Virus qui bloque tout accès à internetFermé

Question

Bonjour,

J'utilisais l'ordi de ma fille pour lui télécharger un logiciel sur emule, j'ai lancé le setup.exe, puis une demi heure plus tard je n'ai plus accès à internet. J'ai entre temps installé un driver provenant du site officiel hp pour l'imprimante, et lors du redémarrage de l'ordi, plus moyen de se connecter, plus l'icône de son et j'en passe.

Je suis vraiment très gêné pour ma fille ... Je ne sais plus quoi faire.

Merci.

Destrio5 · Answer

Salut,

En un seul mot : BRAVO !

--> Télécharge FindyKill (par Chiquitine29) sur ton Bureau.

--> Lance l'installation avec les paramètres par défaut.

--> Double-clique sur le raccourci FindyKill sur ton Bureau.

--> Au menu principal, choisis l'option 1 (Recherche).

--> Poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

nielsp · Answer

Merci je fais ça tout de suite.

nielsp · Answer

############################## [ FindyKill V4.721 ] 

# User : suliane (Administrateurs) # SULI-MAISON
# Update on 29/03/09 by Chiquitine29
# Start at: 16:50:15 | 31/03/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

#               Intel(R) Pentium(R) 4 CPU 2.60GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Disabled

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 111,78 Go (42,82 Go free) # NTFS
# D:\ # Disque amovible
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque CD-ROM # 3,12 Go (0 Mo free) [Logiciels] # CDFS
# I:\ # Disque CD-ROM
# J:\ # Disque amovible # 1,88 Go (1,88 Go free) # FAT
 
############################## [ Processus actifs ] 
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Documents and Settings\suliane\Application Data\drivers\winupgro.exe
C:\Documents and Settings\suliane\Application Data\m\flec006.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
 
################## [ Processus infectieux stoppés ]  
 
"C:\Documents and Settings\suliane\Application Data\drivers\winupgro.exe"  (248)
"C:\Documents and Settings\suliane\Application Data\m\flec006.exe"  (256)
"C:\WINDOWS\system32\wintems.exe"  (276)
 
################## [ Fichiers / Dossiers infectieux C:\ ] 
 
 
################## [ C:\WINDOWS & C:\WINDOWS\Prefetch ] 
 
Found ! - C:\WINDOWS\prefetch\1072359.EXE-122FEE4A.pf 
Found ! - C:\WINDOWS\prefetch\162000.EXE-34D8C850.pf 
Found ! - C:\WINDOWS\prefetch\348234.EXE-16C79571.pf 
Found ! - C:\WINDOWS\prefetch\348937.EXE-30A51E96.pf 
Found ! - C:\WINDOWS\prefetch\638093.EXE-34CD699C.pf 
Found ! - C:\WINDOWS\prefetch\646000.EXE-0D219A82.pf 
Found ! - C:\WINDOWS\prefetch\648187.EXE-17290276.pf 
Found ! - C:\WINDOWS\prefetch\652531.EXE-394E5174.pf 
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-26861E1F.pf 
Found ! - C:\WINDOWS\prefetch\KEYGEN.EXE-0F8D6C69.pf 
Found ! - C:\WINDOWS\prefetch\KEYGEN.EXE-104D6D97.pf 
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf 
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf 
 
################## [ C:\WINDOWS\system32 ] 
 
Found ! - C:\WINDOWS\system32\mdelk.exe 
Found ! - C:\WINDOWS\system32\wintems.exe 
 
################## [ C:\WINDOWS\system32\drivers ] 
 
Found ! - "C:\WINDOWS\system32\drivers\down" 
 
################## [ C:\.. Application Data ... ] 
 
Found ! - "C:\Documents and Settings\suliane\Application Data\m\flec006.exe" 
Found ! - "C:\Documents and Settings\suliane\Application Data\m\list.oct" 
Found ! - "C:\Documents and Settings\suliane\Application Data\m\data.oct" 
Found ! - "C:\Documents and Settings\suliane\Application Data\m\srvlist.oct" 
Found ! - "C:\Documents and Settings\suliane\Application Data\m\shared" 
Found ! - "C:\Documents and Settings\suliane\Application Data\m" 
Found ! - "C:\Documents and Settings\suliane\Application Data\drivers" 
Found ! - "C:\Documents and Settings\suliane\Application Data\drivers\srosa2.sys" 
Found ! - "C:\Documents and Settings\suliane\Application Data\drivers\wfsintwq.sys" 
Found ! - "C:\Documents and Settings\suliane\Application Data\drivers\winupgro.exe" 
Found ! - "C:\Documents and Settings\suliane\Application Data\drivers\downld" 
 
################## [ C:\Users...\Temp Files... ] 
 
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\7IDDY8K9\b64_1[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\C56ZS1E3\b64_3[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\C56ZS1E3\b64_6[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\b64[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\b64_3[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\ieps[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\mxd[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\WXMRKLYJ\b64_2[1].jpg  
Found ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\WXMRKLYJ\ftpps[1].jpg  
 
################## [ Registre / Clés infectieuses ] 
 
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\Local AppWizard-Generated Applications\MsnMsgr  
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\Local AppWizard-Generated Applications\winupgro  
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\bisoft  
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\DateTime4  
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\FFC  
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\FirtR  
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\MuleAppData  
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr  
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S  
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S  
Found ! - HKEY_CURRENT_USER\Software\bisoft  
Found ! - HKEY_CURRENT_USER\Software\DateTime4  
Found ! - HKEY_CURRENT_USER\Software\FirtR  
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"drvsyskit" 
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\"drvsyskit" 
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe" 
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe" 
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"mule_st_key" 
Found ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\"mule_st_key" 
 
# HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1 
 
################## [ Recherche dans supports amovibles] 
 
# Présence des fichiers : 

 
################## [ Registre / Mountpoint2 ] 
 
# -> Not found !  
 
################## [ ! Fin du rapport # FindyKill V4.721 ! ]

Destrio5 · Answer

Infection Bagle.

--> Supprime le fichier qui t'a infecté (Crack par exemple).

--> Double-clique sur le raccourci FindyKill sur ton Bureau.

--> Au menu principal, choisis l'option 2 (Suppression).

/!\ Il y aura un redémarrage, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

--> Ensuite, poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

nielsp · Answer

Comment je sais quel fichier a infecté l'ordinateur ? Je ne sais pas où le trouver ! 

Je vous remerci de prendre du temps pour m'aider ..

Destrio5 · Answer

C'est le programme que tu as téléchargé sur eMule puis lancé.

nielsp · Answer

Ah d'accord. Je fait tout ça.

nielsp · Answer

############################## [ FindyKill V4.721 ] 

# User : suliane (Administrateurs) # SULI-MAISON
# Update on 29/03/09 by Chiquitine29
# Start at: 17:04:57 | 31/03/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

#               Intel(R) Pentium(R) 4 CPU 2.60GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Disabled

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 111,78 Go (49,94 Go free) # NTFS
# D:\ # Disque amovible
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque CD-ROM # 3,12 Go (0 Mo free) [Logiciels] # CDFS
# I:\ # Disque CD-ROM

############################## [ Active Processes ] 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
 
################## [ Infected Files / Folders C:\ ] 
 
 
################## [ C:\WINDOWS & C:\WINDOWS\prefetch ] 
 
Deleted ! - C:\WINDOWS\prefetch\1072359.EXE-122FEE4A.pf  
Deleted ! - C:\WINDOWS\prefetch\162000.EXE-34D8C850.pf  
Deleted ! - C:\WINDOWS\prefetch\348234.EXE-16C79571.pf  
Deleted ! - C:\WINDOWS\prefetch\348937.EXE-30A51E96.pf  
Deleted ! - C:\WINDOWS\prefetch\638093.EXE-34CD699C.pf  
Deleted ! - C:\WINDOWS\prefetch\646000.EXE-0D219A82.pf  
Deleted ! - C:\WINDOWS\prefetch\648187.EXE-17290276.pf  
Deleted ! - C:\WINDOWS\prefetch\652531.EXE-394E5174.pf  
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-26861E1F.pf  
Deleted ! - C:\WINDOWS\prefetch\KEYGEN.EXE-0F8D6C69.pf  
Deleted ! - C:\WINDOWS\prefetch\KEYGEN.EXE-104D6D97.pf  
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf  
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf  
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-17681AA8.pf  
 
################## [ C:\WINDOWS\System32 ] 
 
Deleted ! - C:\WINDOWS\system32\mdelk.exe 
Deleted ! - C:\WINDOWS\system32\wintems.exe 
 
################## [ C:\WINDOWS\System32\drivers ] 
 
Deleted ! - "C:\WINDOWS\system32\drivers\down" 
 
################## [ C:\.. Application Data ... ] 
 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\m\flec006.exe" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\m\list.oct" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\m\data.oct" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\m\srvlist.oct" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\m\shared" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\m" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\drivers\srosa2.sys" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\drivers\wfsintwq.sys" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\drivers\winupgro.exe" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\drivers\downld" 
Deleted ! - "C:\Documents and Settings\suliane\Application Data\drivers" 
 
################## [ C:\Documents and Settings\suliane\.....\Temp Files... ] 
 
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\7IDDY8K9\b64_1[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\C56ZS1E3\b64_3[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\C56ZS1E3\b64_6[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\b64[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\b64_3[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\ieps[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\P39NNKK9\mxd[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\WXMRKLYJ\b64_2[1].jpg  
Deleted ! - C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\WXMRKLYJ\ftpps[1].jpg  
Deleted ! - C:\DOCUME~1\suliane\LOCALS~1\Temp\FCSetup.exe  
Deleted ! - C:\DOCUME~1\suliane\LOCALS~1\Temp\pft27F.tmp\Source\Setup.exe  
 
################## [ Registry / Infected keys ]  
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_CURRENT_USER\Software\bisoft   
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4   
Deleted ! - HKEY_CURRENT_USER\Software\FirtR   
Deleted ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr   
Deleted ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\FFC   
Deleted ! - HKEY_USERS\S-1-5-21-1275210071-1482476501-725345543-1003\Software\MuleAppData   
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"drvsyskit" 
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe" 
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"mule_st_key" 
 
################## [ Cleaning Removable drives ]  

# Deleting Files : 
 
 
################## [ Registry / Mountpoint2 ] 

# -> Not found !  
 
################## [ States / Restarting of services ]   

# Services : [ Auto=2 / Request=3 / Disable=4 ] 

# Ndisuio -> # Type of startup =3  
# Ip6Fw -> # Type of startup =2  
# SharedAccess -> # Type of startup =2  
# wuauserv -> # Type of startup =2  
# wscsvc -> # Type of startup =2  
# Safe boot mode restored !  
 
################## [ Searching Other Infections ] 
 
# Références de comparaison Bagle MD5 :

File ... : C:\Documents and Settings\suliane\Application Data\drivers\winupgro.exe
CRC32 .. : 0ded7310
MD5 .... : 5b6ea5574526d5c8beff51dee8ad9d14

# -> Nothing found.
 
################## [ PEH Corrupted ] 
 
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\RECYCLER\S-1-5-21-1275210071-1482476501-725345543-1003\Dc618\autorun\launch.exe
 
################## [ ! End of Report # FindyKill V4.721 ! ]

Destrio5 · Answer

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

nielsp · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by suliane at 2009-03-31 17:18:09
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 51 GB (45%) free of 114 GB
Total RAM: 511 MB (54% free)

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll [2009-02-10 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-30 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{959012ec-ab9a-82dd-05f1-58521f220c1f}]
precisead - C:\WINDOWS\system32
sj87.dll [2009-03-23 645120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-30 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-30 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WD Button Manager"=C:\WINDOWS\system32\WDBtnMgr.exe [2008-11-20 364544]
"LogitechCommunicationsManager"=C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe [2008-08-14 565008]
"LogitechQuickCamRibbon"=C:\Program Files\Logitech\QuickCam\Quickcam.exe [2008-08-14 2407184]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2004-09-07 57344]
"TrayServer"=C:\Program Files\MAGIX\Video_nomade_3_Version_a_telecharger\TrayServer.exe []
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe [2009-02-10 185872]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-30 136600]
"UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2009-03-31 15872]
""= []
"StatusClient"=C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe [2002-12-16 36864]
"TomcatStartup"=C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe [2003-03-31 155648]
"HPLJ Config"=C:\Program Files\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe [2003-03-31 28672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2004-04-06 860160]

C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage
Air Mouse.lnk - C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe

C:\Documents and Settings\suliane\Menu Démarrer\Programmes\Démarrage
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\BeatPack\BeatPack.exe"="C:\Program Files\BeatPack\BeatPack.exe:*:Enabled:BeatPack"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\TightVNC\WinVNC.exe"="C:\Program Files\TightVNC\WinVNC.exe:*:Enabled:TightVNC Win32 Server"
"C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe"="C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe:*:Enabled:AirMouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 1 months======

2009-03-31 17:18:09 ----D---- C:sit
2009-03-31 17:18:09 ----D---- C:\Program Files	rend micro
2009-03-31 17:04:55 ----A---- C:\FindyKill.txt
2009-03-31 16:49:09 ----D---- C:\FindyKill
2009-03-31 16:09:27 ----D---- C:\200903311609271679706442
2009-03-31 16:04:47 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Trend Micro
2009-03-31 15:23:59 ----D---- C:\Program Files\Hewlett-Packard
2009-03-31 15:18:56 ----A---- C:\WINDOWS\NCUNINST.EXE
2009-03-31 15:18:24 ----D---- C:\Program Files\Fichiers communs\SWF Studio
2009-03-31 15:17:49 ----A---- C:\WINDOWS\hplj1010.ini
2009-03-31 13:24:54 ----D---- C:\WINDOWS\system32\appmgmt
2009-03-31 12:39:01 ----D---- C:\Documents and Settings\suliane\Application Data\Sony
2009-03-31 11:47:59 ----D---- C:\Program Files\Sony Setup
2009-03-29 15:43:48 ----A---- C:\WINDOWS\system32\de4e0675-eaa7-507a-1db2-efd0def114ee.exe
2009-03-23 13:01:26 ----D---- C:\Program Files\Air Mouse
2009-03-23 13:00:31 ----D---- C:\WINDOWS\Downloaded Installations
2009-03-23 12:52:45 ----D---- C:\Program Files\TightVNC
2009-03-23 11:58:56 ----A---- C:\WINDOWS\system32
sj87.dll
2009-03-19 13:31:26 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-03-19 13:31:16 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-03-05 15:22:56 ----D---- C:\Documents and Settings\suliane\Application Data\CopyTrans
2009-03-05 15:21:19 ----D---- C:\Program Files\WindSolutions
2009-03-05 15:21:11 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\CopyTransControlCenter
2009-03-02 00:17:42 ----D---- C:\Documents and Settings\suliane\Application Data\CopyTransPhoto
2009-03-02 00:14:20 ----D---- C:\Documents and Settings\suliane\Application Data\iCloner
2009-03-02 00:11:20 ----D---- C:\Documents and Settings\suliane\Application Data\CopyTransControlCenter
2009-03-01 15:42:45 ----D---- C:\Program Files\MSECache

======List of files/folders modified in the last 1 months======

2009-03-31 17:18:09 ----RD---- C:\Program Files
2009-03-31 17:17:43 ----D---- C:\WINDOWS\Prefetch
2009-03-31 17:13:07 ----D---- C:\WINDOWS\system32
2009-03-31 17:13:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-03-31 17:12:11 ----D---- C:\WINDOWS\Temp
2009-03-31 17:06:15 ----HD---- C:\WINDOWS\system32\drivers
2009-03-31 17:05:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-03-31 17:02:27 ----D---- C:\WINDOWS
2009-03-31 17:01:56 ----D---- C:\downloads
2009-03-31 16:24:21 ----D---- C:\Program Files\Mozilla Firefox
2009-03-31 16:19:22 ----D---- C:\WINDOWS\system32\CatRoot2
2009-03-31 16:19:00 ----SHD---- C:\WINDOWS\Installer
2009-03-31 15:46:12 ----HD---- C:\WINDOWS\inf
2009-03-31 15:44:29 ----D---- C:\WINDOWS\system32\CatRoot
2009-03-31 15:44:21 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-03-31 15:24:15 ----RSD---- C:\WINDOWS\Fonts
2009-03-31 15:18:24 ----D---- C:\Program Files\Fichiers communs
2009-03-31 12:54:17 ----D---- C:\Program Files\Unlocker
2009-03-29 15:44:19 ----D---- C:\Documents and Settings\suliane\Application Data\LimeWire
2009-03-22 16:03:54 ----A---- C:\WINDOWS\win.ini
2009-03-22 14:44:25 ----D---- C:\Documents and Settings\suliane\Application Data\Adobe
2009-03-22 14:12:06 ----D---- C:\Program Files\Mozilla Thunderbird
2009-03-22 14:06:53 ----HD---- C:\Program Files\InstallShield Installation Information
2009-03-22 14:06:30 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-03-22 13:58:08 ----D---- C:\Program Files\Adobe
2009-03-22 13:57:02 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-03-19 13:31:23 ----A---- C:\WINDOWS\imsins.BAK
2009-03-11 01:28:57 ----HD---- C:\WINDOWS\$hf_mig$
2009-03-04 18:55:17 ----D---- C:\Program Files\Behringer
2009-03-02 16:09:45 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe
2009-03-01 15:43:09 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-19 40320]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2008-12-02 5632]
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [2001-08-17 289887]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [2001-08-17 115807]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [2001-08-17 391199]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [2001-08-17 199711]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [2001-08-17 50751]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [2001-08-17 488383]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-01 2279424]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-28 9600]
R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 LVPr2Mon;Logitech LVPr2Mon Driver; C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys [2008-07-26 25624]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\LVUSBSta.sys [2007-10-12 41752]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-28 12288]
R3 MTXPARH;MTXPARH; C:\WINDOWS\System32\DRIVERS\MTXPARHM.sys [2004-08-03 452736]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\System32\DRIVERS
ic1394.sys [2004-08-03 61824]
R3 PID_PEPI;Logitech QuickCam IM(PID_PEPI); C:\WINDOWS\system32\DRIVERS\LV302V32.SYS [2007-10-12 1279000]
R3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
R3 wlags51b;Wireless LAN USB Driver; C:\WINDOWS\system32\DRIVERS\wlags51b.sys [2002-04-30 176128]
S3 61883;Pilote d'unité 61883; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-04 48128]
S3 Avc;Périphérique AVC; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-04 38912]
S3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167]
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 Dot4;Pilote MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2004-08-03 207360]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-23 24064]
S3 FCA202AudioSrv;Behringer FCA202 Audio Driver (WDM); C:\WINDOWS\system32\drivers\fca202.sys []
S3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-11-07 32000]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-30 152984]
R2 LVCOMSer;LVCOMSer; C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe [2008-07-26 186904]
R2 LVPrcSrv;Process Monitor; C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe [2008-07-26 150040]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-02-10 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2002-08-01 65536]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------



Et Info




info.txt logfile of random's system information tool 1.06 2009-03-31 17:18:11

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
-->MsiExec.exe /X{57922B53-02D4-4DFC-AC24-A3519DC1F49A}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.62-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe After Effects 7.0-->msiexec /I {DD362256-A7A2-4524-9457-213DDC2AFC2A}
Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000103}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5102}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 2.0-->MsiExec.exe /I{8FFC924C-ED06-44CB-8867-3CA778ECE903}
Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-040C-1E257A25E34D}
Adobe Premiere Pro 2.0-->msiexec /I {FA17A726-B229-4116-B793-A2AB1A4EAE2E}
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-0C40-4930-9AFE-113BCE553101}
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1437-443D-B06E-79A00FE45110}
Air Mouse Server-->MsiExec.exe /I{5164E4B0-9CD0-454A-BAC0-6771A15EEB64}
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Contextual Tool Precisead-->C:\WINDOWS\system32\de4e0675-eaa7-507a-1db2-efd0def114ee.exe
Correctif pour Windows XP (KB942288-v3)-->"C:\WINDOWS\$NtUninstallKB942288-v3$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Dofus 1.26.0-->C:\Program Files\Dofus\uninstall.exe
Drivers-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6ABA1658-6429-4D01-875C-0EA6EE851AD1}\Setup.exe" -l0x9 -a
FindyKill-->C:\FindyKill\Uninstal.exe
Firebird SQL Server - MAGIX Edition-->C:\Program Files\MAGIX\Common\Database\unwise.exe
hp LaserJet 1010 Series-->MsiExec.exe /x {292C47B2-8DB7-47BF-896C-C3C5EE8108C4}
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
J2SE Runtime Environment 5.0 Update 8-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150080}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
K-Lite Codec Pack 4.1.4 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LimeWire 4.18.8-->"C:\Program Files\LimeWire\uninstall.exe"
Logitech QuickCam-->MsiExec.exe /X{3AF8FCCD-F51A-4014-9002-F195E1CBC876}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft Office Standard Edition 2003-->MsiExec.exe /I{9112040C-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB925720)-->"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
Mozilla Firefox (3.0.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.19)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Sony USB Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}\setup.exe" -l0x40c UNINSTALL -removeonly
Unlocker 1.8.7-->C:\Program Files\Unlocker\uninst.exe
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VideoLAN VLC media player 0.7.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WD Firewire HID Driver-->MsiExec.exe /X{FD6C6B7F-5696-48C5-A601-2EE9E50C3D46}
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe
WinSCP 4.1.8-->"C:\Program Files\WinSCP\unins000.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======System event log======

Computer Name: SULI-MAISON
Event Code: 7036
Message: Le service Gestionnaire de connexions d'accès distant est entré dans l'état : en cours d'exécution.

Record Number: 4138
Source Name: Service Control Manager
Time Written: 20090220085740.000000+060
Event Type: Informations
User: 

Computer Name: SULI-MAISON
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Gestionnaire de connexions d'accès distant.

Record Number: 4137
Source Name: Service Control Manager
Time Written: 20090220085739.000000+060
Event Type: Informations
User: SULI-MAISON\suliane

Computer Name: SULI-MAISON
Event Code: 7036
Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.

Record Number: 4136
Source Name: Service Control Manager
Time Written: 20090220085739.000000+060
Event Type: Informations
User: 

Computer Name: SULI-MAISON
Event Code: 7036
Message: Le service Service de découvertes SSDP est entré dans l'état : en cours d'exécution.

Record Number: 4135
Source Name: Service Control Manager
Time Written: 20090220085739.000000+060
Event Type: Informations
User: 

Computer Name: SULI-MAISON
Event Code: 7036
Message: Le service Explorateur d'ordinateur est entré dans l'état : arrêté.

Record Number: 4134
Source Name: Service Control Manager
Time Written: 20090220085739.000000+060
Event Type: Informations
User: 

=====Application event log=====

Computer Name: SULI-MAISON
Event Code: 0
Message: 
Record Number: 1788
Source Name: iPod Service
Time Written: 20090311211805.000000+060
Event Type: Informations
User: 

Computer Name: SULI-MAISON
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 1787
Source Name: SecurityCenter
Time Written: 20090311211759.000000+060
Event Type: Informations
User: 

Computer Name: SULI-MAISON
Event Code: 1
Message: 
Record Number: 1786
Source Name: Bonjour Service
Time Written: 20090311211758.000000+060
Event Type: Informations
User: 

Computer Name: SULI-MAISON
Event Code: 0
Message: 
Record Number: 1785
Source Name: LVCOMSer
Time Written: 20090311211758.000000+060
Event Type: Informations
User: 

Computer Name: SULI-MAISON
Event Code: 0
Message: 
Record Number: 1784
Source Name: iPod Service
Time Written: 20090311115205.000000+060
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Samsung\Samsung PC Studio 3\;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Fichiers communs\Adobe\AGL
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Destrio5 · Answer

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:files 
C:\WINDOWS\system32
sj87.dll 
C:\WINDOWS\system32\de4e0675-eaa7-507a-1db2-efd0def114ee.exe   

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Explorer\Browser Helper Objects\{959012ec-ab9a-82dd-05f1-58521f220c1f}]  

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

nielsp · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\WINDOWS\system32
sj87.dll unregistered successfully.
C:\WINDOWS\system32
sj87.dll moved successfully.
C:\WINDOWS\system32\de4e0675-eaa7-507a-1db2-efd0def114ee.exe moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Explorer\Browser Helper Objects\{959012ec-ab9a-82dd-05f1-58521f220c1f}\ not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_5c4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03312009_172640

Files moved on Reboot...
C:\Documents and Settings\suliane\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS	emp\logishrd\LVPrcInj01.dll
C:\WINDOWS	emp\logishrd\LVPrcInj01.dll NOT unregistered.
File move failed. C:\WINDOWS	emp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.
File C:\WINDOWS	emp\Perflib_Perfdata_5c4.dat not found!

Destrio5 · Answer

---> Désinstalle FindyKill.

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

nielsp · Answer

Malwarebytes' Anti-Malware 1.35
Version de la base de données: 1924
Windows 5.1.2600 Service Pack 2

31/03/2009 17:48:02
mbam-log-2009-03-31 (17-48-02).txt

Type de recherche: Examen rapide
Eléments examinés: 83221
Temps écoulé: 3 minute(s), 41 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Mozilla Firefox\components\d56348b0-13cf-19fb-7d23-bd26f860cdd5.dll (Adware.Yoog) -> Quarantined and deleted successfully.

Destrio5 · Answer

--> Relance MBAM, va dans Quarantaine et supprime tout.

- Télécharge HijackThis v2.0.2 sur ton Bureau.

- Double-clique sur HJTInstall afin de lancer l'installation.

- Clique sur Install ensuite sur I Accept.

- Clique sur Do a system scan and save a logfile.

- Le Bloc-notes s'ouvrira, fais un copier/coller de tout son contenu ici dans ton prochain message.

nielsp · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:56:15, on 31/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\program files\logitech\quickcam\lu\lulnchr.exe
c:\program files\logitech\quickcam\lu\LogitechUpdate.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Video_nomade_3_Version_a_telecharger\TrayServer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [HPLJ Config] C:\Program Files\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe -c Direct -p USB -pn "" -n 0 -l  -sl 120000
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Air Mouse.lnk = C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Destrio5 · Answer

1/

---> Lance ce fichier : C:\Program Files\Trend Micro\HijackThis\HijackThis.exe    
 
---> Choisis Do a system scan only.

---> Coche les cases qui sont devant les lignes suivantes :

O2 - BHO: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file) 

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Ferme HijackThis.


2/

---> Désinstalle J2SE Runtime Environment 5.0 Update 8 et Java 6 Update 11.

---> Mets à jour Internet Explorer.

---> Mets à jour Java.

---> Mets à jour Adobe Reader.


3/

--> Installe Antivir et mets-le à jour.

--> Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches.

--> Dans Antivir, choisis Outils puis Configuration.

--> Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages.

--> Fais un scan complet et poste le rapport.

Tutoriel sur Antivir

nielsp · Answer

Je n'arrive pas à trouver le moyen de faire l'étape sur antivir, car déjà lorsque je l'installe et dezip, je me retrouve face à plein de programme avec l'icone du parapluie. J'ai réussi à lancer un setup, mais l'interface d'Avira Antivir Personal ne comporte pas "outils", "configuration", "mode expert" ...

nielsp · Answer

Avira AntiVir Personal
Report file date: mercredi 1 avril 2009  10:33

Scanning for 1334897 virus strains and unwanted programs.

Licensee        : Avira AntiVir Personal - FREE Antivirus
Serial number   : 0000149996-ADJIE-0000001
Platform        : Windows XP
Windows version : (Service Pack 2)  [5.1.2600]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : SULI-MAISON

Version information:
BUILD.DAT       : 9.0.0.387     17962 Bytes  24/03/2009 11:04:00
AVSCAN.EXE      : 9.0.3.3      464641 Bytes  24/02/2009 10:13:28
AVSCAN.DLL      : 9.0.3.0       40705 Bytes  27/02/2009 08:58:26
LUKE.DLL        : 9.0.3.2      209665 Bytes  20/02/2009 09:35:50
LUKERES.DLL     : 9.0.2.0       12033 Bytes  27/02/2009 08:58:54
ANTIVIR0.VDF    : 7.1.0.0    15603712 Bytes  27/10/2008 10:30:38
ANTIVIR1.VDF    : 7.1.2.12    3336192 Bytes  11/02/2009 18:33:28
ANTIVIR2.VDF    : 7.1.2.199   1008640 Bytes  22/03/2009 08:18:58
ANTIVIR3.VDF    : 7.1.2.244    338432 Bytes  01/04/2009 08:31:01
Engineversion   : 8.2.0.129
AEVDF.DLL       : 8.1.1.0      106868 Bytes  27/01/2009 15:36:42
AESCRIPT.DLL    : 8.1.1.70     369019 Bytes  01/04/2009 08:19:07
AESCN.DLL       : 8.1.1.8      127346 Bytes  01/04/2009 08:19:07
AERDL.DLL       : 8.1.1.3      438645 Bytes  29/10/2008 16:24:42
AEPACK.DLL      : 8.1.3.11     397687 Bytes  01/04/2009 08:19:06
AEOFFICE.DLL    : 8.1.0.36     196987 Bytes  26/02/2009 18:01:58
AEHEUR.DLL      : 8.1.0.111   1679736 Bytes  01/04/2009 08:19:05
AEHELP.DLL      : 8.1.2.2      119158 Bytes  26/02/2009 18:01:58
AEGEN.DLL       : 8.1.1.31     340341 Bytes  01/04/2009 08:19:01
AEEMU.DLL       : 8.1.0.9      393588 Bytes  09/10/2008 12:32:40
AECORE.DLL      : 8.1.6.6      176501 Bytes  17/02/2009 12:22:44
AEBB.DLL        : 8.1.0.3       53618 Bytes  09/10/2008 12:32:40
AVWINLL.DLL     : 9.0.0.3       18177 Bytes  12/12/2008 06:48:00
AVPREF.DLL      : 9.0.0.1       43777 Bytes  05/12/2008 08:32:16
AVREP.DLL       : 8.0.0.3      155905 Bytes  20/01/2009 12:34:30
AVREG.DLL       : 9.0.0.0       36609 Bytes  05/12/2008 08:32:10
AVARKT.DLL      : 9.0.0.1      292609 Bytes  09/02/2009 05:52:26
AVEVTLOG.DLL    : 9.0.0.7      167169 Bytes  30/01/2009 08:37:10
SQLITE3.DLL     : 3.6.1.0      326401 Bytes  28/01/2009 13:03:50
SMTPLIB.DLL     : 9.2.0.25      28417 Bytes  02/02/2009 06:21:34
NETNT.DLL       : 9.0.0.0       11521 Bytes  05/12/2008 08:32:12
RCIMAGE.DLL     : 9.0.0.21    2438401 Bytes  09/02/2009 09:45:46
RCTEXT.DLL      : 9.0.35.0      87297 Bytes  11/03/2009 13:55:14

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, 
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: mercredi 1 avril 2009  10:33

Starting search for hidden objects.
'49437' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'LogitechUpdate.exe' - '1' Module(s) have been scanned
Scan process 'LULnchr.exe' - '1' Module(s) have been scanned
Scan process 'hpzipm12.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'LVComSer.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'COCIManager.exe' - '1' Module(s) have been scanned
Scan process 'javaw.exe' - '1' Module(s) have been scanned
Scan process 'Air Mouse.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'StatusClient.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'ALCXMNTR.EXE' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'Quickcam.exe' - '1' Module(s) have been scanned
Scan process 'Communications_Helper.exe' - '1' Module(s) have been scanned
Scan process 'WDBtnMgr.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned
Scan process 'LVComSer.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
44 processes with 44 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).
The registry was scanned ( '53' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Ben Harper - Waiting on an angel.mp3
    [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Bloc Party - Silent Alarm.wma
    [DETECTION] Is the TR/Dldr.WMA.GetCodec.A Trojan
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Bloc Party. - Pioneers.mp3
    [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Colin Mcrae 2005 PSP iSO.zip
  [0] Archive type: ZIP
    --> Setup.exe
      [DETECTION] Contains recognition pattern of the WORM/IrcBot.290818 worm
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\CopyTrans Suite 1.13 Ultra.zip
  [0] Archive type: ZIP
    --> Setup.exe
      [1] Archive type: RSRC
      [DETECTION] Is the TR/Dropper.Gen Trojan
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\CopyTrans Suite v1.02.zip
  [0] Archive type: ZIP
    --> Setup.exe
      [DETECTION] Is the TR/Agent.tvb Trojan
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    [DETECTION] Is the TR/Dldr.Bagle.apx Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP157\A0074582.sys
    [DETECTION] Is the TR/Rootkit.Gen Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP157\A0075586.sys
    [DETECTION] Is the TR/Rootkit.Gen Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075623.sys
    [DETECTION] Is the TR/Rootkit.Gen Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075917.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075918.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075920.exe
    [DETECTION] Is the TR/Agent.bptr Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075921.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075922.exe
    [DETECTION] Is the TR/Dldr.Bagle.apx Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075923.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075933.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075955.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0076252.dll
    [DETECTION] Is the TR/Killav.28714 Trojan
C:\_OTMoveIt\MovedFiles\03312009_172640\WINDOWS\system32
sj87.dll
    [DETECTION] Contains recognition pattern of the ADSPY/SearchPan.A adware or spyware

Beginning disinfection:
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Ben Harper - Waiting on an angel.mp3
    [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
    [NOTE]      The file was moved to '4a413556.qua'!
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Bloc Party - Silent Alarm.wma
    [DETECTION] Is the TR/Dldr.WMA.GetCodec.A Trojan
    [NOTE]      The file was moved to '4a42355e.qua'!
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Bloc Party. - Pioneers.mp3
    [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
    [NOTE]      The file was moved to '4b3db0bf.qua'!
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\Colin Mcrae 2005 PSP iSO.zip
    [NOTE]      The file was moved to '4a3f3561.qua'!
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\CopyTrans Suite 1.13 Ultra.zip
    [NOTE]      The file was moved to '4a433561.qua'!
C:\Documents and Settings\suliane\Mes documents\Samsung PC Studio 4\CopyTrans Suite v1.02.zip
    [NOTE]      The file was moved to '4b3d4b7a.qua'!
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    [DETECTION] Is the TR/Dldr.Bagle.apx Trojan
    [NOTE]      The file was moved to '4a413565.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP157\A0074582.sys
    [DETECTION] Is the TR/Rootkit.Gen Trojan
    [NOTE]      The file was moved to '4a033523.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP157\A0075586.sys
    [DETECTION] Is the TR/Rootkit.Gen Trojan
    [NOTE]      The file was moved to '4eacba14.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075623.sys
    [DETECTION] Is the TR/Rootkit.Gen Trojan
    [NOTE]      The file was moved to '4b81a81c.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075917.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
    [NOTE]      The file was moved to '4a033524.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075918.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
    [NOTE]      The file was moved to '4b809025.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075920.exe
    [DETECTION] Is the TR/Agent.bptr Trojan
    [NOTE]      The file was moved to '4917b3bd.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075921.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
    [NOTE]      The file was moved to '49125a65.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075922.exe
    [DETECTION] Is the TR/Dldr.Bagle.apx Trojan
    [NOTE]      The file was moved to '4915bb4d.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075923.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
    [NOTE]      The file was moved to '4914a315.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075933.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
    [NOTE]      The file was moved to '4a033525.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0075955.exe
    [DETECTION] Is the TR/Bagle.Gen.B Trojan
    [NOTE]      The file was moved to '491a90e6.qua'!
C:\System Volume Information\_restore{92B82FD2-E2D7-46B3-ABBC-0439E983FB1B}\RP159\A0076252.dll
    [DETECTION] Is the TR/Killav.28714 Trojan
    [NOTE]      The file was moved to '491998ae.qua'!
C:\_OTMoveIt\MovedFiles\03312009_172640\WINDOWS\system32
sj87.dll
    [DETECTION] Contains recognition pattern of the ADSPY/SearchPan.A adware or spyware
    [NOTE]      The file was moved to '4a3d3568.qua'!


End of the scan: mercredi 1 avril 2009  11:33
Used time: 59:13 Minute(s)

The scan has been done completely.

   8032 Scanned directories
 279908 Files were scanned
     20 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
     20 Files were moved to quarantine
      0 Files were renamed
      1 Files cannot be scanned
 279887 Files not concerned
   2170 Archives were scanned
      1 Warnings
     21 Notes
  49437 Objects were scanned with rootkit scan
      0 Hidden objects were found

Destrio5 · Answer

---> Refais un scan RSIT et poste le rapport log.

nielsp · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by suliane at 2009-04-02 11:44:39
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 93 GB (81%) free of 114 GB
Total RAM: 511 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:52, on 02/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\program files\logitech\quickcam\lu\lulnchr.exe
c:\program files\logitech\quickcam\lu\LogitechUpdate.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\suliane\Bureau\RSIT.exe
C:\Program Files	rend micro\HijackThis\suliane.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Video_nomade_3_Version_a_telecharger\TrayServer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [HPLJ Config] C:\Program Files\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe -c Direct -p USB -pn "" -n 0 -l  -sl 120000
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Air Mouse.lnk = C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Destrio5 · Answer

Ton PC va bien ?

nielsp · Answer

ben j'ai toujours ce virus "yoog", j'ai ré-accès à internet, mais plus à msn ..

Destrio5 · Answer

Qui te dit que tu as ce virus ?

nielsp · Answer

Dans firefox, la barre de recherche en haut à droite se met toujours automatiquement en "yoog search" et avira antivir me l'a détecté, mais il ne s'est rien passé après, pas d'étape comme effacer le virus ou le mettre en quarantaine .. J'en déduit qu'il est toujours là en voyant que msn décide de ne plus démarrer ! Je ne l'affirme pas ..

Destrio5 · Answer

MSN t'affiche un message d'erreur ?

nielsp · Answer

non il ne se lance pas, je n'arrive qu'à le voir "msnmsg.exe" dans les processus

Destrio5 · Answer

C'est normal, il est sûrement infecté par Bagle, réinstalle-le.

nielsp · Answer

D'accord merci, et pour le yoog search, pas moyen de le virer ?

Destrio5 · Answer

Mets à jour MBAM et fais un examen rapide.

nielsp · Answer

Dac.

nielsp · Answer

J'avais oublié, j'ai déjà essayé de réinstaller windows live messenger, mais quand je veux le réinstaller il me dit qu'il est déjà installé ... J'ai supprimer tout les fichiers qui pourrait avoir rapport avec ça y compris dans programme files etc ..

Destrio5 · Answer

Essaie ZapMessenger :
https://www.wikikou.fr/

nielsp · Answer

Merci j'essaye ça tout de suite.

nielsp · Answer

Génial ça marche parfaitement ! Merci beaucoup, je fais la mise à jour de MBAM.

Virus qui bloque tout accès à internet

35 réponses

Discussions similaires

Newsletters