Virus spamer et Buffer Overrun

Voici le log de la suppression grâce à Lop S&D :



-----------------------[ Lop S&D 4.2.1-1 XP/Vista ]---------------------

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Rahxephon ] [ "C:\Lop SD" ] [ Selection : 2 ]
[ 31/05/2008 | 16:26:20,18 ] [ PC : ARNAUD ]
[ MAJ : 31-05-2008 | 14:12 ]


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@adultfriendfinder[1].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@adin.bigpoint[1].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@adin.bigpoint[2].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@bigpoint[1].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@es.bigpoint[1].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@es.bigpoint[2].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@fr1.seafight.bigpoint[2].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@www.bigpoint[1].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@banner.cotedazurpalace[2].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@cotedazurpalace[1].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@adopt.euroclick[2].txt
Supprimé! - C:\DOCUME~1\RAHXEP~1\Cookies\rahxephon@partypoker[2].txt

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


-------------[ Listing des dossiers dans Application Data ]------------

[17/08/2006|12:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[17/08/2006|17:49] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[31/05/2008|14:25] C:\DOCUME~1\ADMINI~1.ARN\APPLIC~1\Adobe
[17/08/2006|22:23] C:\DOCUME~1\ADMINI~1.ARN\APPLIC~1\desktop.ini
[31/05/2008|14:26] C:\DOCUME~1\ADMINI~1.ARN\APPLIC~1\Macromedia
[31/05/2008|14:25] C:\DOCUME~1\ADMINI~1.ARN\APPLIC~1\Microsoft

[20/04/2006|15:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[28/05/2006|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[20/04/2006|22:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[17/08/2006|19:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[18/06/2006|18:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[23/04/2006|22:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[24/06/2006|19:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QTSBandwidthCache
[24/04/2006|19:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[20/04/2006|16:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[31/01/2007|16:07] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[27/09/2006|21:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
[14/04/2008|21:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avg8
[17/08/2006|22:23] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\desktop.ini
[15/02/2007|23:10] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\DVD Shrink
[10/10/2007|14:46] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Google
[06/11/2007|14:36] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\InstallShield
[30/05/2008|19:12] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Kaspersky Lab Setup Files
[29/05/2008|18:18] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\LightScribe
[22/12/2007|22:50] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\LogiShrd
[22/12/2007|22:48] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Logitech
[16/09/2006|12:39] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
[30/05/2008|21:37] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[06/03/2008|23:49] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
[18/08/2006|12:26] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NVIDIA
[12/12/2006|07:55] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\QTSBandwidthCache
[13/04/2008|11:43] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Skyline
[13/05/2007|11:51] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
[28/08/2006|23:01] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage

[17/08/2006|19:28] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[20/04/2006|14:01] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[17/08/2006|22:23] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\desktop.ini
[17/08/2006|20:59] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft

[07/07/2006|17:05] C:\DOCUME~1\INVIT~1\APPLIC~1\Adobe
[20/04/2006|15:51] C:\DOCUME~1\INVIT~1\APPLIC~1\desktop.ini
[26/06/2006|17:04] C:\DOCUME~1\INVIT~1\APPLIC~1\Identities
[03/07/2006|18:13] C:\DOCUME~1\INVIT~1\APPLIC~1\Macromedia
[26/06/2006|17:04] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft
[03/07/2006|18:14] C:\DOCUME~1\INVIT~1\APPLIC~1\Sun

[10/07/2006|09:08] C:\DOCUME~1\Laurent\APPLIC~1\Adobe
[10/07/2006|09:08] C:\DOCUME~1\Laurent\APPLIC~1\AdobeUM
[20/04/2006|15:51] C:\DOCUME~1\Laurent\APPLIC~1\desktop.ini
[09/07/2006|12:18] C:\DOCUME~1\Laurent\APPLIC~1\Identities
[10/07/2006|09:00] C:\DOCUME~1\Laurent\APPLIC~1\Macromedia
[27/07/2006|00:27] C:\DOCUME~1\Laurent\APPLIC~1\Microsoft
[10/07/2006|09:01] C:\DOCUME~1\Laurent\APPLIC~1\Sun
[16/07/2006|09:08] C:\DOCUME~1\Laurent\APPLIC~1\Template
[21/07/2006|19:34] C:\DOCUME~1\Laurent\APPLIC~1\vlc
[16/07/2006|11:33] C:\DOCUME~1\Laurent\APPLIC~1\wklnhst.dat

[20/04/2006|14:01] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[14/04/2008|21:55] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft

[20/04/2006|14:01] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[14/04/2008|21:55] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft

[18/08/2006|12:35] C:\DOCUME~1\RAHXEP~1\APPLIC~1\.bittorrent
[29/05/2008|18:05] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Acoustica
[31/01/2008|15:57] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Adobe
[29/05/2008|17:37] C:\DOCUME~1\RAHXEP~1\APPLIC~1\AdobeUM
[13/11/2006|22:22] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Ahead
[20/09/2006|07:00] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Apple Computer
[30/05/2008|18:58] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Azureus
[01/02/2008|17:05] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Bioshock
[23/01/2008|15:03] C:\DOCUME~1\RAHXEP~1\APPLIC~1\BitZipper
[06/11/2007|14:36] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Codemasters
[29/04/2007|09:45] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Command & Conquer 3 Les guerres du Tiberium
[19/04/2007|11:56] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
[17/08/2006|22:23] C:\DOCUME~1\RAHXEP~1\APPLIC~1\desktop.ini
[09/01/2008|16:29] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Dev-Cpp
[26/10/2007|21:35] C:\DOCUME~1\RAHXEP~1\APPLIC~1\DivX
[23/09/2006|14:06] C:\DOCUME~1\RAHXEP~1\APPLIC~1\dvdcss
[13/05/2007|13:51] C:\DOCUME~1\RAHXEP~1\APPLIC~1\FlashGet
[10/10/2007|14:44] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Google
[29/05/2008|19:09] C:\DOCUME~1\RAHXEP~1\APPLIC~1\gtk-2.0
[24/05/2008|20:26] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Hamachi
[10/09/2006|14:36] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Help
[17/08/2006|21:08] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Identities
[06/03/2008|23:47] C:\DOCUME~1\RAHXEP~1\APPLIC~1\InstallShield
[06/03/2008|23:45] C:\DOCUME~1\RAHXEP~1\APPLIC~1\InstallShield Installation Information
[18/06/2007|14:22] C:\DOCUME~1\RAHXEP~1\APPLIC~1\La Bataille pour la Terre du Milieu T II
[13/02/2008|15:11] C:\DOCUME~1\RAHXEP~1\APPLIC~1\LimeWire
[11/09/2006|20:59] C:\DOCUME~1\RAHXEP~1\APPLIC~1\LiteOn
[22/12/2007|22:50] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Logitech
[27/08/2006|11:15] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Macromedia
[06/03/2008|23:45] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Media Center Programs
[14/11/2006|14:11] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Media Player Classic
[16/04/2008|22:33] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Microsoft
[21/05/2008|13:02] C:\DOCUME~1\RAHXEP~1\APPLIC~1\mIRC
[11/03/2008|08:00] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Mozilla
[17/03/2008|18:05] C:\DOCUME~1\RAHXEP~1\APPLIC~1\MPQEditor.ini
[24/05/2008|18:29] C:\DOCUME~1\RAHXEP~1\APPLIC~1\OpenOffice.org2
[18/06/2007|15:44] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Opera
[09/03/2008|19:10] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Real
[23/11/2007|23:37] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Roxio
[29/04/2007|09:44] C:\DOCUME~1\RAHXEP~1\APPLIC~1\SecuROM
[19/07/2007|19:35] C:\DOCUME~1\RAHXEP~1\APPLIC~1\SQLyog
[09/09/2006|23:04] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Sun
[04/12/2006|19:48] C:\DOCUME~1\RAHXEP~1\APPLIC~1\Template
[16/04/2008|23:10] C:\DOCUME~1\RAHXEP~1\APPLIC~1\uk.co.planetside
[26/08/2006|20:35] C:\DOCUME~1\RAHXEP~1\APPLIC~1\vlc
[30/05/2008|19:28] C:\DOCUME~1\RAHXEP~1\APPLIC~1\WinRAR
[13/05/2008|21:23] C:\DOCUME~1\RAHXEP~1\APPLIC~1\wklnhst.dat

----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

[27/05/2008 18:30][--a------] C:\WINDOWS\tasks\Solenne.job
[18/03/2008 19:34][--a------] C:\WINDOWS\tasks\Aline.job
[31/05/2008 16:16][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{E1364D60-FE1A-45C7-8DA3-8F66027EDD61}.job
[28/05/2008 19:00][--a------] C:\WINDOWS\tasks\Restauration du systŠme.job
[31/05/2008 14:39][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[30/05/2008|16:12] C:\Program Files\Adobe
[06/11/2007|14:35] C:\Program Files\AGEIA Technologies
[30/05/2008|15:04] C:\Program Files\Antivirus
[09/12/2007|19:30] C:\Program Files\Audacity
[31/10/2007|15:41] C:\Program Files\Aureon 5.1 Fun PCI
[17/04/2008|17:15] C:\Program Files\Azureus
[12/07/2006|13:18] C:\Program Files\Bethesda Softworks
[16/04/2008|19:05] C:\Program Files\Blender Foundation
[02/03/2008|11:22] C:\Program Files\CAPCOM
[21/04/2006|19:10] C:\Program Files\Common Files
[20/04/2006|13:58] C:\Program Files\ComPlus Applications
[09/12/2007|19:33] C:\Program Files\Daemon Tools
[30/05/2008|15:10] C:\Program Files\DivX
[12/09/2006|20:36] C:\Program Files\FastLink
[29/05/2008|18:16] C:\Program Files\Fichiers communs
[08/03/2008|17:28] C:\Program Files\Game Graphic Studio
[28/03/2008|17:02] C:\Program Files\GIMP-2.0
[11/03/2008|20:10] C:\Program Files\InstallShield Installation Information
[09/04/2008|22:38] C:\Program Files\Internet Explorer
[18/03/2007|17:23] C:\Program Files\iTunes
[10/03/2008|08:00] C:\Program Files\Java
[29/05/2008|18:47] C:\Program Files\LightScribe
[22/12/2007|22:48] C:\Program Files\Logitech
[19/08/2006|00:27] C:\Program Files\Messenger
[05/04/2008|14:57] C:\Program Files\Messenger Plus! Live
[18/06/2006|18:49] C:\Program Files\Microsoft Encarta
[20/04/2006|14:04] C:\Program Files\microsoft frontpage
[06/04/2007|21:49] C:\Program Files\Microsoft Office
[30/11/2007|23:34] C:\Program Files\Microsoft SDKs
[06/04/2007|22:00] C:\Program Files\Microsoft SQL Server
[12/01/2008|00:44] C:\Program Files\Microsoft Visual Studio 9.0
[04/12/2006|19:45] C:\Program Files\Microsoft Works
[06/03/2008|23:49] C:\Program Files\Microsoft.NET
[23/04/2006|22:22] C:\Program Files\MicroStar
[21/05/2008|13:00] C:\Program Files\mIRC
[20/04/2006|13:59] C:\Program Files\Movie Maker
[30/05/2008|18:36] C:\Program Files\Mozilla Firefox 3 Beta 3
[18/07/2007|12:36] C:\Program Files\MSBuild
[20/04/2006|13:57] C:\Program Files\MSN
[17/08/2006|19:43] C:\Program Files\msn gaming zone
[05/04/2008|14:57] C:\Program Files\MSN Messenger
[22/08/2006|11:44] C:\Program Files\Multimedia Combo Set
[20/04/2006|13:59] C:\Program Files\NetMeeting
[24/01/2008|23:34] C:\Program Files\OpenOffice.org 2.3
[30/05/2008|15:56] C:\Program Files\outlook express
[09/12/2007|19:36] C:\Program Files\PowerISO
[16/03/2008|17:08] C:\Program Files\PremiumSoft
[25/03/2007|22:22] C:\Program Files\Project64 1.6
[03/06/2007|10:21] C:\Program Files\QuickTime
[09/03/2008|19:07] C:\Program Files\Real
[17/01/2008|06:59] C:\Program Files\Red Kawa
[18/07/2007|12:31] C:\Program Files\Reference Assemblies
[16/11/2007|00:00] C:\Program Files\Roxio
[27/06/2006|21:57] C:\Program Files\Saitek
[05/12/2006|07:53] C:\Program Files\Satsuki Decoder Pack
[27/02/2008|14:48] C:\Program Files\SC
[06/09/2006|17:18] C:\Program Files\Seagrand
[20/04/2006|14:00] C:\Program Files\Services en ligne
[23/04/2006|22:17] C:\Program Files\Support
[24/04/2006|19:51] C:\Program Files\Symantec
[23/04/2006|22:22] C:\Program Files\SymNetDrv
[30/05/2008|15:02] C:\Program Files\Terragen
[13/09/2006|20:40] C:\Program Files\Ti-83
[11/03/2008|20:11] C:\Program Files\ToniArts
[20/04/2006|14:11] C:\Program Files\Uninstall Information
[16/03/2008|16:28] C:\Program Files\Unlocker
[26/06/2006|21:52] C:\Program Files\VideoLAN
[14/04/2008|18:28] C:\Program Files\Virtualis
[12/01/2008|00:53] C:\Program Files\Visual Studio 2008
[28/05/2008|22:30] C:\Program Files\Warcraft III
[03/03/2008|21:54] C:\Program Files\Windows Journal Viewer
[18/09/2007|18:30] C:\Program Files\Windows Live
[04/01/2007|18:24] C:\Program Files\Windows Media Connect 2
[20/12/2006|16:20] C:\Program Files\Windows Media Player
[17/08/2006|20:55] C:\Program Files\Windows NT
[20/04/2006|14:00] C:\Program Files\WindowsUpdate
[30/05/2008|19:12] C:\Program Files\WinRAR
[24/05/2008|17:10] C:\Program Files\World of Warcraft
[04/05/2008|16:26] C:\Program Files\WowCartographe
[20/04/2006|14:04] C:\Program Files\xerox

------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

[30/05/2008|16:07] C:\Program Files\Fichiers communs\Adobe
[23/04/2006|22:22] C:\Program Files\Fichiers communs\Ahead
[21/03/2008|12:19] C:\Program Files\Fichiers communs\Blizzard Entertainment
[06/04/2007|21:49] C:\Program Files\Fichiers communs\Designer
[06/11/2007|14:32] C:\Program Files\Fichiers communs\InstallShield
[20/04/2006|14:04] C:\Program Files\Fichiers communs\Java
[29/05/2008|18:17] C:\Program Files\Fichiers communs\LightScribe
[22/12/2007|22:49] C:\Program Files\Fichiers communs\Logishrd
[26/09/2007|22:48] C:\Program Files\Fichiers communs\Logitech
[06/03/2008|23:49] C:\Program Files\Fichiers communs\Merge Modules
[14/04/2008|21:34] C:\Program Files\Fichiers communs\Microsoft Shared
[20/04/2006|13:59] C:\Program Files\Fichiers communs\MSSoap
[20/04/2006|15:51] C:\Program Files\Fichiers communs\ODBC
[09/03/2008|19:08] C:\Program Files\Fichiers communs\Real
[03/12/2006|12:45] C:\Program Files\Fichiers communs\Roxio Shared
[20/04/2006|13:59] C:\Program Files\Fichiers communs\Services
[20/04/2006|15:51] C:\Program Files\Fichiers communs\SpeechEngines
[24/04/2006|19:45] C:\Program Files\Fichiers communs\Symantec Shared
[13/06/2007|16:07] C:\Program Files\Fichiers communs\System
[12/09/2006|21:35] C:\Program Files\Fichiers communs\TI Shared
[06/11/2007|14:35] C:\Program Files\Fichiers communs\Wise Installation Wizard
[09/03/2008|19:08] C:\Program Files\Fichiers communs\xing shared

---------------------------[ Process ]--------------------------

... 31

... OK !

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

Aucun fichier / dossier Lop trouvé !

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-31 16:28:24
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

C:\WINDOWS\system32\RXyyayay.ini2
[b]! VUNDO Possible !/b

=> C:\Documents and Settings\Rahxephon\Favoris\Warez\InfiniteWarez.com - Free Full Version Games, Movies, Warez, XXX, Cracks, Serials, Keygens & More!.url
=> C:\Documents and Settings\Rahxephon\Local Settings\Temp\Samples\C++\Direct3D\UVAtlas\crackdecl.cpp
=> C:\Documents and Settings\Rahxephon\Local Settings\Temp\Samples\C++\Direct3D\UVAtlas\crackdecl.h
=> C:\Documents and Settings\Rahxephon\Mes documents\World Of Warcraft Server\Core Mangos 5378 +SD2 275\buildings\Shadowmoon_Wall_Crack.wmo
=> C:\Documents and Settings\Rahxephon\Mes documents\World Of Warcraft Server\Fichiers t‚l‚charg‚s\Utilitaires\Crack_Navicat_MySQL_8.0.22.exe
=> C:\Documents and Settings\Rahxephon\Mes documents\World Of Warcraft Server\Utilitaires\Crack_Navicat_MySQL_8.0.22.exe
=> C:\Documents and Settings\Rahxephon\Favoris\Warez\InfiniteWarez.com - Free Full Version Games, Movies, Warez, XXX, Cracks, Serials, Keygens & More!.url
=> C:\Documents and Settings\Rahxephon\Mes documents\Mes vid‚os\Acoustica.CD.DVD.Label.Maker.v3.17.WinAll.Incl.KeyGen-NeoX[Gettorrents.org]_[mininova][1].torrent


[F:4906][D:414]-> C:\DOCUME~1\RAHXEP~1\LOCALS~1\Temp
[F:145][D:0]-> C:\DOCUME~1\RAHXEP~1\Cookies
[F:13122][D:16]-> C:\DOCUME~1\RAHXEP~1\LOCALS~1\TEMPOR~1\content.IE5

--------------------[ Fin du rapport a 16:29:05,40 ]----------------------




Et ici le second log de Navi :

Search Navipromo version 3.5.7 commencé le 31/05/2008 à 16:37:17,53

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Rahxephon"

Mise à jour le 11.05.2008 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1.win\applic~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1.win\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Rahxephon\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.ARN\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Laurent\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Rahxephon\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.ARN\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Laurent\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Rahxephon\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.ARN\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Laurent\menudm~1\progra~1" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Rahxephon\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1.ARN\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Laurent\locals~1\applic~1" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Rahxephon\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1.ARN\locals~1\applic~1" :


* Dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\Laurent\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

C:\WINDOWS\system32\RXyyayay.ini2 trouvé ! infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 31/05/2008 à 16:44:50,37 ***

Voici le rapport de VundoFix :


VundoFix V7.0.5

Scan started at 17:00:45 31/05/2008

Listing files found while scanning....

C:\Program Files\PowerISO\PWRISOSH.DLL

Beginning removal...

Attempting to delete C:\Program Files\PowerISO\PWRISOSH.DLL
C:\Program Files\PowerISO\PWRISOSH.DLL Has been deleted!

Performing Repairs to the registry.
Done!


Et enfin :


[05/31/2008, 17:15:14] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Rahxephon\Bureau\VirtumundoBeGone.exe" )
[05/31/2008, 17:15:24] - User choose NOT to continue. Exiting...

[05/31/2008, 17:17:00] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Rahxephon\Bureau\VirtumundoBeGone.exe" )
[05/31/2008, 17:17:02] - Detected System Information:
[05/31/2008, 17:17:02] - Windows Version: 5.1.2600, Service Pack 2
[05/31/2008, 17:17:02] - Current Username: Rahxephon (Admin)
[05/31/2008, 17:17:02] - Windows is in NORMAL mode.
[05/31/2008, 17:17:02] - Searching for Browser Helper Objects:
[05/31/2008, 17:17:02] - BHO 1: {140BD8E3-C167-11D4-B4A3-080000180323} ()
[05/31/2008, 17:17:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/31/2008, 17:17:02] - No filename found. Continuing.
[05/31/2008, 17:17:02] - BHO 2: {170721ca-6d8f-405e-accc-6d5577ff4ae5} ()
[05/31/2008, 17:17:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/31/2008, 17:17:02] - Checking for HKLM\...\Winlogon\Notify\uupylmha
[05/31/2008, 17:17:02] - Key not found: HKLM\...\Winlogon\Notify\uupylmha, continuing.
[05/31/2008, 17:17:02] - BHO 3: {3049C3E9-B461-4BC5-8870-4C09146192CA} (RealPlayer Download and Record Plugin for Internet Explorer)
[05/31/2008, 17:17:02] - BHO 4: {444FC7D1-8F08-4377-B39B-4D75AE0E9F70} ()
[05/31/2008, 17:17:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/31/2008, 17:17:02] - Checking for HKLM\...\Winlogon\Notify\fccBTJCR
[05/31/2008, 17:17:02] - Key not found: HKLM\...\Winlogon\Notify\fccBTJCR, continuing.
[05/31/2008, 17:17:02] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/31/2008, 17:17:02] - BHO 6: {85B95FA8-2DA2-4D73-8C6E-EB53D93CD731} ()
[05/31/2008, 17:17:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/31/2008, 17:17:02] - Checking for HKLM\...\Winlogon\Notify\yayayyXR
[05/31/2008, 17:17:02] - Key not found: HKLM\...\Winlogon\Notify\yayayyXR, continuing.
[05/31/2008, 17:17:02] - Finished Searching Browser Helper Objects
[05/31/2008, 17:17:02] - Finishing up...
[05/31/2008, 17:17:02] - Nothing found! Exiting...


J'en déduis que c'est du tout bon ? :)

Edit : Ah non, je viens encore de recevoir une page de pub... *Sigh*

Voici le rapport :

Logfile of HijackThis v1.99.1
Scan saved at 17:26:26, on 31/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Antivirus\SmitfraudFix\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [WireLessKeyboard ] C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: WlanUtility.lnk = C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSI_WLAN_Service - Unknown owner - C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\bin\apache\apache2.2.6\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.45\bin\mysqld-nt.exe

/on je raconte ma vie
C'est justement que j'étais en train de faire, quand j'ai attrapé mon virus, j'avais plus d'antivirus (Avast! me faisait bugger mon ordi quand il lancait le processus avast.setup) et c'est seulement après le virus que j'ai mis Kaspersky que je viens de désinstaller (bouffait trop de RAM) pour le remplacer par Antivir, que je venais de finir de télécharger avec votre message.
/off je raconte ma vie
:)

Ca risque de prendre encore pas mal de temps...

Selon Antivir j'ai 3 virus mis en quarantaine :
- Is the Trojan horse TR/Lowzones.SG (x3, Antivir l'a repérer 2x de suite pendant que j'écrivais ce mesage)
- Is the Trojan horse TR/Crypt.XPACK.Gen (x3)
- Contains suspicious code HEUR/HTML.Malware

Voilà, c'est fait et pourtant je reçois encore de la pub :'(

Logfile of HijackThis v1.99.1
Scan saved at 11:49:31, on 01/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Antivirus\SmitfraudFix\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [WireLessKeyboard ] C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BM47b66def] Rundll32.exe "C:\WINDOWS\system32\immxklcp.dll",s
O4 - HKLM\..\Run: [44855e73] rundll32.exe "C:\WINDOWS\system32\dwjjdepa.dll",b
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: WlanUtility.lnk = C:\Program Files\MicroStar\WLANUtility\WlanUtility.exe
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSI_WLAN_Service - Unknown owner - C:\Program Files\MicroStar\WLANUtility\WLAN_Service.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\bin\apache\apache2.2.6\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.45\bin\mysqld-nt.exe




Note : je suis allé dans voir dans les modules complémentaires voir s'il n'y avait pas un truc qui cloche :
-{444FC7D1-8F08-4337-B39B-4D75AE0E9F70}
- Console Java (Sun)
- Organise-notes
- RealPlayer Download and Record Plugin for Internet
- SSVHelper Class
- Uninstall BitDefender Online Scanner v8
- uupylmha.dll
- Windows Messenger
- yayayyXR.dll

yayayyXR.dll est étrange, je crois qu'il apparaissait plusieurs fois pendant les analyses antivirus et je vais chercher sur Internet ce qu'est uupylmha.dll

Edit : Les deux .dll cité précédemment ne sont pas connu par Google Oo

Antivir me trouve un virus dans Navilog1 :
Contains Detection pattern of the dropper DR/Tool.Reboot.F.94
Je continue quand même ?

Search Navipromo version 3.5.7 commencé le 01/06/2008 à 12:28:09,68

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Rahxephon"

Mise à jour le 11.05.2008 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1.win\applic~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1.win\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Rahxephon\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.ARN\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Laurent\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Rahxephon\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.ARN\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Laurent\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Rahxephon\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1.ARN\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Laurent\menudm~1\progra~1" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Rahxephon\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1.ARN\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Laurent\locals~1\applic~1" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Rahxephon\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1.ARN\locals~1\applic~1" :


* Dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\Laurent\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

C:\WINDOWS\system32\RXyyayay.ini2 trouvé ! infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 01/06/2008 à 12:37:39,64 ***


RXyyayay.ini2 réapparaît comme dans mes modules complémentaires (avec yayayyXR.dll mais écrit à l'envers)

[06/01/2008, 12:57:46] - VirtumundoBeGone v1.5 ( "C:\Program Files\Antivirus\VirtumundoBeGone.exe" )
[06/01/2008, 12:57:47] - Detected System Information:
[06/01/2008, 12:57:47] - Windows Version: 5.1.2600, Service Pack 2
[06/01/2008, 12:57:48] - Current Username: Rahxephon (Admin)
[06/01/2008, 12:57:48] - Windows is in NORMAL mode.
[06/01/2008, 12:57:48] - Searching for Browser Helper Objects:
[06/01/2008, 12:57:48] - BHO 1: {140BD8E3-C167-11D4-B4A3-080000180323} ()
[06/01/2008, 12:57:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/01/2008, 12:57:48] - No filename found. Continuing.
[06/01/2008, 12:57:48] - BHO 2: {170721ca-6d8f-405e-accc-6d5577ff4ae5} ()
[06/01/2008, 12:57:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/01/2008, 12:57:48] - Checking for HKLM\...\Winlogon\Notify\uupylmha
[06/01/2008, 12:57:48] - Key not found: HKLM\...\Winlogon\Notify\uupylmha, continuing.
[06/01/2008, 12:57:48] - BHO 3: {3049C3E9-B461-4BC5-8870-4C09146192CA} (RealPlayer Download and Record Plugin for Internet Explorer)
[06/01/2008, 12:57:48] - BHO 4: {444FC7D1-8F08-4377-B39B-4D75AE0E9F70} ()
[06/01/2008, 12:57:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/01/2008, 12:57:48] - Checking for HKLM\...\Winlogon\Notify\fccBTJCR
[06/01/2008, 12:57:48] - Key not found: HKLM\...\Winlogon\Notify\fccBTJCR, continuing.
[06/01/2008, 12:57:48] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[06/01/2008, 12:57:48] - BHO 6: {D86EAC4B-CED8-4F9A-8FF2-363BFA250DA3} ()
[06/01/2008, 12:57:48] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/01/2008, 12:57:48] - Checking for HKLM\...\Winlogon\Notify\yayayyXR
[06/01/2008, 12:57:48] - Key not found: HKLM\...\Winlogon\Notify\yayayyXR, continuing.
[06/01/2008, 12:57:48] - Finished Searching Browser Helper Objects
[06/01/2008, 12:57:48] - Finishing up...
[06/01/2008, 12:57:48] - Nothing found! Exiting...


VundoFix ne m'a rien trouvé, en effet

Le logiciel en question ne marche pas, même après avoir fait la mise à jour : bug du processus setup.exe
Voici un screenshot :
http://imageshack-france.com/out.php/i112016_bug.jpg

L'analyse n'est pas encore terminer mais Dr.Web® m'a trouvé des trucs bizarres (je ne sais pas si je dois les supprimer ou pas) :
- Process.exe (de l'antivirus Lop S&D)
- Process.exe (de Navilog)
- Process.exe (de SmitfraudFix)
- Restart.exe (de SmitfraudFix)

Voilà, j'ai tout supprimé mais j'ai encore la pub Oo j'y crois pas...

Voilà, AVG en a trouvé encore pas mal (j'étais super bien virusé :s)
Je vais attendre voir si les pubs vont revenir, si elles ne reviennent pas, je mettrais [Résolu] en tout cas, merci beaucoup.

Edit : Finalement, c'est encore là (les pubs) :s