probleme avec iworm_attac_v122.02a

elmaximo17 · le 14 juillet 2006

J'ai un probleme : depuis hier, un message s'affiche a coté de l'heure et me dit que mon pc est infecté par "the last version of internet trojan", et des pop-up s'affichent...

J'ai suivi a la lettre les instructions présentes a la page :

http://forum.zebulon.fr/index.php?showtopic=83986

Donc j'ai fait un scan avec hijackthis, et j'aimerais bien savoir ce que je dois faire maintenant...

S'il vous plaït, est-ce que quelqu'un peut m'aider ?

voici les résultats du scan...

Logfile of HijackThis v1.99.1

Scan saved at 18:55:15, on 14/07/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Acer\Acer eConsole\MediaServerService.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\system32\isnotify.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Acer\Acer eMode Management\AspireService.exe

C:\Program Files\Acer\Acer eConsole\MediaSync.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\PROGRA~1\WANADOO\TaskBarIcon.exe

C:\Program Files\MessengerPlus! 3\MsgPlus.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Acer\Empowering Technology\eRecovery\Monitor.exe

C:\Program Files\Fichiers communs\{320D180E-0710-1036-1028-050914050021}\Update.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN

C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchIndexer.exe

C:\Program Files\Hijackthis Version Française\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL

R3 - URLSearchHook: (no name) - {8A2D3D7B-AFBC-FB35-CB39-8CBADB664F91} - C:\WINDOWS\system32\gbrzpmzo.dll (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt0.dll (file missing)

O2 - BHO: (no name) - {8A2D3D7B-AFBC-FB35-CB39-8CBADB664F91} - C:\WINDOWS\system32\gbrzpmzo.dll (file missing)

O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll

O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe

O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe

O4 - HKLM\..\Run: [EPSON Stylus Photo RX520 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P31 "EPSON Stylus Photo RX520 Series" /O6 "USB001" /M "Stylus Photo RX520"

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [LaunchApp] Alaunch

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\WANADOO\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [Nphb] "C:\DOCUME~1\famille\APPLIC~1\STEM32~1\winspool.exe" -vt yax

O4 - HKCU\..\Run: [Eurpnxlz] C:\Documents and Settings\famille\Mes documents\W?nSxS\l?ass.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?

O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe

O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm

O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZNxmk546YYFR

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?e9e4dcad611c45b89fc4d2bee89ffed

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?e9e4dcad611c45b89fc4d2bee89ffed

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe

O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: winword.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)

O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\system32\pmnqguh.dll (file missing)

O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Merci d'avance...

Modifié le 14 juillet 2006 par elmaximo17

Malekal_morte · le 14 juillet 2006

Bonjour,

-- Télécharge SmitfraudFix

-- Fais un clic droit puis Extraire tout sur le fichier SmitfraudFix.zip, cela va tout décompresser dans un nouveau dossier SmitFraudfix

-- Ouvre le dossier SmitfraudFix double clic sur SmitfraudFix.cmd (ne

clique sur aucun autre fichier!!!)

-- Choisis l'option 1 et appuie sur Entrée

-- Réponds o (Oui) aux deux questions suivantes si elles sont posées

-- Un rapport sera généré sauvegarde le dans un dossier

-- Copie/colle le contenu du rapport ici

elmaximo17 · le 14 juillet 2006

tiens je crois que c'est ce raport que tu veux...

merci de voulir m'aider.

SmitFraudFix v2.70

Rapport fait à 20:01:48,12, 14/07/2006

Executé à partir de C:\Documents and Settings\famille\Bureau\SmitfraudFix\SmitfraudFix

OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT

Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\isnotify.exe PRESENT !

C:\WINDOWS\system32\ot.ico PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\famille\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\famille\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

"Source"="About:Home"

"SubscribedURL"="About:Home"

"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Malekal_morte · le 14 juillet 2006

OK.

Tu as deux Antivirus : Avast & Norton ?

C'est pas bon du tout.

Merci d'en désinstaller un pour n'en avoir qu'un seul, je te fais suivre les manips.

Voici la manipulation à effectuer en entier

Si certains éléments ne sont pas trouvés, merci de le signaler mais de poursuivre les manipulations jusqu'au bout.

Dans ajout/suppression de programme du panneau de configuration, désinstalle si présent :

My Web Search

Sur HijackThis, refais un scan et coches les lignes suivantes :

R3 - URLSearchHook: (no name) - {8A2D3D7B-AFBC-FB35-CB39-8CBADB664F91} - C:\WINDOWS\system32\gbrzpmzo.dll (file missing)

O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt0.dll (file missing)

O2 - BHO: (no name) - {8A2D3D7B-AFBC-FB35-CB39-8CBADB664F91} - C:\WINDOWS\system32\gbrzpmzo.dll (file missing)

O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)

O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S

O4 - HKCU\..\Run: [Nphb] "C:\DOCUME~1\famille\APPLIC~1\STEM32~1\winspool.exe" -vt yax

O4 - HKCU\..\Run: [Eurpnxlz] C:\Documents and Settings\famille\Mes documents\W?nSxS\l?ass.exe

O20 - AppInit_DLLs: winword.dll

O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)

O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\system32\pmnqguh.dll (file missing)

---> puis clic sur le bouton "Fix Checked"

n'hésite pas à consulter l'aide HijackThis

- Télécharge et installe ewido

- Mets le à jour à partir du menu update en haut, n'hésite pas à consulter l'Aide ewido pour tout problème.

- Télécharge clean.zip, décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.

-- Redémarre en mode en mode sans échec, si tu sais pas comment on fait lis ceci

-- Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laisse la ouverte.

Ouvre le poste de travail pour naviguer dans tes dossiers et supprime :

C:\Documents and Settings\famille\Mes documents\W?nSxS\

C:\Documents and Settings\famille\APPLICATIONS DATA\STEM32~1\

C:\PROGRAM FILES\MYWEBS~1\

C:\Windows\system32\winword.dll

-- Ouvre le dossier SmitfraudFix double clic sur SmitfraudFix.cmd (ne

clique sur aucun autre fichier!!!)

-- Choisis l'option 2 et appuie sur Entrée

-- Réponds o (Oui) aux deux questions suivantes si elles sont posées

-- Un rapport sera généré sauvegarde le dans un dossier,

- Ouvre ewido et clic sur l'onglet Scanner en haut

- Démarre ewido et clique "Complete System Scan"

** Si un fichier est infecté, choisis l'option " Apply All Actions " en fin d'analyse **

Clique sur " Save Report " puis sur " Save Report As "

Enregistre ce fichier texte sur ton bureau.

N'hésite pas à consulter l'Aide ewido pour tout problème.

-- Redémarre en mode normal : Menu Démarrer / Arreter / Redémarre l'ordinateur

Attention : dans le cas où l'ordinateur redémarre en boucle en mode sans échec, faire la manipulation inverse en décochant l'option /SAFEBOOT à l'aide de msconfig : voir à nouveau cette page : cliquez-ici

-- Fais un scan en ligne avec Internet Explorer : Scan Kaspersky et colle le rapport ici. Si tu es perdu, tu peux suivre cette aide pour les scans en ligne

-- Copie/Colle ici les rapports :

- ewido

- SmitFraudFix

- le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt

- ainsi qu'un nouveau log HijackThis

elmaximo17 · le 16 juillet 2006

ça y est, j'ai enfin pu faire tout ce que tu m'as demandé, j'ai suivi tes instructions a la lettre :

Voici donc tous les rapports que tu me demandes, bonne lecture et encore merci de ton aide...

Tout d'abord, le rapport du scan en ligne de kaspersky :

KASPERSKY ONLINE SCANNER REPORT

Sunday, July 16, 2006 5:35:16 PM

Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 16/07/2006

Kaspersky Anti-Virus database records: 195297

Scan Settings

Scan using the following antivirus database standard

Scan Archives true

Scan Mail Bases true

Scan Target My Computer

C:\

D:\

E:\

F:\

G:\

H:\

I:\

J:\

Scan Statistics

Total number of scanned objects 85755

Number of viruses found 4

Number of infected objects 6 / 0

Number of suspicious objects 0

Duration of the scan process 00:31:09

Infected Object Name Virus Name Last Action

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\drivers\sptd9341.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\drivers\vaxscsi.sys Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\temp\JETA558.tmp Object is locked skipped

C:\WINDOWS\temp\Perflib_Perfdata_47c.dat Object is locked skipped

C:\WINDOWS\temp\_avast4_\Webshlock.txt Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-07142006-105138.log Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\famille\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\famille\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Temp\JETA558.tmp Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Historique\History.IE5\MSHist012006071620060717\index.dat Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\GatherLogs\MyIndex\MyIndex.57.gthr Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\GatherLogs\MyIndex\MyIndex.57.Crwl Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Ntfy20.gthr Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\NlFiles\CiST0000.000 Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\NlFiles\DocId.Map Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\CiPT0000.000 Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\INDEX.000 Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\00010001.ci Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.chk2.gthr Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.chk1.gthr Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Idm.gthr Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.Dir Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.idx Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h0.Dir Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h0 Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h1.Dir Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h1 Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h3 Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4A.Dir Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4A Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4B.Dir Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4B Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\tmp.edb Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\MSStmp.log Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\MSS.log Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\RSApp.edb Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Logs\MAPI.txt Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Temp\rssgthrsvc\Ntf2.tmp Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Temp\rssgthrsvc\Ntf3.tmp Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Microsoft\Desktop Search\Temp\rssgthrsvc\Perflib_Perfdata_84c.dat Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\famille\Local Settings\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\famille\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cert8.db Object is locked skipped

C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\key3.db Object is locked skipped

C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\parent.lock Object is locked skipped

C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\history.dat Object is locked skipped

C:\Program Files\Acer\Acer eConsole\AcerDB.mdb Object is locked skipped

C:\Program Files\Acer\Acer eConsole\AcerDB.ldb Object is locked skipped

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2006-07-16.16-16-01.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\report\Protection résidente.txt Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP169\A0023435.exe Infected: Trojan-Downloader.Win32.PurityScan.co skipped

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP169\A0023437.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP169\A0023440.exe Infected: Trojan-Downloader.Win32.PurityScan.cr skipped

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP169\A0023441.exe/data0006 Infected: Trojan-Dropper.Win32.VB.nn skipped

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP169\A0023441.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP169\A0023441.exe CryptFF: infected - 1 skipped

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP179\change.log Object is locked skipped

Scan process completed.

Voici ensuit le rapport de ewido :

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 16:13:15 16/07/2006

+ Scan result:

C:\WINDOWS\YAXUninst.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).

C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll -> Adware.Softomate : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP156\A0020570.dll -> Adware.Softomate : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP166\A0022756.exe -> Adware.Websearch : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP166\A0022730.DLL -> Downloader.IstBar : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP179\A0024081.exe -> Downloader.Zlob.yt : Cleaned with backup (quarantined).

:mozilla.40:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.41:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.42:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.35:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.

:mozilla.23:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.

C:\Documents and Settings\famille\Cookies\famille@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.

:mozilla.32:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.

:mozilla.29:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.30:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.33:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.

C:\Documents and Settings\famille\Cookies\famille@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.

:mozilla.34:C:\Documents and Settings\famille\Application Data\Mozilla\Firefox\Profiles\9b2xv38m.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.

C:\Documents and Settings\famille\Cookies\famille@weborama[2].txt -> TrackingCookie.Weborama : Cleaned.

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP178\A0023811.DLL -> Trojan.Mezzia : Cleaned with backup (quarantined).

C:\System Volume Information\_restore{18120FB7-1173-47C3-9BCD-321152D5F4E4}\RP179\A0024158.exe -> Trojan.Starter.65 : Cleaned with backup (quarantined).

::Report end

Puis le rapport de SmitfraudFix :

SmitFraudFix v2.70

Rapport fait à 15:39:32,10, 16/07/2006

Executé à partir de C:\Documents and Settings\famille\Bureau\SmitfraudFix\SmitfraudFix

OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT

Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix

!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix

!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Le rapport clean :

Script clean par Malekal_morte - http://www.malekal.com

*** SUPPRESSION DES FICHIERS

*** Suppressions de trojans/vers sur...

C:\WINDOWS\inf\unregmp2.exe FOUND

C:\WINDOWS\unvise32qt.exe FOUND

C:\WINDOWS\system32\isnotify.exe FOUND

C:\WINDOWS\system32\ot.ico FOUND

C:\WINDOWS\system32\SpoonUninstall.exe FOUND

*** Suppressions des adware connus...

C:\WINDOWS\system32\wnsapisv.exe FOUND

"C:\Program Files\Fichiers communs\*.exe" FOUND

"C:\Program Files\Boonty\" FOUND

"C:\Program Files\BoontyGames\" FOUND

Et pour finir, le nouveau log hijackthis :

Logfile of HijackThis v1.99.1

Scan saved at 17:45:32, on 16/07/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Acer\Acer eMode Management\AspireService.exe

C:\Program Files\Acer\Acer eConsole\MediaSync.exe

C:\Program Files\Acer\Acer eConsole\MediaServerService.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\Program Files\MessengerPlus! 3\MsgPlus.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\PROGRA~1\WANADOO\TaskBarIcon.exe

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\Program Files\Messenger\msmsgs.exe

C:\PROGRA~1\WANADOO\EspaceWanadoo.exe

C:\Acer\Empowering Technology\eRecovery\Monitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\Program Files\OpenOffice.org 2.0\program\soffice.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN

C:\WINDOWS\System32\FTRTSVC.exe

C:\PROGRA~1\WANADOO\ComComp.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\PROGRA~1\WANADOO\Toaster.exe

C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchIndexer.exe

C:\PROGRA~1\WANADOO\Inactivity.exe

C:\PROGRA~1\WANADOO\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\PROGRA~1\WANADOO\Watch.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Mozilla Firefox 2 Beta 1\firefox.exe