Bonjour et bien venu sur CCM

pour commencer

* Télécharge malwarebytes
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

=> Installe le
=> Ensuite va en mode sans echec


Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel


=> Lance malwarebytes
=> Coche "Executer un examen complet"
=> Si tu es en présence d'une infection à la fin de l'examen clique sur "ok"
=> Clique sur Supprimer la sélection
=> Pour poster le rapport Clique sur l'onglet Rapports/Logs, sélectionne celui t'intéresse et clique sur Ouvrir
=> Fait copier coller et poste le rapport

--------------------------

ensuite

* Télécharge CCleaner
http://www.filehippo.com/download_ccleaner/
=> Aide toi de ce tuto pour l'utiliser
http://www.malekal.com/tutorial_CCleaner.php

--------------------------

Ensuite Télécharge BTFix 1.057 (de bibi26)
http://www.bibi26.power-heberg.com/logiciels/BTFix.zip
* Décompresse l'archive sur ton Bureau
* Ouvre le dossier BTFix
* Double clique sur BTFix.exe
* Clique sur Rechercher
* Un rapport va apparaître, copie/colle-le dans ta prochaine réponse

---------------------------
ensuite

Télécharge Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
=> déconnecte toi d'internet et ferme toutes tes applications.
=> désactive tes protections (antivirus, parefeu,antispyware)
=> Double-clic sur combofix,
=> Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
=> Attends que combofix ait terminé, un rapport sera créé.
=> réactive ton parefeu, ton antivirus, la garde de ton antispyware
=> copie/colle le rapport C:\ComboFix.txt

@+ C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Je ne pouvais pas entrer sur windows en "mode sans échec" (à cause d'un mot de passe de réseau) alors je suis allé en "mode sans échec prise en charge réseau". J'espère que c'est correct.

Je laisse le rapport malwarebytes. Ils disaient que certains éléments ne pouvaient pas être effacés, et ils me demandaient de redémarrer l'ordinateur pour que le processus se termine, ce que j'ai fais.

Merci pour l'aide!


Malwarebytes' Anti-Malware 1.12
Version de la base de données: 723

Type de recherche: Examen complet (C:\|)
Eléments examinés: 87929
Temps écoulé: 23 minute(s), 55 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 29
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 44

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\wvUmnKAq.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\wvUkLBrR.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d4a80003-1518-4eee-9ed2-cab2c3792c26} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{d4a80003-1518-4eee-9ed2-cab2c3792c26} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{ce86878f-d099-4ffc-a4dc-e51d192063b1} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce86878f-d099-4ffc-a4dc-e51d192063b1} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvuklbrr (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\uninstall (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b2-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b3-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b4-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b5-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b6-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b7-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b9-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488ba-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488bb-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8996b0a1-d7be-101b-8650-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d4573f8e (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oqovlkiy (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\drrIu6967i (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{ce86878f-d099-4ffc-a4dc-e51d192063b1} (Trojan.Vundo) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvumnkaq -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvumnkaq -> Delete on reboot.

Dossier(s) infecté(s):
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\chsqxaem.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\meaxqshc.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvUmnKAq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qAKnmUvw.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qAKnmUvw.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ypyjkfop.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\yperajyz\sjefazez.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvUkLBrR.dll (Trojan.Vundo) -> Delete on reboot.
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP2\A0002601.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\unopek.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mrgzspst.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Cfx32.ocx (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\CFX32.LIC (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\temp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

BTFix n'a trouvé aucune erreur... voici le rapport:

BTFix 1.098 (par bibi26) - 06/05/2008 14:29:33 - Analyse
Lancé depuis C:\Documents and Settings\gaumes1\Bureau\btfix\BTFix\BTFix.exe

---> Fichiers/Dossiers trouvés


---> Analyse terminée le 06/05/2008 14:29:33

Alors voici enfin le rapport de Combofix:

ComboFix 08-05-01.3 - GAUMES1 2008-05-06 14:39:27.1 - NTFSx86 NETWORK
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.804 [GMT -4:00]
Endroit: C:\Documents and Settings\gaumes1\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\smp.bat
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ggfblvfu.ini
C:\WINDOWS\system32\hgggOXyb.ini
C:\WINDOWS\system32\hgggOXyb.ini2
C:\WINDOWS\system32\lkhbfnya.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mvpkavvq.ini
C:\WINDOWS\system32\nejtgavr.ini
C:\WINDOWS\system32\nsfdfxus.ini
C:\WINDOWS\system32\qAKnmUvw.ini
C:\WINDOWS\system32\qAKnmUvw.ini2
C:\WINDOWS\system32\wvUkLBrR.dll
C:\WINDOWS\system32\wvUmnKAq.dll
C:\WINDOWS\system32\yvqxtvsm.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-06 to 2008-05-06 ))))))))))))))))))))))))))))))))))))
.

2008-05-06 14:21 . 2008-05-06 14:21 <REP> d-------- C:\Program Files\CCleaner
2008-05-06 11:22 . 2008-05-06 11:22 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-05-06 10:45 . 2008-05-06 10:45 <REP> d-------- C:\Documents and Settings\gaumes1\Application Data\Malwarebytes
2008-05-06 10:44 . 2008-05-06 10:44 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-06 10:44 . 2008-05-06 10:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-06 10:44 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-06 10:44 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-06 09:23 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-06 09:22 . 2008-05-06 09:22 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-05-05 12:46 . 2008-05-05 13:10 <REP> d-------- C:\Program Files\Spyware Terminator
2008-05-05 12:46 . 2008-05-05 13:10 <REP> d-------- C:\Documents and Settings\gaumes1\Application Data\Spyware Terminator
2008-05-05 12:46 . 2008-05-05 13:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-05-05 12:46 . 2008-05-05 12:46 141,312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-05-02 23:13 . 2008-05-02 23:14 153 --a------ C:\WINDOWS\wininit.ini
2008-05-02 12:09 . 2008-05-02 12:09 <REP> d-------- C:\Program Files\Enigma Software Group
2008-05-02 10:59 . 2004-08-04 00:54 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2008-05-02 10:57 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys
2008-05-02 10:56 . 2001-08-17 21:28 765,884 --a--c--- C:\WINDOWS\system32\dllcache\usrti.sys
2008-05-02 10:55 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-05-02 10:54 . 2001-08-23 17:47 525,568 --a--c--- C:\WINDOWS\system32\dllcache\tridxp.dll
2008-05-02 10:53 . 2001-08-17 22:01 241,664 --a--c--- C:\WINDOWS\system32\dllcache\tosdvd02.sys
2008-05-02 10:52 . 2001-08-23 17:46 172,768 --a--c--- C:\WINDOWS\system32\dllcache\t2r4disp.dll
2008-05-02 10:51 . 2001-08-23 16:57 286,848 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys
2008-05-02 10:50 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys
2008-05-02 10:49 . 2004-08-04 00:54 286,792 --a--c--- C:\WINDOWS\system32\dllcache\slextspk.dll
2008-05-02 10:48 . 2001-08-23 17:47 495,616 --a--c--- C:\WINDOWS\system32\dllcache\sblfx.dll
2008-05-02 10:47 . 2004-08-04 00:54 397,056 --a--c--- C:\WINDOWS\system32\dllcache\s3gnb.dll
2008-05-02 10:46 . 2001-08-23 17:18 899,914 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-05-02 10:45 . 2004-08-04 00:54 363,520 --a--c--- C:\WINDOWS\system32\dllcache\psisdecd.dll
2008-05-02 10:44 . 2004-08-04 00:53 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll
2008-05-02 10:43 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-05-02 10:42 . 2004-08-04 00:54 4,274,816 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll
2008-05-02 10:41 . 2004-08-04 00:47 132,695 --a--c--- C:\WINDOWS\system32\dllcache\netwlan5.sys
2008-05-02 10:40 . 2004-08-04 00:54 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-05-02 10:39 . 2001-08-23 17:03 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys
2008-05-02 10:38 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-05-02 10:37 . 2001-08-23 17:47 242,688 --a--c--- C:\WINDOWS\system32\dllcache\kdsusd.dll
2008-05-02 10:37 . 2001-08-23 17:47 46,080 --a--c--- C:\WINDOWS\system32\dllcache\kdsui.dll
2008-05-02 10:37 . 2004-08-04 00:45 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-05-02 10:37 . 2001-08-23 17:47 8,704 --a--c--- C:\WINDOWS\system32\dllcache\kbdjpn.dll
2008-05-02 10:37 . 2001-08-23 17:47 8,192 --a--c--- C:\WINDOWS\system32\dllcache\kbdkor.dll
2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd106.dll
2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101c.dll
2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101b.dll
2008-05-02 10:37 . 2001-08-17 22:55 5,632 --a--c--- C:\WINDOWS\system32\dllcache\kbd103.dll
2008-05-02 10:35 . 2001-08-23 17:47 372,824 --a--c--- C:\WINDOWS\system32\dllcache\iconf32.dll
2008-05-02 10:34 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-05-02 10:33 . 2001-08-17 21:28 542,879 --a--c--- C:\WINDOWS\system32\dllcache\hsf_msft.sys
2008-05-02 10:32 . 2001-08-23 17:46 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-05-02 10:31 . 2001-08-17 20:15 455,680 --a--c--- C:\WINDOWS\system32\dllcache\fus2base.sys
2008-05-02 10:30 . 2001-08-23 17:13 634,166 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys
2008-05-02 10:29 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2008-05-02 10:28 . 2001-08-23 17:47 422,429 --a--c--- C:\WINDOWS\system32\dllcache\dgconfig.dll
2008-05-02 10:27 . 2001-08-23 17:04 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-05-02 10:26 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-05-02 10:25 . 2004-08-04 00:54 870,784 --a--c--- C:\WINDOWS\system32\dllcache\ati3d1ag.dll
2008-05-02 10:24 . 2001-08-17 21:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-05-01 16:25 . 2008-05-02 10:09 3,420 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-01 15:32 . 2008-05-06 14:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\yperajyz
2008-05-01 15:13 . 2008-05-06 14:38 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
2008-04-17 22:19 . 2008-04-17 22:50 <REP> d-------- C:\WINDOWS\system32\Adobe
2008-04-15 15:37 . 2008-04-15 15:37 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-15 15:37 . 2008-04-15 15:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-06 14:42 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Skype
2008-05-06 14:07 --------- d-----w C:\Program Files\PointsecLogs
2008-05-06 13:23 --------- d-----w C:\Program Files\Java
2008-05-06 13:00 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\skypePM
2008-05-06 03:38 --------- d-----w C:\Program Files\Online Bible
2008-05-04 18:03 --------- d-----w C:\Program Files\Pointsec
2008-03-31 14:30 --------- d-----w C:\Program Files\QuickTime
2008-03-24 20:22 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\OpenSong
2008-03-24 20:19 --------- d-----w C:\Program Files\OpenSong
2008-03-18 13:56 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Image Zone Express
2008-03-18 13:53 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\HP
2008-03-15 05:10 --------- d-----w C:\Program Files\Sun Life
2008-03-15 05:08 --------- d-----w C:\Program Files\Fichiers communs\Data Dynamics
2008-03-15 05:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-15 05:07 --------- d-----w C:\Program Files\Vortex
2008-03-15 04:53 --------- d-----w C:\Program Files\ZoomExpressKeyview
2008-03-13 15:10 3,905 ----a-w C:\WINDOWS\system32\drivers\stac97e.log
2008-03-09 03:30 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-07 20:35 --------- d-----w C:\Program Files\HP
2008-03-07 20:35 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-07 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-03-07 20:33 --------- d-----w C:\Program Files\Hewlett-Packard
2008-03-07 20:31 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-03-06 20:39 --------- d-----w C:\Program Files\Naviplan
2008-03-06 20:38 --------- d-----w C:\Program Files\Fichiers communs\IG Shared
2008-03-06 20:37 --------- d-----w C:\Program Files\IG Advantage
2008-03-04 21:17 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-04 14:55 6 ----a-w C:\VOL_CHAR.DAT
2008-03-04 14:55 1,715,200 --sha-r C:\PROT_INS.SYS
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 08:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592]
"SecureLogin"="C:\Program Files\Protocom\SecureLogin\slproto.exe" [2005-06-29 18:29 356352]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-31 10:30 385024]
"Protect Tray"="C:\Program Files\Pointsec\P95tray.exe" [2005-12-28 08:41 344064]
"Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe" [2003-10-07 10:48 147514]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 22:00 344064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 21:00 94208]
"McAfeeUpdaterUI"="C:\Program Files\network associates\common framework\UdaterUI.exe" [2007-10-25 16:06 136512]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-05 08:00 160768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Malwarebytes Anti-Malware Reboot"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-05-05 20:46 1179256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 08:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvUkLBrR]
wvUkLBrR.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^gaumes1^Menu Démarrer^Programmes^Démarrage^Webshots.lnk]
path=C:\Documents and Settings\gaumes1\Menu Démarrer\Programmes\Démarrage\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 2007-01-01 17:22 3739648 C:\Program Files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-06 19:37 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SharedAccess"=2 (0x2)
"sp_rssrv"=2 (0x2)
"McShield"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%programfiles%\\Intel\\Intel NetStructure VPN Client\\icdesk.exe"=
"%windir%\\system32\\dwrcs.exe"=
"%ProgramFiles%\\Microsoft Office\\Office10\\OUTLOOK.EXE"=
"%ProgramFiles%\\Microsoft Office\\Office11\\OUTLOOK.EXE"=
"%ProgramFiles%\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%ProgramFiles%\\IG Advantage\\IGConSys\\jobs\\JobControlFiles.EXE"=
"%ProgramFiles%\\IG Advantage\\IGConSys\\jobs\\JobPhoneList.EXE"=
"%ProgramFiles%\\ACT\\ACT for Windows\\ActSage.exe"=
"%ProgramFiles%\\ACT\\ACT for Windows\\Act8.exe"=
"%ProgramFiles%\\Microsoft SQL Server\\MSSQL.1\\MSSQL\\Binn\\sqlservr.exe"=
"%windir%\\system32\\mqsvc.exe"=
"C:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"137:UDP"= 137:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Name Service
"138:UDP"= 138:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Datagram Service
"139:TCP"= 139:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Session Service
"445:TCP"= 445:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:SMB over TCP
"6129:TCP"= 6129:TCP:10.0.0.0/8,156.11.0.0/16:Enabled:Dameware Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 prot_2k;prot_2k;C:\WINDOWS\system32\drivers\prot_2k.sys [2005-12-21 15:12]
R3 ICvnic;VPN Client Virtual Adapter;C:\WINDOWS\system32\DRIVERS\ICvnic.sys [2002-05-01 15:19]
S1 ICsrvr;VPN Client Protocol;C:\WINDOWS\system32\DRIVERS\ICsrvr.sys [2002-05-01 15:20]
S1 ICtdi;VPN Client TDI Driver;C:\WINDOWS\system32\DRIVERS\ictdi.sys [2002-05-01 15:19]
S2 ICService;Intel(R) NetStructure(TM) VPN Client;C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe [2002-05-01 15:35]
S2 Pointsec;Pointsec;C:\WINDOWS\system32\PROT_SRV.EXE [2005-12-28 08:41]
S2 Pointsec_agent;Pointsec update agent;C:\WINDOWS\system32\pagents.exe [2005-09-16 02:56]
S2 Pointsec_start;Pointsec service start;C:\WINDOWS\system32\PSTARTSR.EXE [2005-12-28 08:41]
S3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2005-05-31 12:46]
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-05 20:46]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-06 14:43:40
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 1

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\icgina.dll
-> C:\WINDOWS\system32\ICGinaApi.dll
.
Temps d'accomplissement: 2008-05-06 14:46:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-06 18:46:00

Pre-Run: 25,870,684,160 octets libres
Post-Run: 26,134,302,720 octets libres

224 --- E O F --- 2008-04-10 04:20:35

Selectionne ceci

registry::

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvUkLBrR]



* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Veille à ce que Retour à la ligne ne soit pas coché dans Format.
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt
* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme ceci
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

@+

ensuite fait un scan en ligne

avec bitdefender et colle le rapport

http://www.bitdefender.com/scan8/ie.html

Scan à faire sous Internet Explorer

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm

plus un nouveau hijack

@+
C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Rapport du scan combofix...

ComboFix 08-05-01.3 - GAUMES1 2008-05-06 15:41:02.2 - NTFSx86 NETWORK
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.804 [GMT -4:00]
Endroit: C:\Documents and Settings\gaumes1\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\gaumes1\Bureau\CFScript.txt

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-06 to 2008-05-06 ))))))))))))))))))))))))))))))))))))
.

2008-05-06 11:22 . 2008-05-06 11:22 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-05-06 10:45 . 2008-05-06 10:45 <REP> d-------- C:\Documents and Settings\gaumes1\Application Data\Malwarebytes
2008-05-06 10:44 . 2008-05-06 10:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-06 09:23 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-06 09:22 . 2008-05-06 09:22 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-05-02 23:13 . 2008-05-02 23:14 153 --a------ C:\WINDOWS\wininit.ini
2008-05-02 10:59 . 2004-08-04 00:54 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2008-05-02 10:57 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys
2008-05-02 10:56 . 2001-08-17 21:28 765,884 --a--c--- C:\WINDOWS\system32\dllcache\usrti.sys
2008-05-02 10:55 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-05-02 10:54 . 2001-08-23 17:47 525,568 --a--c--- C:\WINDOWS\system32\dllcache\tridxp.dll
2008-05-02 10:53 . 2001-08-17 22:01 241,664 --a--c--- C:\WINDOWS\system32\dllcache\tosdvd02.sys
2008-05-02 10:52 . 2001-08-23 17:46 172,768 --a--c--- C:\WINDOWS\system32\dllcache\t2r4disp.dll
2008-05-02 10:51 . 2001-08-23 16:57 286,848 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys
2008-05-02 10:50 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys
2008-05-02 10:49 . 2004-08-04 00:54 286,792 --a--c--- C:\WINDOWS\system32\dllcache\slextspk.dll
2008-05-02 10:48 . 2001-08-23 17:47 495,616 --a--c--- C:\WINDOWS\system32\dllcache\sblfx.dll
2008-05-02 10:47 . 2004-08-04 00:54 397,056 --a--c--- C:\WINDOWS\system32\dllcache\s3gnb.dll
2008-05-02 10:46 . 2001-08-23 17:18 899,914 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-05-02 10:45 . 2004-08-04 00:54 363,520 --a--c--- C:\WINDOWS\system32\dllcache\psisdecd.dll
2008-05-02 10:44 . 2004-08-04 00:53 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll
2008-05-02 10:43 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-05-02 10:42 . 2004-08-04 00:54 4,274,816 --a--c--- C:\WINDOWS\system32\dllcache\nv4_disp.dll
2008-05-02 10:41 . 2004-08-04 00:47 132,695 --a--c--- C:\WINDOWS\system32\dllcache\netwlan5.sys
2008-05-02 10:40 . 2004-08-04 00:54 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll
2008-05-02 10:39 . 2001-08-23 17:03 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys
2008-05-02 10:38 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-05-02 10:37 . 2001-08-23 17:47 242,688 --a--c--- C:\WINDOWS\system32\dllcache\kdsusd.dll
2008-05-02 10:37 . 2001-08-23 17:47 46,080 --a--c--- C:\WINDOWS\system32\dllcache\kdsui.dll
2008-05-02 10:37 . 2004-08-04 00:45 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-05-02 10:37 . 2001-08-23 17:47 8,704 --a--c--- C:\WINDOWS\system32\dllcache\kbdjpn.dll
2008-05-02 10:37 . 2001-08-23 17:47 8,192 --a--c--- C:\WINDOWS\system32\dllcache\kbdkor.dll
2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd106.dll
2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101c.dll
2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101b.dll
2008-05-02 10:37 . 2001-08-17 22:55 5,632 --a--c--- C:\WINDOWS\system32\dllcache\kbd103.dll
2008-05-02 10:35 . 2001-08-23 17:47 372,824 --a--c--- C:\WINDOWS\system32\dllcache\iconf32.dll
2008-05-02 10:34 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys
2008-05-02 10:33 . 2001-08-17 21:28 542,879 --a--c--- C:\WINDOWS\system32\dllcache\hsf_msft.sys
2008-05-02 10:32 . 2001-08-23 17:46 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-05-02 10:31 . 2001-08-17 20:15 455,680 --a--c--- C:\WINDOWS\system32\dllcache\fus2base.sys
2008-05-02 10:30 . 2001-08-23 17:13 634,166 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys
2008-05-02 10:29 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2008-05-02 10:28 . 2001-08-23 17:47 422,429 --a--c--- C:\WINDOWS\system32\dllcache\dgconfig.dll
2008-05-02 10:27 . 2001-08-23 17:04 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-05-02 10:26 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-05-02 10:25 . 2004-08-04 00:54 870,784 --a--c--- C:\WINDOWS\system32\dllcache\ati3d1ag.dll
2008-05-02 10:24 . 2001-08-17 21:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-05-01 16:25 . 2008-05-02 10:09 3,420 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-01 15:32 . 2008-05-06 14:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\yperajyz
2008-05-01 15:13 . 2008-05-06 14:38 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
2008-04-17 22:19 . 2008-04-17 22:50 <REP> d-------- C:\WINDOWS\system32\Adobe
2008-04-15 15:37 . 2008-05-06 14:53 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-06 19:35 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Skype
2008-05-06 19:26 --------- d-----w C:\Program Files\Online Bible
2008-05-06 19:09 --------- d-----w C:\Program Files\PointsecLogs
2008-05-06 13:23 --------- d-----w C:\Program Files\Java
2008-05-06 13:00 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\skypePM
2008-05-04 18:03 --------- d-----w C:\Program Files\Pointsec
2008-03-31 14:30 --------- d-----w C:\Program Files\QuickTime
2008-03-24 20:22 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\OpenSong
2008-03-24 20:19 --------- d-----w C:\Program Files\OpenSong
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-18 13:56 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Image Zone Express
2008-03-18 13:53 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\HP
2008-03-15 05:10 --------- d-----w C:\Program Files\Sun Life
2008-03-15 05:08 --------- d-----w C:\Program Files\Fichiers communs\Data Dynamics
2008-03-15 05:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-15 05:07 --------- d-----w C:\Program Files\Vortex
2008-03-15 04:53 --------- d-----w C:\Program Files\ZoomExpressKeyview
2008-03-13 15:10 3,905 ----a-w C:\WINDOWS\system32\drivers\stac97e.log
2008-03-09 03:30 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-07 20:35 --------- d-----w C:\Program Files\HP
2008-03-07 20:35 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-03-07 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-03-07 20:33 --------- d-----w C:\Program Files\Hewlett-Packard
2008-03-07 20:31 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-03-06 20:39 --------- d-----w C:\Program Files\Naviplan
2008-03-06 20:38 --------- d-----w C:\Program Files\Fichiers communs\IG Shared
2008-03-06 20:37 --------- d-----w C:\Program Files\IG Advantage
2008-03-04 21:17 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-03-04 14:55 6 ----a-w C:\VOL_CHAR.DAT
2008-03-04 14:55 1,715,200 --sha-r C:\PROT_INS.SYS
2008-03-04 14:46 88,576 ----a-w C:\WINDOWS\system32\ICGINAAPI.DLL
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-11 14:04 24,728 ----a-w C:\WINDOWS\system32\novamnv5.dll
2008-02-11 14:04 18,584 ----a-w C:\WINDOWS\system32\novamiv5.dll
.

((((((((((((((((((((((((((((( snapshot@2008-05-06_14.45.50.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-06 18:42:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-06 19:37:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 08:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592]
"SecureLogin"="C:\Program Files\Protocom\SecureLogin\slproto.exe" [2005-06-29 18:29 356352]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-31 10:30 385024]
"Protect Tray"="C:\Program Files\Pointsec\P95tray.exe" [2005-12-28 08:41 344064]
"Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe" [2003-10-07 10:48 147514]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 22:00 344064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 21:00 94208]
"McAfeeUpdaterUI"="C:\Program Files\network associates\common framework\UdaterUI.exe" [2007-10-25 16:06 136512]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2004-08-05 08:00 160768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Malwarebytes Anti-Malware Reboot"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 08:00 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^gaumes1^Menu Démarrer^Programmes^Démarrage^Webshots.lnk]
path=C:\Documents and Settings\gaumes1\Menu Démarrer\Programmes\Démarrage\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 2007-01-01 17:22 3739648 C:\Program Files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-06 19:37 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"sp_rssrv"=2 (0x2)
"McShield"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%programfiles%\\Intel\\Intel NetStructure VPN Client\\icdesk.exe"=
"%windir%\\system32\\dwrcs.exe"=
"%ProgramFiles%\\Microsoft Office\\Office10\\OUTLOOK.EXE"=
"%ProgramFiles%\\Microsoft Office\\Office11\\OUTLOOK.EXE"=
"%ProgramFiles%\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%ProgramFiles%\\IG Advantage\\IGConSys\\jobs\\JobControlFiles.EXE"=
"%ProgramFiles%\\IG Advantage\\IGConSys\\jobs\\JobPhoneList.EXE"=
"%ProgramFiles%\\ACT\\ACT for Windows\\ActSage.exe"=
"%ProgramFiles%\\ACT\\ACT for Windows\\Act8.exe"=
"%ProgramFiles%\\Microsoft SQL Server\\MSSQL.1\\MSSQL\\Binn\\sqlservr.exe"=
"%windir%\\system32\\mqsvc.exe"=
"C:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"137:UDP"= 137:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Name Service
"138:UDP"= 138:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Datagram Service
"139:TCP"= 139:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Session Service
"445:TCP"= 445:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:SMB over TCP
"6129:TCP"= 6129:TCP:10.0.0.0/8,156.11.0.0/16:Enabled:Dameware Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 prot_2k;prot_2k;C:\WINDOWS\system32\drivers\prot_2k.sys [2005-12-21 15:12]
R3 ICvnic;VPN Client Virtual Adapter;C:\WINDOWS\system32\DRIVERS\ICvnic.sys [2002-05-01 15:19]
S1 ICsrvr;VPN Client Protocol;C:\WINDOWS\system32\DRIVERS\ICsrvr.sys [2002-05-01 15:20]
S1 ICtdi;VPN Client TDI Driver;C:\WINDOWS\system32\DRIVERS\ictdi.sys [2002-05-01 15:19]
S2 ICService;Intel(R) NetStructure(TM) VPN Client;C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe [2002-05-01 15:35]
S2 Pointsec;Pointsec;C:\WINDOWS\system32\PROT_SRV.EXE [2005-12-28 08:41]
S2 Pointsec_agent;Pointsec update agent;C:\WINDOWS\system32\pagents.exe [2005-09-16 02:56]
S2 Pointsec_start;Pointsec service start;C:\WINDOWS\system32\PSTARTSR.EXE [2005-12-28 08:41]
S3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2005-05-31 12:46]
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-06 15:42:54
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\icgina.dll
-> C:\WINDOWS\system32\ICGinaApi.dll
.
Temps d'accomplissement: 2008-05-06 15:43:36
ComboFix-quarantined-files.txt 2008-05-06 19:43:33
ComboFix2.txt 2008-05-06 18:46:04

Pre-Run: 26,132,746,240 octets libres
Post-Run: 26,137,956,352 octets libres

208 --- E O F --- 2008-04-10 04:20:35

Ok maintenant le scan
@+ C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Alors voici le Scan et le rapport HIJACKTHIS:


BitDefender Online Scanner



Scan report generated at: Tue, May 06, 2008 - 16:20:36





Scan path: C:\;D:\;







Statistics

Time
00:28:32

Files
159063

Folders
4397

Boot Sectors
2

Archives
925

Packed Files
7988




Results

Identified Viruses
3

Infected Files
5

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
5




Engines Info

Virus Definitions
1189986

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
16

Archive plugins
42

Unpack plugins
7

E-mail plugins
6

System plugins
5




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe=>wise0031
Detected with: Adware.Gator.AD

C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe=>wise0031
Deleted

C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe
Update failed

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000001.ini
Infected with: Trojan.Vundo.DVS

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000001.ini
Disinfection failed

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000001.ini
Deleted

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000019.ini
Infected with: Trojan.Vundo.DVS

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000019.ini
Disinfection failed

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000019.ini
Deleted

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000066.ini
Infected with: Trojan.Vundo.DVS

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000066.ini
Disinfection failed

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000066.ini
Deleted

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP6\A0003206.dll
Infected with: Trojan.PWS.Agent.SDB

C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP6\A0003206.dll
Deleted





Rapport HIJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25, on 2008-05-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\gaumes1\Local Settings\Temporary Internet Files\Content.IE5\S7E7VXMP\HiJackThis[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/Content/fr/default.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = igproxy.investorsgroup.com:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://home*.investorsgroup.com;https://businesslinkonwinfund.investorsgroup.com;*.ig.bz;*.iga.bz;*.gwl.ca;*.gwl.bz;*mycybrary.londonlife.com;*cybrary.londonlife.com;*.ll.bz;*.grsaccess.com;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: SecureLogin IESSO Browser Helper Object - {7DE7B623-A17E-4A0B-94BA-D1B3BA646792} - C:\Program Files\Protocom\SecureLogin\iesso.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SecureLogin] "C:\Program Files\Protocom\SecureLogin\slproto.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Protect Tray] "C:\Program Files\Pointsec\P95tray.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\network associates\common framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Controleur de Connection GI.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\Software\..\Telephony: DomainName = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R) NetStructure(TM) VPN Client (ICService) - Unknown owner - C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\network associates\common framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Pointsec - Unknown owner - C:\WINDOWS\system32\PROT_SRV.EXE
O23 - Service: Pointsec update agent (Pointsec_agent) - Unknown owner - C:\WINDOWS\system32\pagents.exe
O23 - Service: Pointsec service start (Pointsec_start) - Unknown owner - C:\WINDOWS\system32\PSTARTSR.EXE
End of file - 8142 bytes

Re

Télécharge sur le bureau http://siri.urz.free.fr/Fix/SmitfraudFix.exe
=> Double clic sur SmitfraudFix.zip
=> Extraire tout
=> Double clic sur SmitfraudFix
=> Double Clic sur SmitfraudFix.cmd
=> Choisir Option 1
=> poste le rapport
@+ C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Rapport Smitfraudfix:

SmitFraudFix v2.320

Rapport fait à 19:32:03.15, 2008-05-06
Executé à partir de C:\Documents and Settings\gaumes1\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\gaumes1


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\gaumes1\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\gaumes1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom NetXtreme 57xx Gigabit Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0B1138E6-3721-4E59-8FBB-8A4EBA7271EF}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0B1138E6-3721-4E59-8FBB-8A4EBA7271EF}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0B1138E6-3721-4E59-8FBB-8A4EBA7271EF}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=156.11.98.121 156.11.219.1 156.11.98.122
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=156.11.98.121 156.11.219.1 156.11.98.122
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=156.11.98.121 156.11.219.1 156.11.98.122


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonjour connais tu cette adresse 156.11.98.121 156.11.219.1 156.11.98.122
? C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Aucune idée. La compagnie où je travaille fait des mises à jour automatiques quotidiennement sur mon ordinateur. Aussi, une fois, il y avait eu un expert de la compagnie où je travaille qui s'était connecté sur mon ordi pour arranger quelques éléments qui ne fonctionnaient pas. Je ne sais pas si tout ça peut être lié.

Pas sur mais pour vérif

Télécharge FixWareout de l'un de ces deux liens :
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Sauvegarde-le sur ton Bureau, puis lance-le.
Clique Next, puis Install, et assure-toi que "Run fixit" soit coché, puis clique Finish.
Suis les directives à l'écran.
L'outil va te demander de redémarrer ton PC; fais-le s'il te plaît.
Le redémarrage risque de prendre un peu plus de temps; ceci est normal.

Lorsque redémarré, un fichier texte apparaîtra (report.txt); copie/colle ce rapport dans ta prochaine réponse, avec un nouveau rapport HijackThis également. C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Voici le rapport FixWareout d'abord, et le hijack ensuite.

FIXWAREOUT:

Username "GAUMES1" - 2008-05-07 11:37:36 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"UpdateManager"="\"C:\\Program Files\\Fichiers communs\\Sonic\\Update Manager\\sgtray.exe\" /r"
"SecureLogin"="\"C:\\Program Files\\Protocom\\SecureLogin\\slproto.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Protect Tray"="\"C:\\Program Files\\Pointsec\\P95tray.exe\""
"Network Associates Error Reporting Service"="\"C:\\Program Files\\Fichiers communs\\Network Associates\\TalkBack\\tbmon.exe\""
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE"
"McAfeeUpdaterUI"="\"C:\\Program Files\\network associates\\common framework\\UdaterUI.exe\" /StartedFromRunKey"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe\""
"Malwarebytes Anti-Malware Reboot"="\"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe\" /runcleanupscript"
"MSConfig"="C:\\WINDOWS\\pchealth\\helpctr\\Binaries\\MSCONFIG.EXE /auto"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~



RAPPORT HIJACK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45, on 2008-05-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
C:\Program Files\network associates\common framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PROT_SRV.EXE
C:\WINDOWS\system32\pagents.exe
C:\WINDOWS\system32\PSTARTSR.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe
C:\Program Files\Pointsec\P95tray.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Protocom\SECURE~1\slbroker.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\network associates\common framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\network associates\common framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IG Advantage\Igconsys\ConSched.exe
C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\network associates\common framework\McScript_InUse.exe
C:\Program Files\Network Associates\VirusScan\SCAN32.EXE
C:\Documents and Settings\gaumes1\Local Settings\Temporary Internet Files\Content.IE5\X7TVFABX\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/Content/fr/default.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = igproxy.investorsgroup.com:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://home*.investorsgroup.com;https://businesslinkonwinfund.investorsgroup.com;*.ig.bz;*.iga.bz;*.gwl.ca;*.gwl.bz;*mycybrary.londonlife.com;*cybrary.londonlife.com;*.ll.bz;*.grsaccess.com;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: SecureLogin IESSO Browser Helper Object - {7DE7B623-A17E-4A0B-94BA-D1B3BA646792} - C:\Program Files\Protocom\SecureLogin\iesso.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SecureLogin] "C:\Program Files\Protocom\SecureLogin\slproto.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Protect Tray] "C:\Program Files\Pointsec\P95tray.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\network associates\common framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Controleur de Connection GI.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\Software\..\Telephony: DomainName = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R) NetStructure(TM) VPN Client (ICService) - Unknown owner - C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\network associates\common framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Pointsec - Unknown owner - C:\WINDOWS\system32\PROT_SRV.EXE
O23 - Service: Pointsec update agent (Pointsec_agent) - Unknown owner - C:\WINDOWS\system32\pagents.exe
O23 - Service: Pointsec service start (Pointsec_start) - Unknown owner - C:\WINDOWS\system32\PSTARTSR.EXE
End of file - 9479 bytes

Tu vas te rendre sur ce site
http://www.virustotal.com/fr/

et faire analyser ces fichiers

C:\Program Files\IG Advantage\Igconsys\ConSched.exe
C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe"

Et colle les résultats
@+

C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Alors voici les 3 résultats...
____________________________________________________________­__________________________
Fichier ConSched.exe reçu le 2008.05.07 20:22:43 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 0/31 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.3.0 2008.05.07 -
AntiVir 7.8.0.11 2008.05.07 -
Authentium 4.93.8 2008.05.07 -
Avast 4.8.1169.0 2008.05.07 -
AVG 7.5.0.516 2008.05.07 -
BitDefender 7.2 2008.05.07 -
CAT-QuickHeal 9.50 2008.05.07 -
ClamAV 0.92.1 2008.05.07 -
DrWeb 4.44.0.09170 2008.05.07 -
eSafe 7.0.15.0 2008.05.07 -
eTrust-Vet 31.4.5766 2008.05.07 -
Ewido 4.0 2008.05.07 -
F-Prot 4.4.2.54 2008.05.07 -
F-Secure 6.70.13260.0 2008.05.07 -
Fortinet 3.14.0.0 2008.05.07 -
Ikarus T3.1.1.26 2008.05.07 -
Kaspersky 7.0.0.125 2008.05.07 -
McAfee 5290 2008.05.07 -
Microsoft 1.3408 2008.05.07 -
NOD32v2 3083 2008.05.07 -
Norman 5.80.02 2008.05.07 -
Panda 9.0.0.4 2008.05.06 -
Prevx1 V2 2008.05.07 -
Rising 20.43.12.00 2008.05.07 -
Sophos 4.29.0 2008.05.07 -
Sunbelt 3.0.1097.0 2008.05.07 -
Symantec 10 2008.05.07 -
TheHacker 6.2.92.302 2008.05.07 -
VBA32 3.12.6.5 2008.05.07 -
VirusBuster 4.3.26:9 2008.05.07 -
Webwasher-Gateway 6.6.2 2008.05.07 -
Information additionnelle
File size: 69632 bytes
MD5...: 5453f56a2e709bcec190e39234d99cde
SHA1..: a4ff42b8abc478d1f1155d201e90c7ffd5226133
SHA256: c026e1f4c0c015409e3bf91377af46e5146c1d790050999b3199c81d3d5d9427
SHA512: 9e5b05dd9fe30894428ef14600f3e93b54b59956afe0587ba59030f7a9937f26
f00256d7ce56033213ad357abc1c343e4e114824745f0899cc4835597e0dfbe6
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401878
timedatestamp.....: 0x4693daaf (Tue Jul 10 19:14:55 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xde10 0xe000 5.72 6276ce60d7c51d0e175a5e39bc0827a9
.data 0xf000 0x142c 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x11000 0xf00 0x1000 3.34 1165704b4907141438bce9237825f0cf

( 1 imports )
> MSVBVM60.DLL: __vbaVarTstGt, __vbaVarSub, __vbaStrI2, _CIcos, _adj_fptan, __vbaStrI4, __vbaVarVargNofree, __vbaFreeVar, __vbaLenBstr, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, -, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, -, __vbaLsetFixstr, -, __vbaSetSystemError, -, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, -, __vbaExitProc, -, -, __vbaOnError, __vbaObjSet, -, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, -, __vbaStrFixstr, -, -, _CIsin, -, -, __vbaChkstk, __vbaFileClose, -, EVENT_SINK_AddRef, -, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, -, __vbaObjVar, __vbaI2I4, DllFunctionCall, __vbaRedimPreserve, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, -, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaVarMul, __vbaExceptHandler, __vbaInputFile, __vbaStrToUnicode, __vbaDateStr, _adj_fprem, _adj_fdivr_m64, -, -, __vbaFPException, __vbaStrVarVal, __vbaVarCat, __vbaDateVar, __vbaI2Var, -, -, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, -, __vbaInStr, -, _adj_fdiv_m32i, _adj_fdivr_m32i, -, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, _adj_fdiv_r, -, -, __vbaI4Var, __vbaLateMemCall, __vbaVarAdd, __vbaAryLock, __vbaVarDup, __vbaStrToAnsi, __vbaFpI2, __vbaFpI4, -, __vbaLateMemCallLd, _CIatan, __vbaCastObj, __vbaStrMove, -, -, -, _allmul, -, _CItan, -, __vbaAryUnlock, _CIexp, __vbaFreeStr, __vbaFreeObj

( 0 exports )


______________________________________________________________________________________




Fichier slwinsso.exe reçu le 2008.05.07 20:29:47 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 1/31 (3.23%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 2.
L'heure estimée de démarrage est entre 42 et 61 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.3.0 2008.05.07 -
AntiVir 7.8.0.11 2008.05.07 -
Authentium 4.93.8 2008.05.07 -
Avast 4.8.1169.0 2008.05.07 -
AVG 7.5.0.516 2008.05.07 -
BitDefender 7.2 2008.05.07 -
CAT-QuickHeal 9.50 2008.05.07 -
ClamAV 0.92.1 2008.05.07 -
DrWeb 4.44.0.09170 2008.05.07 -
eSafe 7.0.15.0 2008.05.07 -
eTrust-Vet 31.4.5766 2008.05.07 -
Ewido 4.0 2008.05.07 -
F-Prot 4.4.2.54 2008.05.07 -
F-Secure 6.70.13260.0 2008.05.07 -
Fortinet 3.14.0.0 2008.05.07 -
Ikarus T3.1.1.26.0 2008.05.07 -
Kaspersky 7.0.0.125 2008.05.07 -
McAfee 5290 2008.05.07 -
Microsoft 1.3408 2008.05.07 -
NOD32v2 3083 2008.05.07 -
Norman 5.80.02 2008.05.07 -
Panda 9.0.0.4 2008.05.06 -
Prevx1 V2 2008.05.07 Malicious Software
Rising 20.43.12.00 2008.05.07 -
Sophos 4.29.0 2008.05.07 -
Sunbelt 3.0.1097.0 2008.05.07 -
Symantec 10 2008.05.07 -
TheHacker 6.2.92.302 2008.05.07 -
VBA32 3.12.6.5 2008.05.07 -
VirusBuster 4.3.26:9 2008.05.07 -
Webwasher-Gateway 6.6.2 2008.05.07 -
Information additionnelle
File size: 53248 bytes
MD5...: 9effa03e0917bb6f92a40d0d8e6be7fa
SHA1..: 59755747e3a94d4cf94d3a0900b7c1f8a1e2e7f4
SHA256: 863a659600e8e02b9398f15f75ca43e2a43aaabf44be22928b637e3ee5eaf92e
SHA512: cff337d3975084bcb20bfb7e2833c03fb01fefae8f9e6f8298434a697e4cb7af
74af30e944ac330e559d7ec44e5a06110787d318d1a50184301212b19e62bd1a
PEiD..: Armadillo v1.71
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4033c2
timedatestamp.....: 0x42c24d9b (Wed Jun 29 07:28:27 2005)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x290b 0x3000 5.70 3aeb6929443a8d8aac041f471529afce
.rdata 0x4000 0x14f4 0x2000 3.78 b7ec0391d602c7a9601827f212a5cc99
.data 0x6000 0x69c 0x1000 1.66 0ff9061bf7dd3d4e31923a647d52949f
.rsrc 0x7000 0x5cb8 0x6000 5.12 82342a9482399f0235c1f6a919d69d52

( 7 imports )
> KERNEL32.dll: OpenEventW, SetProcessWorkingSetSize, CloseHandle, ReleaseMutex, OutputDebugStringW, CreateMutexW, WideCharToMultiByte, WaitForSingleObject, MultiByteToWideChar, CreateDirectoryW, GetProcAddress, FreeLibrary, LoadLibraryA, GetProcessHeaps, LoadLibraryW, GetLastError, GetModuleHandleA, GetCurrentProcess, GetStartupInfoA
> USER32.dll: LoadStringW, PeekMessageW, MsgWaitForMultipleObjects, wsprintfW, MessageBoxW, DispatchMessageW, TranslateMessage, GetMessageW
> slcaptain.dll: _SetLongJohn@@YAHPAUHWND__@@@Z, _Hook_Start@@YAHXZ, _Hook_Stop@@YAHXZ
> slbroker.dll: __0CSSOScriptBroker@@QAE@_N00@Z, __1CSSOScriptBroker@@QAE@XZ
> MSVCP60.dll: _npos@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@2IB, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@ABV10@0@Z, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBG@Z, __0_Lockit@std@@QAE@XZ, __1_Lockit@std@@QAE@XZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, __Freeze@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXXZ, __C@_1___Nullstr@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@CAPBGXZ@4GB, _c_str@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@PBGABV_$allocator@G@1@@Z, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, __Tidy@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEX_N@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, __6std@@YAAAV_$basic_ostream@GU_$char_traits@G@std@@@0@AAV10@PBG@Z, _c_str@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEPBDXZ, __0_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAE@PBDH@Z, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, _close@_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ, ___D_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __1_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@XZ
> MSVCRT.dll: abs, _onexit, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, _XcptFilter, _exit, free, _controlfp, swprintf, wcsncpy, __2@YAPAXI@Z, _snwprintf, time, _wstrtime, wcslen, strlen, __CxxFrameHandler, _beginthread, exit, _wgetenv, _except_handler3, _wstat, _wstrdate, __dllonexit
> ADVAPI32.dll: RegCloseKey, RegQueryValueExA, RegOpenKeyExA

( 0 exports )

Prevx info: http://info.prevx.com/...






______________________________________________________________________________________





Fichier slproto.exe reçu le 2008.05.07 20:33:38 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE


Résultat: 1/31 (3.23%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 2.
L'heure estimée de démarrage est entre 42 et 61 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.5.3.0 2008.05.07 -
AntiVir 7.8.0.11 2008.05.07 -
Authentium 4.93.8 2008.05.07 -
Avast 4.8.1169.0 2008.05.07 -
AVG 7.5.0.516 2008.05.07 -
BitDefender 7.2 2008.05.07 -
CAT-QuickHeal 9.50 2008.05.07 -
ClamAV 0.92.1 2008.05.07 -
DrWeb 4.44.0.09170 2008.05.07 -
eSafe 7.0.15.0 2008.05.07 -
eTrust-Vet 31.4.5766 2008.05.07 -
Ewido 4.0 2008.05.07 -
F-Prot 4.4.2.54 2008.05.07 -
F-Secure 6.70.13260.0 2008.05.07 -
Fortinet 3.14.0.0 2008.05.07 -
Ikarus T3.1.1.26.0 2008.05.07 -
Kaspersky 7.0.0.125 2008.05.07 -
McAfee 5290 2008.05.07 -
Microsoft 1.3408 2008.05.07 -
NOD32v2 3083 2008.05.07 -
Norman 5.80.02 2008.05.07 -
Panda 9.0.0.4 2008.05.06 -
Prevx1 V2 2008.05.07 Malicious Software
Rising 20.43.12.00 2008.05.07 -
Sophos 4.29.0 2008.05.07 -
Sunbelt 3.0.1097.0 2008.05.07 -
Symantec 10 2008.05.07 -
TheHacker 6.2.92.302 2008.05.07 -
VBA32 3.12.6.5 2008.05.07 -
VirusBuster 4.3.26:9 2008.05.07 -
Webwasher-Gateway 6.6.2 2008.05.07 -
Information additionnelle
File size: 356352 bytes
MD5...: c2f3f2407451f77489dd57cbad6d1aae
SHA1..: 1a437ac7844191fa360826121ca90738adb9cd82
SHA256: 00a99dd5a325d0ccaa63142807e1f15df41ba030a18b8c15cdb1212f2d310454
SHA512: bbfcd938e95adf589c282ac82ec00e7e52583bb23176b07197295cfdbc6e20fa
0201e6186b21ebf1a195f4cb59a7390d16ac37841b9e148c83b7ae5a51b0de36
PEiD..: Armadillo v1.71
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x42f560
timedatestamp.....: 0x42c24ddc (Wed Jun 29 07:29:32 2005)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3c674 0x3d000 6.41 39c0ca66a47f1a94dbb49ce6c5a65be8
.rdata 0x3e000 0xd30c 0xe000 4.91 9f220b7f755a7faef20f63d1b3e6493f
.data 0x4c000 0x57dc 0x5000 4.11 769553629a8eb44378309bb56aefd027
.rsrc 0x52000 0x5d10 0x6000 5.13 1b5acb8c6931d9c02c099b896920861b

( 13 imports )
> slbroker.dll: _GetPlatformScript@CSSOScriptBroker@@QAEHPBGPAPAGPAW4SSOPlatformType@@_N@Z, _AddCredentialSet@CSSOScriptBroker@@QAEHPBG0_N@Z, _ChangePassphrase@CSSOScriptBroker@@QAEHXZ, _LoadVariableList@CSSOScriptBroker@@QAEHPBG0@Z, _FreePlatformScript@CSSOScriptBroker@@QAEHPAG@Z, _GetNumCredentialSets@CSSOScriptBroker@@QAEHPBGW4SSOCredSetType@@PAH@Z, _SetReloadStatus@CSSOScriptBroker@@QAEHH@Z, _FreeVariableList@CSSOScriptBroker@@QAEHXZ, _FreePlatformTypeName@CSSOScriptBroker@@QAEHPAG@Z, _SetPlatformTypeName@CSSOScriptBroker@@QAEHPBG00PAPAG@Z, _AuthenticateDevice@CSSOScriptBroker@@QAEHXZ, _GetRTVariable@CSSOScriptBroker@@QAEHPBG0PAPAG@Z, _FreeString@CSSOScriptBroker@@QAEHPAG@Z, _FreeAttribute@CSSOScriptBroker@@QAEHPAG@Z, _GetAttributeFromCurrentUser@CSSOScriptBroker@@QAEHPBGPAPAG@Z, __1CSSOScriptBroker@@QAE@XZ, _CheckAuthChanged@CSSOScriptBroker@@QAEHXZ, _VerifyPassphrase@CSSOScriptBroker@@QAEHH@Z, _SetSelectOfflineMode@CSSOScriptBroker@@QAEHH@Z, _GetNextVariable@CSSOScriptBroker@@QAEHPAGH@Z, _AmIActive@CSSOScriptBroker@@QAEHW4SSOModulesEnum@@@Z, _ShutdownBroker@CSSOScriptBroker@@QAEHXZ, _FreeRTVariableResult@CSSOScriptBroker@@QAEHPAPAG@Z, _IsLoadingSSOData@CSSOScriptBroker@@QAEHPAH@Z, _SetValue@CSSOScriptBroker@@QAEHPBG000H@Z, _SaveSSOData@CSSOScriptBroker@@QAEH_N00@Z, _SetPrimaryDataStoreProfile@CSSOScriptBroker@@QAEHPBG@Z, _SetRTVariable@CSSOScriptBroker@@QAEHPBG00@Z, _SetSecureLoginStatus@CSSOScriptBroker@@QAEHH@Z, _LogError@CSSOScriptBroker@@QBAHW4SSOModulesEnum@@W4ErrorSeverityLevel@@HPAGZZ, _SetForceOfflineMode@CSSOScriptBroker@@QAEHH@Z, _LoadSSOData@CSSOScriptBroker@@QAEH_N0@Z, _GetCurrentUserName@CSSOScriptBroker@@QAEHPAPAG_N@Z, _ShowBrokerErrorBox@CSSOScriptBroker@@QAEHPBG0HPAH@Z, _FreeUserName@CSSOScriptBroker@@QAEHPAG@Z, _ClearAllSSOCredentials@CSSOScriptBroker@@QAEHXZ, _LoadPlatformList@CSSOScriptBroker@@QAEHW4SSOPlatformType@@_N@Z, _GetNextPlatform@CSSOScriptBroker@@QAEHAA_NAAW4SSOPlatformType@@PAGH@Z, _GetPlatformDescription@CSSOScriptBroker@@QAEHPBGPAPAG@Z, _FreePlatformList@CSSOScriptBroker@@QAEHXZ, _LoadCredentialSetList@CSSOScriptBroker@@QAEHPBGW4SSOCredSetType@@@Z, _GetNextCredentialSet@CSSOScriptBroker@@QAEHPAGH@Z, _FreeCredentialSetList@CSSOScriptBroker@@QAEHXZ, __0CSSOScriptBroker@@QAE@_N00@Z, _GetDataStoreInfo@CSSOScriptBroker@@QAEHPAW4SSODataStoreTraitsType@@PAH01@Z, _GetSelectOfflineMode@CSSOScriptBroker@@QAEHPAH@Z, _GetPreference@CSSOScriptBroker@@QAEHW4PreferenceNameEnum@@PAHPAG_N3@Z, _IsDataStoreConnectionEncrypted@CSSOScriptBroker@@QAEHPAH@Z, _GetDataStoreVersion@CSSOScriptBroker@@QAEHPAPAG_N@Z, _FreeBuffer@CSSOScriptBroker@@QAEHPAG@Z
> ADVAPI32.dll: RegSetValueExW, RegCloseKey, RegOpenKeyA, RegQueryValueExA, RegOpenKeyExA, OpenThreadToken, GetUserNameW, RegCreateKeyExW, OpenProcessToken, GetTokenInformation, LookupAccountSidW, RegQueryValueExW, RegDeleteValueW, RegOpenKeyExW
> CRYPT32.dll: CryptUnprotectData, CryptProtectData
> MFC42u.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: __CxxFrameHandler, __0exception@@QAE@ABV0@@Z, wcscmp, memset, wcslen, _CxxThrowException, towlower, wcsstr, _wcsupr, wcscpy, swprintf, _endthread, _beginthread, _except_handler3, __p___wargv, __p___argc, _wtoi, wcsncpy, _purecall, isdigit, abs, _vsnwprintf, _wstrdate, strlen, _wstrtime, _snwprintf, time, __1type_info@@UAE@XZ, _controlfp, __dllonexit, _terminate@@YAXXZ, _onexit, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __wgetmainargs, _wcmdln, exit, _XcptFilter, _exit, iswspace, strspn, strncmp, strstr, strncpy, strchr, strcspn, wcscat, srand, rand, strcmp, iswupper, tolower, _wtol, localtime, _wasctime, towupper, _wcsnicmp, sprintf, _beginthreadex, memmove, memcpy, strcpy, toupper, _wgetenv, _wstat, _itow, __set_app_type, _wcsicmp, __1exception@@UAE@XZ, __0exception@@QAE@ABQBD@Z, isspace
> KERNEL32.dll: LCMapStringW, GetStringTypeW, DeleteCriticalSection, GetVersionExA, CreateSemaphoreW, MultiByteToWideChar, GetVersion, LeaveCriticalSection, GetStringTypeA, GetUserDefaultLCID, GetCurrentProcessId, LCMapStringA, TerminateProcess, GetModuleHandleA, lstrcmpA, GetModuleFileNameW, GetPrivateProfileStringW, GetStartupInfoW, InitializeCriticalSection, ResumeThread, CreateDirectoryW, lstrlenA, ReleaseSemaphore, EnterCriticalSection, WideCharToMultiByte, ReleaseMutex, FindResourceW, LoadResource, LockResource, GetEnvironmentVariableW, OutputDebugStringW, LoadLibraryA, OpenProcess, GetLastError, GetProcAddress, FreeLibrary, GetVersionExW, WaitForSingleObject, LoadLibraryW, ResetEvent, SetEvent, Sleep, lstrlenW, CreateMutexW, CreateEventW, GetModuleHandleW, HeapFree, CreateProcessW, HeapAlloc, GetProcessHeap, GetComputerNameW, GetCurrentThread, LocalFree, GetCurrentProcess, SetProcessWorkingSetSize, InterlockedDecrement, LocalAlloc, InterlockedIncrement, GetProcessHeaps, CloseHandle
> USER32.dll: GetDesktopWindow, GetForegroundWindow, SetWindowPos, DialogBoxParamW, SendDlgItemMessageW, GetSystemMetrics, GetClientRect, ScreenToClient, MoveWindow, GetWindowTextW, DialogBoxIndirectParamW, SetWindowTextW, EndDialog, CreatePopupMenu, AppendMenuW, IsWindow, SetFocus, SetDlgItemTextW, DestroyWindow, GetWindowLongW, PeekMessageW, DispatchMessageW, MsgWaitForMultipleObjects, wsprintfW, LoadStringW, LoadIconW, MessageBoxW, GetWindowRect, ExitWindowsEx, LoadMenuIndirectW, RemoveMenu, GetSubMenu, CheckMenuItem, TrackPopupMenu, SetForegroundWindow, GetCursorPos, GetMenuStringW, KillTimer, SetTimer, CloseWindow, LoadCursorW, SystemParametersInfoW, DefWindowProcW, CreateWindowExW, PostMessageW, SendMessageW, EnableWindow, RegisterWindowMessageW, DrawTextW, GetDC, AdjustWindowRectEx, ReleaseDC, ShowWindow, CreateDialogIndirectParamW, GetDlgItem, FindWindowW, CharLowerW, LoadStringA
> GDI32.dll: SelectObject, SetBkColor, SetBkMode, CreateSolidBrush, SetTextColor
> SHELL32.dll: Shell_NotifyIconW, ShellExecuteW
> COMCTL32.dll: -
> MSVCP60.dll: _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBG0@Z, _what@runtime_error@std@@UBEPBDXZ, _max_size@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEIXZ, _max_size@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIXZ, __Copy@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXI@Z, _replace@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PAG0PBG1@Z, __8std@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@PBD@Z, __Copy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXI@Z, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@PBD@Z, ___7runtime_error@std@@6B@, ___F_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEXXZ, __1_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@XZ, __Y_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV01@PBG@Z, __4_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV01@PBG@Z, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@ABV_$allocator@G@1@@Z, _c_str@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, __4_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV01@ABV01@@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, _c_str@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEPBDXZ, _length@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEIXZ, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@PBGABV_$allocator@G@1@@Z, _empty@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBE_NXZ, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@ABV01@@Z, __0logic_error@std@@QAE@ABV01@@Z, __0out_of_range@std@@QAE@ABV01@@Z, __1out_of_range@std@@UAE@XZ, __0out_of_range@std@@QAE@ABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@1@@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBDABV_$allocator@D@1@@Z, __Ostd@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@0@Z, _end@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGXZ, _begin@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGXZ, __8std@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@0@Z, _npos@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@2IB, _find@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIABV12@I@Z, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@PBGABV10@@Z, _find@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGI@Z, _erase@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@II@Z, _find_last_of@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIGI@Z, _size@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIXZ, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@ABV10@0@Z, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@ABV10@PBG@Z, __Eos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXI@Z, _insert@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@IPBG@Z, _rend@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE_AV_$reverse_iterator@PAGGAAGPAGH@2@XZ, _end@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@IG@Z, _reserve@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEXI@Z, _rbegin@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE_AV_$reverse_iterator@PAGGAAGPAGH@2@XZ, __1runtime_error@std@@UAE@XZ, __0runtime_error@std@@QAE@ABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@1@@Z, __0runtime_error@std@@QAE@ABV01@@Z, _compare@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEHPBG@Z, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@IGABV_$allocator@G@1@@Z, _max@_$numeric_limits@H@std@@SAHXZ, _length@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIXZ, __Tidy@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEX_N@Z, _rfind@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGI@Z, __C@_1___Nullstr@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@CAPBGXZ@4GB, __Freeze@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXXZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, _find@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGII@Z, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, _substr@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBE_AV12@II@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, ___D_$basic_ostringstream@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEXXZ, _str@_$basic_ostringstream@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBE_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@2@XZ, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, __0_$basic_ostringstream@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@H@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, __9std@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@PBG@Z, __Mstd@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@0@Z, _erase@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@II@Z, ___7out_of_range@std@@6B@, __0logic_error@std@@QAE@ABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@1@@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __Freeze@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXXZ, __Xran@std@@YAXXZ, _find@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEIPBDII@Z, _compare@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEHIIPBDI@Z, __0Init@ios_base@std@@QAE@XZ, __1Init@ios_base@std@@QAE@XZ, __0_Winit@std@@QAE@XZ, __1_Winit@std@@QAE@XZ, _compare@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEHIIPBGI@Z, _find_first_of@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGII@Z, __Xlen@std@@YAXXZ, __Grow@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAE_NI_N@Z, __Doraise@runtime_error@std@@MBEXXZ, _begin@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, __6_$basic_ostream@GU_$char_traits@G@std@@@std@@QAEAAV01@H@Z, __Grow@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAE_NI_N@Z, __Split@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXXZ, __A_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAGI@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@IG@Z, __Eos@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXI@Z, __Split@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXXZ, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBD0ABV_$allocator@D@1@@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBD0@Z, _insert@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGPAGG@Z, _rfind@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGII@Z, __8std@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@PBG@Z, __0_Lockit@std@@QAE@XZ, __1_Lockit@std@@QAE@XZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, _erase@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGPAG@Z, __0_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAE@PBDH@Z, __6std@@YAAAV_$basic_ostream@GU_$char_traits@G@std@@@0@AAV10@PBG@Z, _close@_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ, ___D_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ
> ole32.dll: CoInitializeEx
> VERSION.dll: VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

( 0 exports )

Relance hijack et coche ceci
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/Content/fr/default.shtml
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://home*.investorsgroup.com;https://businesslinkonwinfu­nd.investorsgroup.co m;*.ig.bz;­*.iga.bz;*.gwl.ca;*.gwl.bz;*mycybrary.londonlife.­com;*cybrary.londonl ife.com;*.ll.bz;*.grs­access.com;
O4 - HKLM\..\Run: [SecureLogin] "C:\Program Files\Protocom\SecureLogin\slproto.exe"
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122

ensuite clique sur fix checked

Télécharge OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
clic double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :
Paste List of Files/Folders to be moved.

C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe
EmptyTemp

clique sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\\\_OTMoveIt\MovedFiles.

il te sera peut-être demandé de redémarrer le pc pour achever la suppression.

ensuite fait un scan en ligne

avec bitdefender et colle le rapport

http://www.bitdefender.com/scan8/ie.html

Scan à faire sous Internet Explorer

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm


@+
C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.

Êtes-vous bien sûr? Parce que ces programmes je les utilise à tous les jours... ils se connectent automatiquement à mon ordinateur pour me donner des mises à jour pour mon travail, par le réseau de la compagnie.

Pour ces deux la
C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe

Prevx1 V2 2008.05.07 Malicious Software
mais à toi de voir
si tu es sur de ces fichiers pas de soucis

donc fait le scan en ligne et dit ou tu en est avec tes soucis

@+ C’est généralement lorsque le disque dur plante qu’on se rend compte qu’on a oublié de le sauvegarder.