Virus trojan C:\WINDOWS\System32\zipfldr.dll

Voici le rapport obtenu:
Est e que je l'envoie ici aussi?
https://www.androidworld.fr/


############################## | UsbFix V6.052 |

User : Administrateur (Administrateurs) # XPSP2-232859E2C
Update on 13/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 14:38:32 | 15/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Celeron(R) CPU 2.66GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1201 [VPS 081130-0] 4.8.1201 [ (!) Disabled | (!) Outdated ]
AV : Kaspersky Anti-Virus Personal 5.0.142 [ (!) Disabled | (!) Outdated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 24,41 Go (1,21 Go free) # NTFS
D:\ -> Disque fixe local # 78,13 Go (78,06 Go free) # NTFS
E:\ -> Disque fixe local # 83,76 Go (83,69 Go free) # NTFS
F:\ -> Disque CD-ROM # 538,87 Mo (0 Mo free) [Mon disque] # CDFS
G:\ -> Disque amovible # 1,91 Go (1,77 Go free) [MP3] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 640
C:\WINDOWS\system32\csrss.exe 692
C:\WINDOWS\system32\winlogon.exe 716
C:\WINDOWS\system32\services.exe 768
C:\WINDOWS\system32\lsass.exe 780
C:\WINDOWS\system32\svchost.exe 956
C:\WINDOWS\system32\svchost.exe 1024
C:\WINDOWS\System32\svchost.exe 1120
C:\WINDOWS\system32\svchost.exe 1192
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1440
C:\Program Files\Alwil Software\Avast4\ashServ.exe 1520
C:\WINDOWS\system32\spoolsv.exe 1924
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 164
C:\Program Files\Bonjour\mDNSResponder.exe 176
C:\Program Files\Windows Live\Family Safety\fsssvc.exe 216
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 472
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE 584
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 632
C:\WINDOWS\system32\svchost.exe 1144
C:\WINDOWS\system32\wuauclt.exe 1296
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 1560
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 1616
C:\WINDOWS\System32\alg.exe 1108
C:\WINDOWS\system32\KB905474\wgasetup.exe 2268
C:\WINDOWS\Explorer.EXE 2428
C:\WINDOWS\system32\KB905474\wgasetup.exe 2488
C:\WINDOWS\system32\wbem\wmiprvse.exe 2700

################## | Fichiers # Dossiers infectieux |

Supprimé ! D:\autorun.inf

################## | Registre # Clés Run infectieuses |

Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoRecentDocsMenu"

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{0d9dc454-d0cf-11db-a67f-0007cb0000ff}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2298f77c-d328-11dc-a896-0014d13567ff}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2d0f1792-1aa9-11dc-a720-0014d13567ff}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{6cde42ee-53f2-11dc-a7bf-0014d13567ff}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{c452ebe3-4921-11dd-a947-001731842b92}\Shell\setup\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{d6dbe3f4-a6dc-11db-a654-001731842b92}\Shell\Auto\Command

################## | Listing des fichiers présent |

[12/01/2007 15:24|--a------|0] C:\AUTOEXEC.BAT
[12/01/2007 15:19|---hs----|212] C:\boot.ini
[02/10/2001 17:15|-rahs----|4952] C:\Bootfont.bin
[12/01/2007 15:24|--a------|0] C:\CONFIG.SYS
[12/01/2007 15:24|--ahs----|1248] C:\fd1jaw3o.sys
[12/01/2007 15:24|-rahs----|0] C:\IO.SYS
[12/01/2007 15:24|-rahs----|0] C:\MSDOS.SYS
[03/08/2004 21:38|-rahs----|47564] C:\NTDETECT.COM
[03/08/2004 21:59|-rahs----|251712] C:\ntldr
[29/02/2004 16:44|--a------|52576] C:\orange.bmp
[?|?|?] C:\pagefile.sys
[15/11/2009 14:42|--a------|3959] C:\UsbFix.txt
[19/08/2004 15:10|--a------|28672] D:\setupSNK.exe
[25/12/2005 17:23|-r-------|11477288] F:\DivXPlay.exe
[30/11/2005 14:15|-r-------|36211311] F:\PDFTransfomer_Avanquest_eval.exe
[02/01/2000 11:27|--a------|8119236] G:\Kamelancien - Ghettographie.mp3
[01/01/2000 18:47|--a------|6032931] G:\mafia k1-fry-Rabzouz.mp3
[01/01/2000 18:57|--a------|5986345] G:\Rhoff ft Kamel L'Ancien & Sefuy.mp3
[01/01/2000 19:00|--a------|4280865] G:\Sefyu - Goulag.mp3
[18/01/2009 21:12|--a------|3590784] G:\(Rap Francais) Iam & Fonky Family - Bad Boys De Marseille(1).mp3
[01/01/2000 18:53|--a------|6749972] G:\LESS DU NEUF feat MOBB DEEP-freestyl97.wma
[18/01/2009 21:08|--a------|3693188] G:\Rohff- Freestyle Plante Rap TV (Instru D.R.E.).mp3
[22/10/2009 14:21|--a------|4926450] G:\Tupac - All Eyes On Me.mp3
[30/05/2008 02:44|--a------|3780824] G:\ol kainry - abattu de vecu.MP3
[29/08/2005 23:35|--a------|5884282] G:\Kool Shen feat. Dadoo & Rohff - L'avenir est … Nous.mp3
[25/10/2009 14:58|--a------|6361890] G:\114-rohff-le_son_qui_tue_(avec_natty)-pub.mp3
[21/03/2009 14:07|--a------|1322530] G:\Lim .Movez Lang. freestyle.mp3
[15/04/2008 12:45|--a------|5998292] G:\kamelancien-represente.mp3
[03/11/2009 19:53|--a------|19137414] G:\17-movez_lang-freestyle_tous_illicites.mp3
[04/11/2009 13:16|--a------|3627768] G:\Kamelancien - T‚tais ou 2008.mp3
[25/02/2009 19:50|--a------|3389530] G:\Crie Mon Nom alibi,Sefyu,Ol Kainry, Dany Dan.mp3
[28/09/2009 20:15|--a------|6188444] G:\108-sefyu-suis-je_le_gardien_dmon_frereo.mp3
[28/09/2009 20:15|--a------|4851284] G:\ALPHA 5.20 - GUERRE ET PAIX.mp3
[10/07/2009 22:41|--a------|6751186] G:\01-Dontcha-Reste Trankil.mp3
[20/02/2007 13:31|--a------|10160265] G:\Keny_Arkana___Rohff___Soprano___Menzo___Fabe___Akhenaton...Remix_by_Le_Fada.mp3
[07/11/2009 10:27|--a------|4559090] G:\IAM - Petit Frere.mp3
[21/03/2009 13:07|--a------|4634462] G:\Lunatic -la lettre.mp3
[08/03/2009 16:00|--a------|3492776] G:\Nø15-Verset 5.wma
[08/03/2009 16:00|--a------|1336309] G:\Nø18-Verset 6.wma
[08/03/2009 16:01|--a------|7116716] G:\Nø6-La resistance.wma
[08/03/2009 16:02|--a------|1001128] G:\DONCHOA-freestyl97.wma
[08/03/2009 18:15|--a------|4101605] G:\Tupac-Thuglife.mp3
[08/03/2009 18:08|--a------|5319966] G:\tradin was stories-2PAC feat dramacydal,cro,storm.wma

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix.
# D:\autorun.inf -> Dossier créé par UsbFix.
# E:\autorun.inf -> Dossier créé par UsbFix.
# G:\autorun.inf -> Dossier créé par UsbFix.

################## | Suspect | https://www.virustotal.com/gui/ |


################## | Cracks / Keygens / Serials |

encore merci pour ton aide

C'est encore moi ^^

J'ai vidé la quarantaine comme demandé
au cours du scan j'ai eu message d'erreur: code 722 (0,9)
Voici le rapport de Malwarebytes:
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3168
Windows 5.1.2600 Service Pack 2

15/11/2009 16:06:10
mbam-log-2009-11-15 (16-06-10).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|)
Eléments examinés: 199952
Temps écoulé: 1 hour(s), 5 minute(s), 4 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 14
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 18

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\ialmuCHS32.dll (Trojan.Tracur) -> Delete on reboot.
C:\WINDOWS\system32\ialmuCSY32.dll (Trojan.Tracur) -> Delete on reboot.
C:\WINDOWS\system32\extmgr32.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Local Settings\Temp\8.tmp (Trojan.Dropper) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0bad4c24-2c53-440a-bd18-575ee6e2fa3a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0bad4c24-2c53-440a-bd18-575ee6e2fa3a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\18baf6d1691 (Trojan.Tracur) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0bad4c24-2c53-440a-bd18-575ee6e2fa3a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AVR (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdate86.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advanced virus remover (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: c:\windows\system32\ialmuchs32.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\ialmuchs32.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: c:\windows\system32\ialmucsy32.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\ialmucsy32.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\AdvancedVirusRemover (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\LocalService (Worm.Archive) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\extmgr32.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ialmuCHS32.dll (Trojan.Tracur) -> Delete on reboot.
C:\WINDOWS\system32\ialmuCSY32.dll (Trojan.Tracur) -> Delete on reboot.
C:\Documents and Settings\Administrateur\Local Settings\Temp\8.tmp (Trojan.Dropper) -> Delete on reboot.
C:\WINDOWS\system32\winupdate86.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\22.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\1F.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\20.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Local Settings\Temp\2B.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpnwsock32.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpvvox32.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Program Files\AdvancedVirusRemover\AVR.exe (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\LocalService\333.music.au (Worm.Archive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\LocalService\334.music2.au (Worm.Archive) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Menu Démarrer\Advanced Virus Remover.lnk (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\GroupPolicy000.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\GnuHashes.ini (Malware.Trace) -> Quarantined and deleted successfully.

OK merci!
En attendant que le scan se termine, quel antivirus me conseilles tu, vu que les 2 que j'ai en ma possession sont dépassés de validité?
J'essaye de télécharger Bitdefender, mais j'obtiens un fichier "Windows media player"...

Voici le résultat du scan, apparemment je suis toujours infectée, j'espère que c'est pas grave...

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 11/15/2009 at 05:21 PM

Application Version : 4.30.1004

Core Rules Database Version : 4272
Trace Rules Database Version: 2154

Scan type : Complete Scan
Total Scan Time : 00:38:43

Memory items scanned : 506
Memory threats detected : 0
Registry items scanned : 6264
Registry threats detected : 0
File items scanned : 13596
File threats detected : 22

Adware.Tracking Cookie
C:\Documents and Settings\Administrateur\Cookies\administrateur@ad.zanox[3].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[3].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@cnam.solution.weborama[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@247realmedia[2].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@weborama[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@ad.zanox[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@247realmedia[1].txt
C:\Documents and Settings\Administrateur\Cookies\administrateur@atdmt[2].txt
C:\Documents and Settings\TEMP\Cookies\administrateur@atdmt[2].txt
C:\Documents and Settings\TEMP\Cookies\administrateur@smartadserver[2].txt
C:\Documents and Settings\TEMP\Cookies\administrateur@ad.wsod[2].txt
C:\Documents and Settings\TEMP\Cookies\administrateur@msnportal.112.2o7[1].txt

Trojan.Agent/Gen-Nullo[Short]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{10982C90-3706-4FD5-BCE3-B5048C32462D}\RP552\A0039245.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{10982C90-3706-4FD5-BCE3-B5048C32462D}\RP552\A0039242.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{10982C90-3706-4FD5-BCE3-B5048C32462D}\RP552\A0039243.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{10982C90-3706-4FD5-BCE3-B5048C32462D}\RP552\A0039244.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{10982C90-3706-4FD5-BCE3-B5048C32462D}\RP552\A0039250.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{10982C90-3706-4FD5-BCE3-B5048C32462D}\RP552\A0039251.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{10982C90-3706-4FD5-BCE3-B5048C32462D}\RP552\A0039252.DLL

Trojan.Agent/Gen-NumTemp
C:\WINDOWS\SYSTEM32\70.TMP

Trojan.Dropper/Sys-NV
C:\WINDOWS\SYSTEM32\IALMUELL32.DLL
C:\WINDOWS\SYSTEM32\IALMUFRC32.DLL

Et voilà:
https://www.cjoint.com/?lorN7YxkKi

Juste une petite précision, quand j'ai fais certain scan, l'ordi a redémarré et j'ai eu message d'erreur sur un fond bleu: "DRIVER_POWER_STATE_FAILURE"

et cela 2 fois, donc j'ai du faire un "reset" pour redémarré le pc

Je ne sais pas si ça peut t'aidé...

bonjour

g un problème avc nod32 il ne m éface pas le virus je ne peut pas le netoyer ni le suprimer comment faire svp



merci d avance

Voici le rapport du ZHPFix:

Processus mémoire :
(Néant)

Module mémoire :
(Néant)

Clé du Registre :
O40 - ASIC: Microsoft VRML 2.0 Viewer - {90A7533D-88FE-11D0-9DBE-0000C0411FC3} - (not file) => Clé supprimée avec succès
O64 - Services: CurCS - 07c0110a (07c0110a) - LEGACY_07C0110A => Clé supprimée avec succès
O64 - Services: CurCS - a6c417fe (a6c417fe) - LEGACY_A6C417FE => Clé supprimée avec succès

Valeur du Registre :
O47 - AAKE:Key Export SP - "C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Windows Shell" => Valeur supprimée avec succès

Elément de données du Registre :
(Néant)

Dossier :
C:\Program Files\Norton Security Scan => Supprimé et mis en quarantaine

Fichier :
c:\windows\system32\ovkziylaklz16iy.vbs => Supprimé et mis en quarantaine
c:\windows\system32\moa7yndnh9xl89k.vbs => Supprimé et mis en quarantaine
c:\windows\system32\ygheblgzwolb67t.vbs => Supprimé et mis en quarantaine
c:\windows\system32\ds35z.vbs => Supprimé et mis en quarantaine
c:\windows\system32\mpdge.vbs => Supprimé et mis en quarantaine
c:\windows\system32\4f.tmp => Supprimé et mis en quarantaine
c:\windows\system32\producttweaks.xml => Supprimé et mis en quarantaine
c:\windows\system32\user_gensett.xml => Supprimé et mis en quarantaine
c:\windows\pack.epk => Supprimé et mis en quarantaine

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 3
Valeur du Registre : 1
Elément de données du Registre : 0
Dossier : 1
Fichier : 9
Logiciel : 0
Autre : 0


End of the scan

Voici le contenu de log.txt:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-11-15 18:56:14
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 628 MB (3%) free of 25 GB
Total RAM: 503 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57:10, on 15/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Athan\Athan.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BitDefender\BitDefender 2009\uiscan.exe
C:\Program Files\BitDefender\BitDefender 2009\uiscan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - c:\program files\shareaza\razawebhook32.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S87.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'Default user')
O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download with &Shareaza - res://c:\program files\shareaza\razawebhook32.dll/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?623fafa1d808420e804a4f635d56d021
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?623fafa1d808420e804a4f635d56d021
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Google Update (gupdate1c9c8f8a0e7a4f0) (gupdate1c9c8f8a0e7a4f0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

Je le scan online de bitdefender vient de se terminer et 0 virus trouvé.

Je n'ai plus de pop-up d'attaque externe, tout à l'air d'aller bien.

Je te remercie beaucoup pour ton aide, et j'espère ne plus attraper de tel virus.
J'ai finalement opté pour l'antivirus Bitdefender.

Est ce que je peux maintenant supprimer tout ce qui est ZHP, Hijack, Superantyspyware,Malewarebytes, lavasoft et RSIT?

Tu es vraiment calé en informatique, même un cheval de Troie ne te résiste pas.
Merci