VIRUS Trojan.Swizzor.WU comment le supprimerFermé

Question

Bonsoir, 

Voila samedi j'ai fait une recherche sur mon pc a partir de Bitdefender et il a trouver un trojan comment je fait pour le suprimmer merci. 

Voila le rapport. 

Généré à: Sun, Apr 13, 2008 - 23:02:21 







Info d'analyse 





Fichiers scannés 

117948 

Infectés Fichiers 

1 











Virus Détectés 





Trojan.Swizzor.WU 

1 

















Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.

booddha · Answer

Tu es réellement sous Mac ?

Allen · Answer

Non je suis sous XP c'est que j'utilise Safari et c'est un priogramme installé avec itunes.

Allen · Answer

Voila le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:06:17, on 15/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Mediahub.exe
C:\Program Files\Trend Micro\HijackThis\MonJack.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

booddha · Answer

Trojan.Swizzor.WU 
+BitDefender
CCl
+HJT
Malwares Bytes
-------------------------------- Ne pas tenir compte des lignes ci-dessus

==================  MalwareBytes =====================

Telecharger MalwareBytes

Le Tutorial

Attention à ce que l'option Perform Full Scan soit cochée

Ne pas oublier de supprimer tout ce que MalwaresByte trouve. Bouton Remove Selected après avoir tout sélectionné

Poster le rapport et un nouveau rapport HiJackThis

Allen · Answer

Voila rapport pour malwarebytes

Malwarebytes' Anti-Malware 1.11
Version de la base de données: 629

Type de recherche: Examen complet (C:\|)
Eléments examinés: 180586
Temps écoulé: 49 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Menu Démarrer\carlton (Dialer) -> Quarantined and deleted successfully.

Allen · Answer

Rapport Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:44:54, on 15/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\MonJack.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Allen · Answer

T'es la boodha ??

booddha · Answer

=================== LOP S&D =====================

	•	Télécharger la dernière version de Lop S&D sur le Bureau,
	•	Double-click sur Lop S&D.exe pour lancer l'installation,
	•	Puis double-cliquer sur le raccourci Lop S&D présent sur le Bureau,

      Attention Désactivez les protections résidentes : Antivirus, antispywares, controleurs d'intégrité, etc... pour que l'outil puisse s'exécuter correctement.

	•	Sélectionner la langue souhaitée , puis choisir l'Option 1 (Recherche)
	•	Le scan prend moins d'une minute,
	•	A l'issue du scan, le bloc notes va s'ouvrir avec le résultat de la recherche,
	•	Enregistrer le rapport LopR.txt sur le Bureau pour le retrouver facilement, sinon il sera sauvegardé automatiquement à la racine de la partition système : C:\LopR.txt
	•	Pour nettoyer ce qui a été trouvé, relancer LopSD et choisir l'option 2 (Suppression)
	•	Copier/Coller le rapport LopR.txt + un nouveau rapport HijackThis

NB : un backup des suppressions sera créé dans le dossier de Lop S&D.

Allen · Answer

Rapport Lopsd


   -----------------------[  Lop S&D 4.1.1-0  XP/Vista  ]---------------------

   [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
   [ USER : WASSIM ] [ "C:\Lop SD" ]
   [ 15/04/2008 | 12:13:16,65 ] [ PC : YAHYAOUI ]
   [ MAJ : 14-04-2008 | 20:30 ]
 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [31/10/2006|19:31] C:\DOCUME~1\ADMINI~1\APPLIC~1\.
   [31/10/2006|19:31] C:\DOCUME~1\ADMINI~1\APPLIC~1\..
   [14/03/2008|21:31] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
   [23/09/2004|19:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
   [01/11/2006|03:20] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [01/11/2006|03:20] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [01/11/2006|03:20] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [01/11/2006|03:20] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [15/04/2008|01:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.
   [15/04/2008|01:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\..
   [15/04/2008|00:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\118300.34
   [17/03/2008|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [01/07/2007|01:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [11/01/2007|23:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [30/06/2007|23:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [18/04/2007|14:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [03/04/2007|19:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ciel
   [06/05/2007|18:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Corel
   [12/02/2007|22:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [23/09/2004|19:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [14/03/2008|22:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Earthsim
   [13/04/2007|03:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [12/01/2007|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
   [01/11/2006|03:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [17/10/2007|21:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LauncherAccess.dt
   [02/04/2008|20:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [31/03/2008|18:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch
   [02/04/2008|20:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
   [15/04/2008|01:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [01/05/2007|17:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [30/03/2008|14:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [14/04/2008|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [04/06/2007|23:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
   [01/11/2006|03:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
   [13/01/2008|18:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage
   [24/10/2007|17:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
   [20/01/2007|12:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [11/01/2007|13:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [01/11/2006|03:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
   [11/01/2007|13:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [02/02/2008|21:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TVU networks
   [15/07/2007|14:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [08/04/2008|20:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\VadeRetro
   [01/11/2006|03:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [13/04/2007|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [12/04/2007|22:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [04/07/2007|12:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [20/02/2008|18:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [10/01/2007|23:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\X10 Settings

   [31/10/2006|19:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\.
   [31/10/2006|19:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\..
   [14/03/2008|21:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
   [23/09/2004|19:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [01/11/2006|03:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [01/11/2006|03:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [04/07/2007|12:21] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [01/11/2006|03:20] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver



   [11/11/2007|01:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\$_hpcst$.hpc
   [11/11/2007|01:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\.
   [11/11/2007|01:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\..
   [29/04/2007|13:32] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [13/04/2007|17:31] C:\DOCUME~1\LOCALS~1\APPLIC~1\DivX
   [26/09/2007|16:22] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [01/11/2006|03:22] C:\DOCUME~1\LOCALS~1\APPLIC~1\X10 Commander

   [26/09/2007|16:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\.
   [26/09/2007|16:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\..
   [26/09/2007|16:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\Identities
   [26/09/2007|16:11] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft


   [07/10/2007|16:29] C:\DOCUME~1\WASSIM\APPLIC~1\$_hpcst$.hpc
   [15/04/2008|01:29] C:\DOCUME~1\WASSIM\APPLIC~1\.
   [15/04/2008|01:29] C:\DOCUME~1\WASSIM\APPLIC~1\..
   [29/01/2008|21:34] C:\DOCUME~1\WASSIM\APPLIC~1\Adobe
   [02/05/2007|20:27] C:\DOCUME~1\WASSIM\APPLIC~1\AdobeUM
   [13/07/2007|15:19] C:\DOCUME~1\WASSIM\APPLIC~1\Ahead
   [12/04/2008|15:37] C:\DOCUME~1\WASSIM\APPLIC~1\Apple Computer
   [01/11/2006|03:20] C:\DOCUME~1\WASSIM\APPLIC~1\ATI
   [10/04/2008|21:08] C:\DOCUME~1\WASSIM\APPLIC~1\Azureus
   [30/05/2007|13:51] C:\DOCUME~1\WASSIM\APPLIC~1\Corel
   [17/04/2007|16:25] C:\DOCUME~1\WASSIM\APPLIC~1\Creative
   [14/02/2007|19:32] C:\DOCUME~1\WASSIM\APPLIC~1\CyberLink
   [23/09/2004|19:51] C:\DOCUME~1\WASSIM\APPLIC~1\desktop.ini
   [30/09/2007|12:55] C:\DOCUME~1\WASSIM\APPLIC~1\DivX
   [14/03/2008|22:13] C:\DOCUME~1\WASSIM\APPLIC~1\Earthsim
   [20/10/2007|12:36] C:\DOCUME~1\WASSIM\APPLIC~1\EoRezo
   [13/04/2007|12:48] C:\DOCUME~1\WASSIM\APPLIC~1\Google
   [01/11/2006|03:20] C:\DOCUME~1\WASSIM\APPLIC~1\Identities
   [13/04/2008|23:20] C:\DOCUME~1\WASSIM\APPLIC~1\keepsignreadme
   [17/01/2007|20:06] C:\DOCUME~1\WASSIM\APPLIC~1\Leadertech
   [12/04/2007|22:31] C:\DOCUME~1\WASSIM\APPLIC~1\Macromedia
   [15/04/2008|01:29] C:\DOCUME~1\WASSIM\APPLIC~1\Malwarebytes
   [17/09/2007|20:02] C:\DOCUME~1\WASSIM\APPLIC~1\Media Player Classic
   [23/01/2008|13:30] C:\DOCUME~1\WASSIM\APPLIC~1\Microsoft
   [04/06/2007|23:13] C:\DOCUME~1\WASSIM\APPLIC~1\Mozilla
   [29/09/2007|11:33] C:\DOCUME~1\WASSIM\APPLIC~1\Norman
   [11/01/2007|18:55] C:\DOCUME~1\WASSIM\APPLIC~1\OD2
   [19/02/2007|20:50] C:\DOCUME~1\WASSIM\APPLIC~1\OFFICE One v6
   [14/04/2008|21:12] C:\DOCUME~1\WASSIM\APPLIC~1\QuickZip45.ini
   [01/10/2007|22:39] C:\DOCUME~1\WASSIM\APPLIC~1\Samsung
   [11/04/2008|23:57] C:\DOCUME~1\WASSIM\APPLIC~1\Screenshot Sender
   [11/01/2007|13:56] C:\DOCUME~1\WASSIM\APPLIC~1\Skype
   [17/01/2007|20:06] C:\DOCUME~1\WASSIM\APPLIC~1\Sonic
   [09/12/2007|00:45] C:\DOCUME~1\WASSIM\APPLIC~1\SopCast
   [19/02/2007|21:04] C:\DOCUME~1\WASSIM\APPLIC~1\Sun
   [19/02/2007|20:50] C:\DOCUME~1\WASSIM\APPLIC~1\sversion.ini
   [04/06/2007|23:13] C:\DOCUME~1\WASSIM\APPLIC~1\Talkback
   [30/03/2008|00:27] C:\DOCUME~1\WASSIM\APPLIC~1	eamspeak2
   [02/02/2008|21:17] C:\DOCUME~1\WASSIM\APPLIC~1\TVU networks
   [12/06/2007|16:20] C:\DOCUME~1\WASSIM\APPLIC~1\Ulead Systems
   [19/02/2007|20:50] C:\DOCUME~1\WASSIM\APPLIC~1\user60.rdb
   [03/06/2007|19:18] C:\DOCUME~1\WASSIM\APPLIC~1\uTorrent
   [14/04/2007|14:12] C:\DOCUME~1\WASSIM\APPLIC~1\VadeRetro
   [27/09/2007|18:21] C:\DOCUME~1\WASSIM\APPLIC~1\Windows Desktop Search
   [01/11/2006|03:20] C:\DOCUME~1\WASSIM\APPLIC~1\You've Got Pictures Screensaver
 
   ----------------[ Tâches planifiées dans C:\WINDOWS	asks ]---------------

   [12/04/2008 13:35][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [15/04/2008 12:02][--ah-----] C:\WINDOWS	asks\SA.DAT
   [10/08/2004 15:00][-rah-----] C:\WINDOWS	asks\desktop.ini
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [15/04/2008|01:29] C:\Program Files\.
   [15/04/2008|01:29] C:\Program Files\..
   [30/06/2007|21:52] C:\Program Files\7-Zip
   [17/03/2008|13:51] C:\Program Files\Adobe
   [21/12/2007|16:49] C:\Program Files\Alcoda
   [22/02/2008|14:41] C:\Program Files\Alcohol Soft
   [12/04/2007|22:03] C:\Program Files\Alice
   [13/04/2007|17:11] C:\Program Files\Alwil Software
   [11/01/2007|23:59] C:\Program Files\AOL 9.0
   [01/11/2006|03:22] C:\Program Files\AOL Compagnon
   [07/11/2007|22:32] C:\Program Files\Apple Software Update
   [17/09/2007|20:03] C:\Program Files\Ares
   [14/04/2008|14:56] C:\Program Files\a-squared Free
   [14/03/2008|21:36] C:\Program Files\ATI Technologies
   [06/03/2008|20:30] C:\Program Files\Azureus
   [15/04/2008|00:53] C:\Program Files\CCleaner
   [03/04/2007|19:17] C:\Program Files\Ciel
   [08/04/2008|20:30] C:\Program Files\CleanUp!
   [30/06/2007|14:36] C:\Program Files\Common Files
   [01/11/2006|03:20] C:\Program Files\ComPlus Applications
   [31/05/2007|17:37] C:\Program Files\Corel
   [01/11/2006|03:20] C:\Program Files\CyberLink
   [12/06/2007|16:13] C:\Program Files\Digital Camera
   [06/12/2007|01:43] C:\Program Files\DivX
   [20/10/2007|12:36] C:\Program Files\EoRezo
   [02/04/2008|20:31] C:\Program Files\Fichiers communs
   [17/04/2007|08:54] C:\Program Files\Google
   [01/11/2006|03:20] C:\Program Files\Goto Software
   [11/01/2007|13:30] C:\Program Files\HP
   [15/04/2008|00:32] C:\Program Files\InstallShield Installation Information
   [11/04/2008|01:53] C:\Program Files\Internet Explorer
   [12/04/2008|15:34] C:\Program Files\iPod
   [14/01/2007|19:36] C:\Program Files\ISSENDIS
   [12/04/2008|15:34] C:\Program Files\iTunes
   [17/09/2007|19:59] C:\Program Files\IVCsoft
   [29/03/2007|18:15] C:\Program Files\Jasc Software Inc
   [07/03/2008|19:55] C:\Program Files\Java
   [16/07/2007|22:21] C:\Program Files\JCA2000
   [14/04/2008|20:48] C:\Program Files\K-Lite Codec Pack
   [02/04/2008|20:32] C:\Program Files\Lavasoft
   [01/11/2006|03:20] C:\Program Files\Learn2.com
   [28/04/2007|00:30] C:\Program Files\LimeWire
   [15/04/2008|01:29] C:\Program Files\Malwarebytes' Anti-Malware
   [22/02/2008|23:20] C:\Program Files\Messenger
   [31/03/2008|18:48] C:\Program Files\Messenger Plus! Live
   [22/02/2008|22:59] C:\Program Files\MessengerPlus! 3
   [19/01/2008|13:47] C:\Program Files\Microsoft ActiveSync
   [04/07/2007|15:53] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [01/11/2006|03:20] C:\Program Files\microsoft frontpage
   [13/01/2008|17:05] C:\Program Files\Microsoft Office
   [26/09/2007|16:11] C:\Program Files\Microsoft SQL Server Compact Edition
   [13/01/2008|17:05] C:\Program Files\Microsoft Visual Studio
   [13/01/2008|16:59] C:\Program Files\Microsoft Visual Studio 8
   [13/01/2008|17:06] C:\Program Files\Microsoft Works
   [13/01/2008|17:02] C:\Program Files\Microsoft.NET
   [14/04/2008|10:59] C:\Program Files\Movie Maker
   [15/04/2008|01:41] C:\Program Files\Mozilla Firefox
   [22/11/2007|00:17] C:\Program Files\MP3Gain
   [13/01/2008|17:06] C:\Program Files\MSBuild
   [01/02/2008|14:50] C:\Program Files\MSECache
   [14/01/2007|03:31] C:\Program Files\MSN
   [01/11/2006|03:20] C:\Program Files\MSN Gaming Zone
   [08/04/2008|20:35] C:\Program Files\MSN Messenger
   [13/04/2007|03:46] C:\Program Files\MSXML 4.0
   [12/04/2007|23:01] C:\Program Files\Musicmatch
   [14/04/2008|14:51] C:\Program Files\Navilog1
   [01/07/2007|01:07] C:\Program Files\Nero
   [01/11/2006|03:24] C:\Program Files\NetMeeting
   [04/04/2007|21:23] C:\Program Files\OFFICE One6.5
   [01/11/2006|03:24] C:\Program Files\Online Services
   [14/04/2008|10:59] C:\Program Files\Outlook Express
   [22/02/2008|14:00] C:\Program Files\Pcsx2_0.9.4
   [09/05/2007|13:26] C:\Program Files\PhotoFiltre
   [12/04/2008|15:29] C:\Program Files\QuickTime
   [23/09/2007|00:37] C:\Program Files\QuickZip4
   [27/12/2007|20:48] C:\Program Files\RayV
   [01/11/2006|03:20] C:\Program Files\Real
   [22/01/2007|19:09] C:\Program Files\Realtek
   [31/05/2007|04:03] C:\Program Files\Recovery for Word
   [12/04/2008|15:36] C:\Program Files\Safari
   [06/06/2007|16:11] C:\Program Files\Samsung
   [01/11/2006|03:24] C:\Program Files\Services en ligne
   [01/11/2006|03:20] C:\Program Files\SmartSound Software
   [01/11/2006|03:20] C:\Program Files\Sonic
   [21/01/2008|17:57] C:\Program Files\SopCast
   [02/08/2007|11:34] C:\Program Files	@b
   [17/10/2007|11:16] C:\Program Files\Trend Micro
   [12/06/2007|16:16] C:\Program Files\Ulead Systems
   [01/11/2006|03:20] C:\Program Files\Uninstall Information
   [01/11/2006|03:20] C:\Program Files\Viewpoint
   [26/09/2007|16:11] C:\Program Files\Windows Desktop Search
   [27/02/2008|15:09] C:\Program Files\Windows Live
   [15/10/2007|21:01] C:\Program Files\Windows Live Safety Center
   [29/09/2007|11:29] C:\Program Files\Windows Live Toolbar
   [01/11/2006|03:20] C:\Program Files\Windows Media Components
   [07/07/2007|01:34] C:\Program Files\Windows Media Connect 2
   [11/11/2007|01:15] C:\Program Files\Windows Media Player
   [22/01/2007|20:52] C:\Program Files\Windows NT
   [01/11/2006|03:20] C:\Program Files\Windows Plus
   [01/11/2006|03:20] C:\Program Files\WindowsUpdate
   [01/11/2006|03:24] C:\Program Files\X10 Hardware
   [01/11/2006|03:20] C:\Program Files\xerox
   [02/04/2008|20:56] C:\Program Files\Zone Labs
  
   ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
   
   [02/04/2008|20:31] C:\Program Files\Fichiers communs\.
   [02/04/2008|20:31] C:\Program Files\Fichiers communs\..
   [17/03/2008|13:52] C:\Program Files\Fichiers communs\Adobe
   [01/11/2006|03:23] C:\Program Files\Fichiers communs\AOL
   [01/11/2006|03:23] C:\Program Files\Fichiers communs\aolshare
   [30/06/2007|23:21] C:\Program Files\Fichiers communs\Apple
   [28/02/2008|14:39] C:\Program Files\Fichiers communs\Blizzard Entertainment
   [14/01/2007|19:36] C:\Program Files\Fichiers communs\Borland Shared
   [03/04/2007|19:17] C:\Program Files\Fichiers communs\Ciel
   [13/01/2008|17:05] C:\Program Files\Fichiers communs\DESIGNER
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\InstallShield
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\Java
   [14/04/2008|11:39] C:\Program Files\Fichiers communs\Microsoft Shared
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\MSSoap
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\Nullsoft
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\ODBC
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\Real
   [01/11/2006|03:23] C:\Program Files\Fichiers communs\Services
   [01/11/2006|03:23] C:\Program Files\Fichiers communs\Sonic Shared
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\SpeechEngines
   [01/11/2006|03:23] C:\Program Files\Fichiers communs\SureThing Shared
   [11/01/2007|13:16] C:\Program Files\Fichiers communs\Symantec Shared
   [13/01/2008|16:58] C:\Program Files\Fichiers communs\System
   [29/09/2007|11:27] C:\Program Files\Fichiers communs\Teleca Shared
   [01/11/2006|03:20] C:\Program Files\Fichiers communs\TiVo Shared
   [01/11/2006|03:23] C:\Program Files\Fichiers communs\Ulead Systems
   [04/12/2007|01:05] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [02/04/2008|20:31] C:\Program Files\Fichiers communs\Wise Installation Wizard

   ----------------------[ Recherche avec S_Lop ]---------------------

   Aucun fichier / dossier Lop trouvé ! 
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Long slow road itch\phone regs.exe
 
   ----------------------[ Verification du Registre ]----------------------

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 www.drivecleaner.com ## added by CiD
   127.0.0.1 www.errorprotector.com ## added by CiD
   127.0.0.1 www.errorsafe.com ## added by CiD
   127.0.0.1 www.systemdoctor.com ## added by CiD
   127.0.0.1 www.utils.winfixer.com ## added by CiD
   127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 www.win-virus-pro.com ## added by CiD
   127.0.0.1 www.winantispam.com ## added by CiD
   127.0.0.1 www.winantispy.com ## added by CiD
   127.0.0.1 www.winantispyware.com ## added by CiD
   127.0.0.1 www.winantivirus.com ## added by CiD
   127.0.0.1 www.winantiviruspro.com ## added by CiD
   127.0.0.1 www.windrivecleaner.com ## added by CiD
   127.0.0.1 www.windrivesafe.com ## added by CiD
   127.0.0.1 www.winfixer.com ## added by CiD
   127.0.0.1 www.winfixer2006.com ## added by CiD
   127.0.0.1 www.winsoftware.com ## added by CiD

   -> 71 ( 70 ## added by CiD )

   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-04-15 12:14:52
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------

   Aucune autre infection trouvée  !

   /!\ [Fich:3][Doss:3] C:\DOCUME~1\WASSIM\LOCALS~1\Temp
   /!\ [Fich:9][Doss:0] C:\DOCUME~1\WASSIM\Cookies
   /!\ [Fich:84][Doss:4] C:\DOCUME~1\WASSIM\LOCALS~1\TEMPOR~1\content.IE5

   --------------------[ Fin du rapport a 12:17:19,60  ]----------------------

Allen · Answer

Rapport Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:24:33, on 15/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\MonJack.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Allen · Answer

Bouddha t'es la ???

booddha · Answer

Oui, je ne fais que passer serais là ce soir.

Tu as bien fait la deuxième partie ?

• Pour nettoyer ce qui a été trouvé, relancer LopSD et choisir l'option 2 (Suppression)
• Copier/Coller le rapport LopR.txt + un nouveau rapport HijackThis

NB : un backup des suppressions sera créé dans le dossier de Lop S&D. 

Si oui, inutile de la refaire. Sino fais la.

Je n'ai pas vu le rapport de la procédure Malwares Bytes du message N° 5.

Si tu ne l'as pas fait, fais le.

Décris moi tes soucis si tu en as encore.

A ce soir

Allen · Answer

C'est bon pour la 2eme partie je l'avais faite . 

Il a trouvé un fichier dangereux et je les supprimer directement.

booddha · Answer

Tu n'as pas répondu à 2 questions

1) concernant Malwares Bytes

2) Concernant d'éventuels problèmes.

Allen · Answer

Ba enfaite mon ordi est un peu plus lent maintenan sinan pour malwares bytes je t'es deja envoyé le rapport il est plus haut.

booddha · Answer

Bon, je ne vois plus rien dans ton rapport. Pour le rapport Malwares, mes excuses (la fatigue sans doute).

================= TOOLSCLEANER2 ===================
Pour enlever les outils que l'on a utilisé.
• Télécharger ToolsCleaner2
• Double-clic dessus à l'endroit où il a été téléchargé :
• clic sur Recherche
• patienter un moment le temps qu'il travaille...
• Lorsque la recherche est terminée ToolsCleaner affiche une liste des différents outils trouvés,
• clic sur Suppression afin de les supprimer.
• Fermer le programme en cliquant sur Quitter.
• Poster le rapport qui se trouve ici >>> C:\TCleaner.txt
• Supprimer TOOLSCLEANER et tous les rapports ayant pu être sauvegardés.

=============== DESINSTALLER AVAST ==================

desintaller avast qui est une vrai passoire via le lien ci dessous

desintal Avast

===================== ANTIVIR ========================
Qui remplacera avantageusement AVAST

Télécharger ANTIVIR qui est un antivirus gratuit

Suivre la procédure jusqu'au bout. En cas de doute demander

Procédure d'installation

Pour les réglages

------
• Imprimer ou sauvegarder la procédure car le reste va se dérouler sans accés Internet
• Double-Click sur BootSafe.exe (Sur le bureau)
• Cocher Mode sans échec - Minimum
• Click sur le bouton Redémarrer
-------
• Faire une analyse complète de la machine

En fin de scan ( qui est assez long)
• Clic Sauvegarder REPORT puis Enregistrer sous et choisir bureau
-------
• Double-Click sur BootSafe.exe (Sur le bureau)
• Cocher Redémarrage normal
• Click sur le bouton Redémarrer
-------
• Copier/coller le rapport ici

================ AVG ANTI-SPYWARE ===================
Gratuit
Merci à ep44 pour ce mode explicatif
Télécharger:
AVG-AntiSpyware
• Installer
• Le lancer
• Click : Mise à jour
------
• Imprimer ou sauvegarder la procédure car le reste va se dérouler sans accés Internet
• Double-Click sur BootSafe.exe (Sur le bureau)
• Cocher Mode sans échec - Minimum
• Click sur le bouton Redémarrer
-------
• Dans ANALYSE ( en forme de loupe ) <<===== I M P O R T A N T
• Paramètres ==> sous COMMENT REAGIR==>click sur Actions recommandées ==>Quarantaine
• Click : Analyse complète du système

En fin de scan ( qui est assez long)
• Clic Appliquer toutes les actions <== ceci Très important
• Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
-------
• Double-Click sur BootSafe.exe (Sur le bureau)
• Cocher Redémarrage normal
• Click sur le bouton Redémarrer
-------
• Copier/coller le rapport ici

(Ne surveillera plus le PC en arrière-plan dans 30 jours mais pourra servir à faire des scans et supprimer les infections)

===================== CCLEANER ========================
Pour le petit coup de polish.
• Appliquer la procédure ci-dessous.
• l'outil pourra être conservé pour faire le ménage de temps en temps en appliquant la même procédure.
• Fermer toutes les applications
• Lancer CCLeaner
• cocher dans le menu Nettoyeur - onglet Windows :
Internet Explorer: Fichiers Internet Temporaires, Cookies
• Système: Vider la Poubelle, Fichiers Temporaires, Presse-papiers
• Avancé: Vieilles données du Prefetch
• Décocher dans le menu Options - sous-menu Avancé :
Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures
• Cocher dans le menu Nettoyeur - onglet Applications : Internet: Sun Java
• Cocher , si cela est possible, dans le menu Nettoyeur - onglet Applications :
Firefox/Mozilla: Cache Internet, Cookies
• Click sur Analyse
• Click sur le bouton Lancer le nettoyage dans le menu Nettoyeur.
• Click sur Registre
• Sélectionner tout
• Click sur Chercher des erreurs (En bas)

Une fois le scan terminé sélectionner tout
• Click sur Réparer les erreurs sélectionnées

=========== POINT DE RESTAURATION SYSTEME =============

* Désactivation :
Clic droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
• Appliquer
• patienter jusqu’à ce que cela soit marqué "désactivé" puis Ok.

* Activation :
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs"
• Appliquer
• patienter que cela soit à nouveau sur "surveillance" puis Ok.
• Redémarrer l'ordinateur..
• Mettre en résolu le topic (en haut dans le cadre jaune).

---------------------------------------
Une fois cela terminé, dis moi si ton ordinateur est plus rapide ou pas.

Allen · Answer

Bonsoir 

Voila le rapport de Toolscleaner2

-->- Recherche: 

C:\Lop SD: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\WASSIM\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\WASSIM\Bureau\Lop S&D.lnk: trouvé !
C:\Documents and Settings\WASSIM\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\WASSIM\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\WASSIM\Menu Démarrer\Programmes\Lop S&D: trouvé !
C:\Documents and Settings\WASSIM\Mes documents\programme\MsnFix: trouvé !
C:\Lop SD\Lop S&D.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\WASSIM\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\WASSIM\Bureau\Lop S&D.lnk: supprimé !
C:\Documents and Settings\WASSIM\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\WASSIM\Bureau\HJTInstall.exe: supprimé !
C:\Lop SD\Lop S&D.lnk: supprimé !
C:\Lop SD: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\WASSIM\Menu Démarrer\Programmes\Lop S&D: supprimé !
C:\Documents and Settings\WASSIM\Mes documents\programme\MsnFix: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Allen · Answer

Re Rapport de antivar apprés analyse



Avira AntiVir Personal
Report file date: mardi 15 avril 2008  23:36

Scanning for 1202665 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    YAHYAOUI

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  15/04/2008 21:31:55
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  15/04/2008 21:31:55
LUKE.DLL      : 8.1.2.9        151809 Bytes  15/04/2008 21:31:56
LUKERES.DLL   : 8.1.2.1         12033 Bytes  15/04/2008 21:31:56
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 13:27:15
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 21:31:57
ANTIVIR2.VDF  : 7.0.3.156      795136 Bytes  11/04/2008 21:31:57
ANTIVIR3.VDF  : 7.0.3.170      123904 Bytes  15/04/2008 21:31:57
Engineversion : 8.1.0.30  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  15/04/2008 21:31:57
AESCRIPT.DLL  : 8.1.0.23       233851 Bytes  15/04/2008 21:31:57
AESCN.DLL     : 8.1.0.13       115061 Bytes  15/04/2008 21:31:57
AERDL.DLL     : 8.1.0.19       418164 Bytes  15/04/2008 21:31:57
AEPACK.DLL    : 8.1.1.1        364918 Bytes  15/04/2008 21:31:57
AEOFFICE.DLL  : 8.1.0.17       192891 Bytes  15/04/2008 21:31:57
AEHEUR.DLL    : 8.1.0.18      1167735 Bytes  15/04/2008 21:31:57
AEHELP.DLL    : 8.1.0.12       115063 Bytes  15/04/2008 21:31:57
AEGEN.DLL     : 8.1.0.15       299379 Bytes  15/04/2008 21:31:57
AEEMU.DLL     : 8.1.0.5        430450 Bytes  15/04/2008 21:31:57
AECORE.DLL    : 8.1.0.26       168311 Bytes  15/04/2008 21:31:57
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  15/04/2008 21:31:55
AVPREF.DLL    : 8.0.0.1         25857 Bytes  15/04/2008 21:31:55
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 12:16:24
AVREG.DLL     : 8.0.0.0         30977 Bytes  15/04/2008 21:31:55
AVARKT.DLL    : 1.0.0.23       307457 Bytes  15/04/2008 21:31:55
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  15/04/2008 21:31:55
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  15/04/2008 21:31:56
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  15/04/2008 21:31:56
NETNT.DLL     : 8.0.0.1          7937 Bytes  15/04/2008 21:31:56
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  15/04/2008 21:31:52
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  15/04/2008 21:31:52

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 15 avril 2008  23:36

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'cidaemon.exe' - '1' Module(s) have been scanned
Scan process 'cidaemon.exe' - '1' Module(s) have been scanned
Scan process 'Safari.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'X10nets.exe' - '1' Module(s) have been scanned
Scan process 'searchindexer.exe' - '1' Module(s) have been scanned
Scan process 'USBDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'StarWindServiceAE.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'AOSD.EXE' - '1' Module(s) have been scanned
Scan process 'snmp.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'mmtask.exe' - '1' Module(s) have been scanned
Scan process 'ABOARD.EXE' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'Vaderetro_oe.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'PSIService.exe' - '1' Module(s) have been scanned
Scan process 'inetinfo.exe' - '1' Module(s) have been scanned
Scan process 'ehSched.exe' - '1' Module(s) have been scanned
Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned
Scan process 'cisvc.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
53 processes with 53 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!
      [WARNING]   Paramètre incorrect.
Master boot sector HD2
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
Master boot sector HD3
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
Master boot sector HD4
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.
Master boot sector HD5
      [INFO]      No virus was found!
      [WARNING]   Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '33' files ).


Starting the file scan:

Begin scan in 'C:\' <HDD>
C:\hiberfil.sys
      [WARNING]   The file could not be opened!
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP419\A0133274.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
      [NOTE]      The file was moved to '483632a8.qua'!
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP419\A0133277.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen
      [NOTE]      The file was moved to '483632b2.qua'!
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP425\A0136528.exe
      [DETECTION] Contains detection pattern of the dropper DR/Tool.Reboot.F.79
      [NOTE]      The file was moved to '48363307.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!


End of the scan: mercredi 16 avril 2008  01:28
Used time:  1:51:37 min

The scan has been done completely.

  12882 Scanning directories
 479580 Files were scanned
      3 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      3 files were moved to quarantine
      0 files were renamed
      3 Files cannot be scanned
 479577 Files not concerned
  13201 Archives were scanned
      8 Warnings
      3 Notes

Allen · Answer

Voila il n'y a pas de lien pour le fichier boot safe

booddha · Answer

Oki, laisse tomber BootSafe, c'est une erreur. Termine la procédure.

Allen · Answer

J'ai lancé l'analyse de avg est j'ai sauter toute les étapes avec boot safe je post le rapport des que c'est terminé et merci beaucoups pour ton aide.

Allen · Answer

RE voila le rapport avg

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	06:19:18 16/04/2008

 + Résultat de l'analyse:	



C:\Documents and Settings\WASSIM\Cookies\wassim@advertising[2].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\WASSIM\Cookies\wassim@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\WASSIM\Cookies\wassim@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\WASSIM\Cookies\wassim@nrjmobile.solution.weborama[2].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\WASSIM\Cookies\wassim@weborama[2].txt -> TrackingCookie.Weborama : Aucune action entreprise.


Fin du rapport

Allen · Answer

Bonjour Merci pour toute l'aide que tu ma apporter. J'ai fait tout ce que tu ma dit et voila je pense que mon pc et meilleur   il a un peu gagner en vitesse. Et il n'y a plus de virus enfin je pense. Encore merci pour tout. Je continu a lire le topic tant que tu ma pas dit que j'ai fini on ne sait jamais.

Allen · Answer

PS : si quelqu'un peut mettre le topic en resolu comme avec ccleaner j'ai supprimer les cookies je ne peut plus le faire.

booddha · Answer

Si tu as fini la procédure, c'est fini..... jusqu'à la prochaine fois ;)

Allen · Answer

OK un grand MERCI pour tout ce que tu a fait pour moi.

booddha · Answer

;)

VIRUS Trojan.Swizzor.WU comment le supprimer

27 réponses

Discussions similaires

Newsletters