pandex sur mon PC XP media, kerio firewall

mais n'arrive point à le supprimer

chrifleur · le 28 septembre 2008

bonjour et bienvenue

donne le chemin et le nom du fichier infecté stp

poste un rapport hijack this

Modifié le 28 septembre 2008 par chrifleur

bezulon · le 28 septembre 2008

_Risque _Nom du fichier Emplacement d'origine Date

Bloodhound.Exploit.109 plugin-mov.qt C:\Documents and Settings\Jean-Marc\Local Settings\Temp\plugtmp-1\ 26/09/2008 08:57:17

Trojan.Fakeavalert QUAR1.78924 C:\Documents and Settings\Jean-Marc\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\ 26/09/2008 09:44:42

Trojan.Giframe 4pe7jhv.gif C:\Documents and Settings\Jean-Marc\Mes documents\Mes images\Gifs\ 26/09/2008 09:49:55

Trojan.Pandex ati0akxx.sys C:\WINDOWS\system32\drivers\ 27/09/2008 15:53:59

Trojan.Pandex ati2gqxx.sys C:\WINDOWS\system32\drivers\ 28/09/2008 07:10:01

Trojan.Pandex ati3ckxx.sys C:\WINDOWS\system32\drivers\ 27/09/2008 16:29:32

Trojan.Pandex ati4ufxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 13:15:38

Trojan.Pandex ati4yjxx.sys C:\WINDOWS\system32\drivers\ 27/09/2008 01:47:41

Trojan.Pandex ati5akxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 11:52:16

Trojan.Pandex ati5cmxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 10:20:03

Trojan.Pandex ati5ilxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 09:14:22

Trojan.Pandex ati5kgxx.sys C:\WINDOWS\system32\drivers\ 27/09/2008 08:40:30

Trojan.Pandex ati5paxx.sys C:\WINDOWS\system32\drivers\ 27/09/2008 20:16:17

Trojan.Pandex ati6dyxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 08:57:32

Trojan.Pandex ati7adxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 13:52:25

Trojan.Pandex ati7fpxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 09:18:06

Trojan.Pandex ati7lvxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 09:07:49

Trojan.Pandex ati8ilxx.sys C:\WINDOWS\system32\drivers\ 27/09/2008 18:02:07

Trojan.Pandex ati8psxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 13:20:49

Trojan.Pandex ati8qkxx.sys C:\WINDOWS\system32\drivers\ 26/09/2008 09:11:51

Trojan.Pandex tcpsr.sys C:\WINDOWS\system32\drivers\ 28/09/2008 07:09:50

bezulon · le 28 septembre 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:39:17, on 28/09/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\_ Outils sécurité\Norton\DefWatch.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\_ Outils sécurité\Norton\Rtvscan.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\PROGRA~1\_OUTIL~1\Norton\VPTray.exe

C:\WINDOWS\System32\rs32net.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\_ Outils Media\Gaim\gaim.exe

C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe

C:\Program Files\_ Outils Média\Mozilla\Firefox\firefox.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Skype\Plugin Manager\SkypePM.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\_ Outils utilitaires\Office 2003\OFFICE11\WINWORD.EXE

C:\Program Files\_ Outils sécurité\Norton\vpc32.exe

C:\Program Files\_ Outils utilitaires\Office 2003\OFFICE11\EXCEL.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\_ Outils sécurité\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.myspace.com/index.cfm?fuseacti...a5-6d4799065d73

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\_ Outils utilitaires\Adobe Acrobat Reader\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\_OUTIL~1\Spybot\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\_OUTIL~1\Norton\VPTray.exe

O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Gaim] C:\Program Files\_ Outils Media\Gaim\gaim.exe

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe

O4 - Global Startup: HPZRCV01.LNK = C:\Program Files\HP\Temp\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzrcv01.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\_OUTIL~2\OFFICE~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\_ Outils utilitaires\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\_ Outils utilitaires\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\_OUTIL~2\OFFICE~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\_OUTIL~1\Spybot\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\_OUTIL~1\Spybot\SDHelper.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\_ Outils sécurité\Norton\DefWatch.exe

O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\_ Outils sécurité\Norton\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\_ Outils sécurité\Norton\Rtvscan.exe

--

End of file - 6869 bytes

chrifleur · le 28 septembre 2008

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

***Si le lien ne fonctionne pas, essaie celui-ci :

http://download.bleepingcomputer.com/andymanchesta/SDFix.exe ***

Double clique sur SDFix.exe et choisis Install. L'outil sera extrait à la racine du lecteur système (généralement le C:\).

Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

Redémarre ton ordinateur
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (F5 sur certains PC), une pression par seconde.
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Déroule la liste des instructions ci-dessous :

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Il est possible que l'outil demande un nouveau redémarrage en mode Sans Échec en début de routine, si une infection particulière est détectée; valide et tapote la touche F8 (ou F5) au redémarrage pour accéder aux options de démarrage.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

Modifié le 28 septembre 2008 par chrifleur

bezulon · le 28 septembre 2008

Voici report.txt

SDFix: Version 1.229

Run by Jean-Marc on 28/09/2008 at 11:05

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Checking Services :

Restoring Default Security Values

Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\Documents and Settings\Jean-Marc\Mes documents\My Documents.url - Deleted

C:\Documents and Settings\Jean-Marc\Mes documents\Ma musique\My Music.url - Deleted

C:\Documents and Settings\Jean-Marc\Mes documents\Mes images\My Pictures.url - Deleted

C:\WINDOWS\system32\rs32net.exe - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-28 11:21:49

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

IPC error: 2 Le fichier spécifié est introuvable.

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"

"C:\\Program Files\\ASC 2.1\\asc 2.1.exe"="C:\\Program Files\\ASC 2.1\\asc 2.1.exe:*:Enabled:AntiSpyCheck"

"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 2 Dec 2007 19,968 ...H. --- "C:\Documents and Settings\F‚licie\Mes documents\~WRL0003.tmp"

Sat 26 Jul 2008 2,446,848 ...H. --- "C:\Documents and Settings\Jean-Marc\Mes documents\~WRL1401.tmp"

Mon 14 Jan 2008 6,219,320 A..H. --- "C:\Program Files\_ Outils utilitaires\Picasa2\setup.exe"

Wed 18 Apr 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\_ Outils s‚curit‚\Spybot\Spybot - Search & Destroy\SDUpdate.exe"

Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\_ Outils s‚curit‚\Spybot\Spybot - Search & Destroy\SpybotSD.exe"

Mon 18 Aug 2008 1,832,272 A.SHR --- "C:\Program Files\_ Outils s‚curit‚\Spybot\Spybot - Search & Destroy\TeaTimer.exe"

Thu 6 Dec 2007 39,936 ...H. --- "C:\Documents and Settings\Jean-Marc\Application Data\Microsoft\Word\~WRL0530.tmp"

Thu 4 Sep 2008 56,832 ...H. --- "C:\Documents and Settings\Jean-Marc\Application Data\Microsoft\Word\~WRL1010.tmp"

Fri 21 Mar 2008 864,256 ...H. --- "C:\Documents and Settings\Jean-Marc\Application Data\Microsoft\Word\~WRL1650.tmp"

Sat 2 Jun 2007 51,200 ...H. --- "C:\Documents and Settings\Jean-Marc\Application Data\Microsoft\Word\~WRL1855.tmp"

Wed 26 Sep 2007 743,424 ...H. --- "C:\Documents and Settings\Jean-Marc\Application Data\Microsoft\Word\~WRL2316.tmp"

Fri 21 Mar 2008 934,400 ...H. --- "C:\Documents and Settings\Jean-Marc\Application Data\Microsoft\Word\~WRL2768.tmp"

Wed 26 Sep 2007 94,720 ...H. --- "C:\Documents and Settings\Jean-Marc\Application Data\Microsoft\Word\~WRL3218.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0005.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0082.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0147.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0381.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0450.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0612.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0797.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD0854.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD1115.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD1137.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD1362.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD1438.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD1580.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD1731.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD2182.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD2608.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD2616.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD2649.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD2688.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD2930.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3050.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3126.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3305.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3475.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3504.tmp"

Thu 4 Sep 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3731.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3751.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD3823.tmp"

Sat 26 Jul 2008 162 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~$RD4004.tmp"

Sat 26 Jul 2008 3,345,408 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD0082.tmp"

Sat 26 Jul 2008 2,717,184 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD0147.tmp"

Sat 26 Jul 2008 3,274,240 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD0450.tmp"

Sat 26 Jul 2008 2,914,816 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD0612.tmp"

Sat 26 Jul 2008 3,203,072 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD0797.tmp"

Sat 26 Jul 2008 2,991,104 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD0854.tmp"

Sat 26 Jul 2008 3,107,328 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD1115.tmp"

Sat 26 Jul 2008 3,132,416 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD1137.tmp"

Sat 26 Jul 2008 3,186,688 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD1362.tmp"

Sat 26 Jul 2008 3,061,248 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD1438.tmp"

Sat 26 Jul 2008 3,270,656 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD1580.tmp"

Sat 26 Jul 2008 2,990,592 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD1731.tmp"

Sat 26 Jul 2008 3,700,224 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD2182.tmp"

Sat 26 Jul 2008 28,756,992 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD2608.tmp"

Sat 26 Jul 2008 3,704,832 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD2649.tmp"

Sat 26 Jul 2008 2,004,992 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD2688.tmp"

Sat 26 Jul 2008 2,119,168 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD2930.tmp"

Sat 26 Jul 2008 3,558,400 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3050.tmp"

Sat 26 Jul 2008 2,220,032 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3126.tmp"

Sat 26 Jul 2008 2,301,952 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3305.tmp"

Sat 26 Jul 2008 3,482,112 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3475.tmp"

Sat 26 Jul 2008 2,413,056 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3504.tmp"

Thu 4 Sep 2008 385,536 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3731.tmp"

Sat 26 Jul 2008 2,524,672 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3751.tmp"

Sat 26 Jul 2008 3,416,576 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD3823.tmp"

Sat 26 Jul 2008 2,605,568 A..H. --- "C:\Documents and Settings\Jean-Marc\Local Settings\Temporary Internet Files\Content.Word\~WRD4004.tmp"

Thu 6 Dec 2007 421,888 A..H. --- "C:\Documents and Settings\Jean-Marc\Mes documents\Loisirs\Concerts\~WRL2788.tmp"

Tue 27 Nov 2007 147,456 ...H. --- "C:\Documents and Settings\Jean-Marc\Mes documents\_Job\CV\~WRL2528.tmp"

Thu 15 May 2008 37,376 A..H. --- "C:\Documents and Settings\Jean-Marc\Mes documents\_Job\JOB\~WRL0355.tmp"

Thu 15 May 2008 37,888 A..H. --- "C:\Documents and Settings\Jean-Marc\Mes documents\_Job\JOB\~WRL1586.tmp"

Thu 15 May 2008 37,888 A..H. --- "C:\Documents and Settings\Jean-Marc\Mes documents\_Job\JOB\~WRL2167.tmp"

Thu 15 May 2008 36,864 A..H. --- "C:\Documents and Settings\Jean-Marc\Mes documents\_Job\JOB\~WRL2890.tmp"

Finished!

bezulon · le 28 septembre 2008

le dernier Hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:38:09, on 28/09/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\_ Outils sécurité\Norton\DefWatch.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\_ Outils sécurité\Norton\Rtvscan.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\system32\notepad.exe