Trojan-Cliker.Win32.Vesloruki.dcoRésolu/Fermé

Question

Bonjour,
Je me permets de vous embêter parce que depuis hier (où j'ai renouvelé ma licence kaspersky.......) j'ai tout un tas de fenêtres de detection de virus qui apparaissent (plusieurs Win32(NetSky/FraudPack/Wlords/Zbot... et autres trucs sympas). Je ne parviens pas a m'en débarraser, quelqu'un aurait une solution ?
Merci ^^

Miragien · Answer

Bonjour,

Télécharge Hijackthis 2.0.2
http://www.trendsecure.com/portal/fr/_download/HJTInstall.exe

> Installez le, une fois l'installation terminé, cliquez sur l'icône.

> Cliquez sur "Do a system scan and save a logfile".

> Attendre jusqu'à ce que le rapport s'affiche.

> Postez le sur le forum.

Cipra · Answer

Merci pour la réponse (super rapide!)

Voila le compte rendu: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:16:23, on 05/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\svw.exe
C:\Program Files\QuickTime\QTTask.exe
D:\Bureau\iTunesHelper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack	osOBEX.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack	osBtProc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\WINDOWS\odbn0.exe
D:\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKLM\..\Run: [EPSON Stylus D88 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE /P23 "EPSON Stylus D88 Series" /O6 "USB001" /M "Stylus D88"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [lsass] C:\WINDOWS\lsass.exe
O4 - HKLM\..\Run: [netw] C:\WINDOWS\svw.exe
O4 - HKLM\..\Run: [odbny0] C:\WINDOWS\odbn0.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Bureau\iTunesHelper.exe"
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = D:\Bureau\Nouveau dossier\Xfire\Xfire.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O15 - Trusted Zone: http://*.buy-internetsecurity10.com
O15 - Trusted Zone: http://*.buy-is2010.com
O15 - Trusted Zone: http://*.is-software-download.com
O15 - Trusted Zone: http://*.is-software-download25.com
O15 - Trusted Zone: http://*.is10-soft-download.com
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O15 - Trusted Zone: http://*.buy-internetsecurity10.com (HKLM)
O15 - Trusted Zone: http://*.buy-is2010.com (HKLM)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll,C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

Miragien · Answer

Pour la rapidité des réponses c'est par ce que a cette heure il n'y a pas trop de monde donc bon je peut répondre vite mais le soir à 8 heures tout le monde ce connecte et je prend du retard généralement. Le plus dur c'est de jongler entre les différents problèmes et ne pas se tromper de personne ^^ ! 

Pour commencer : il faut mettre à jour internet explorer la version 8 est sortie !

Ensuite tu est vraiment bien infecté ^^ par des virus : Relancez HijackThis > puis : Do a system scan only > coche ces lignes:

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)

O15 - Trusted Zone: http://*.is-software-download.com

O15 - Trusted Zone: http://*.is10-soft-download.com

ensuite valides sur Fix checked 

Enfin : Télécharge Malwarebytes’ Anti-Malware :
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

> Enregistrez le sur le bureau. Double cliquez sur le fichier téléchargé pour lancer le processus d’installation.

> Lorsqu’il le sera demandé, mettre à jour Malwarebytes anti malware, si le pare-feu demande l’autorisation de se connecter pour malwarebytes, acceptez. Une fois la mise à jour terminée, fermez Malwarebytes.

> Double-cliquez sur l’icône de malwarebytes pour le relancer, sélectionnez Exécuter un examen complet. Cliquez sur Rechercher

> A la fin de l’analyse, un message s’affiche : L’examen s’est terminé normalement. Cliquez sur ‘Afficher les résultats’ pour afficher tous les objets trouvés. Cliquez sur Ok pour poursuivre.

> Si des malwares ont été détectés, cliquez sur Afficher les résultats. Sélectionnez tout (ou laissez cochés) et cliquez sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

> Malwarebytes va ouvrir le bloc-notes et y copier le rapport d’analyse. Rendez-vous dans l’onglet rapport/log. Cliquez dessus pour l’afficher.

> Coller le rapport affiché sur le forum et attendez ma réponse.

Note : Tutoriel en cas de besoin.
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

J' attend ta réponse pour poursuivre

Cipra · Answer

Désolé, ce fut un peu long mais apparement c'est un "peu" la cata!

Voila le rapport : 

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3693
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

05/02/2010 18:00:38
mbam-log-2010-02-05 (18-00-38).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 203632
Temps écoulé: 48 minute(s), 53 second(s)

Processus mémoire infecté(s): 3
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 7
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 20

Processus mémoire infecté(s):
C:\WINDOWS\lsass.exe (Trojan.PWS) -> Unloaded process successfully.
C:\WINDOWS\svw.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\WINDOWS\odbn0.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\IS2010 (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass (Trojan.PWS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
etw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odbny0 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\lowsec (Stolen.data) -> Quarantined and deleted successfully.
C:\Program Files\InternetSecurity2010 (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{A86CFCA8-1E78-4E36-8351-E4E4DF02E898}\RP383\A0137295.exe (Trojan.Clicker) -> Delete on reboot.
C:\System Volume Information\_restore{A86CFCA8-1E78-4E36-8351-E4E4DF02E898}\RP385\A0137671.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS	mp2188972.log (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS	mp2501919.log (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS	mp4274255.log (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\avto.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\Fichiers Internet temporaires\Content.IE5\PZCYCVFG\dfghfghgfj[1].dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\5_odbn0.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\avto1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS	mp2364489.log (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS	mp3010907.log (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS	mp7948238.log (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS	mp9165450.log (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\lsass.exe (Trojan.PWS) -> Quarantined and deleted successfully.
C:\WINDOWS\svw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp	este1_p.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Moi\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\odbn0.exe (Trojan.Agent) -> Delete on reboot.


A+

Miragien · Answer

Redémarre l'ordinateur et fais ceci :

1) Affiche les fichiers et dossiers cachés …
Pour ce faire, tu vas dans un dossier, par ex. "Mes Images".
Ensuite, clique sur > Outils > Options des dossiers ...
clique sur l' onglet « Affichage » et ...
coche ---> Afficher les fichiers et dossiers cachés
décoche > Masquer les extensions des fichiers dont le type est connu
décoche > Masquer les fichiers protégés du système d' exploitation (recommandé).
« Appliquer » et « OK ».

2) Désactive toute protection résidente ( antivirus…) !
Déconnecte-toi d’internet, ferme tous les programmes en cours et laisse combofix travailler : ne fais donc pas autre chose en même temps !

Et suis ce tutoriel :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Cipra · Answer

Re, voila le rapport qu'on m'a dit de poster....

ComboFix 10-02-04.08 - Moi 05/02/2010  18:57:04.1.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1022.516 [GMT 1:00]
Lancé depuis: c:\documents and settings\Moi\Mes documents\Téléchargements\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:ecycler\S-1-5-21-4167916875-3346276497-1664007675-500
c:\windows\kb913800.exe
c:\windows\system32\18467.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_AVPsys


(((((((((((((((((((((((((((((   Fichiers créés du 2010-01-05 au 2010-02-05  ))))))))))))))))))))))))))))))))))))
.

2010-02-05 15:15 . 2010-02-05 15:15	--------	d-----w-	c:\documents and settings\Moi\Application Data\Malwarebytes
2010-02-05 15:15 . 2010-01-07 15:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-05 15:15 . 2010-02-05 15:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-05 15:15 . 2010-01-07 15:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-02-05 07:25 . 2010-02-05 13:01	--------	d-----w-	C:\Ad-Remover
2010-02-04 21:33 . 2010-02-04 21:33	--------	d-----w-	c:\documents and settings\All Users\Application Data\NVIDIA
2010-02-04 13:52 . 2009-05-18 13:17	26600	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-04 13:52 . 2008-04-17 12:12	107368	----a-w-	c:\windows\system32\GEARAspi.dll
2010-02-04 13:50 . 2010-02-04 13:50	--------	d-----w-	c:\program files\iPod
2010-02-04 13:50 . 2010-02-04 13:52	--------	d-----w-	c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-02-04 13:49 . 2010-02-04 13:49	--------	d-----w-	c:\program files\Bonjour
2010-02-04 13:47 . 2010-02-04 13:49	--------	d-----w-	c:\program files\QuickTime
2010-02-04 13:45 . 2010-02-04 13:45	--------	d-----w-	c:\documents and settings\Moi\Local Settings\Application Data\Apple
2010-02-04 13:45 . 2010-02-04 13:45	--------	d-----w-	c:\program files\Apple Software Update
2010-02-04 13:44 . 2009-08-28 18:42	40448	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2010-02-04 13:44 . 2009-08-28 18:42	2065696	----a-w-	c:\windows\system32\usbaaplrc.dll
2010-02-04 13:43 . 2010-02-04 13:50	--------	d-----w-	c:\program files\Fichiers communs\Apple
2010-02-04 13:43 . 2010-02-04 13:45	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2010-02-04 10:27 . 2010-02-04 10:27	--------	d-----w-	c:\documents and settings\Moi\Bureau
2010-02-04 10:26 . 2001-08-23 16:47	5632	----a-w-	c:\windows\system32\ptpusb.dll
2010-02-04 10:26 . 2004-08-03 23:54	159232	----a-w-	c:\windows\system32\ptpusd.dll
2010-02-04 10:26 . 2004-08-03 21:58	15104	-c--a-w-	c:\windows\system32\dllcache\usbscan.sys
2010-02-04 10:26 . 2004-08-03 21:58	15104	----a-w-	c:\windows\system32\drivers\usbscan.sys
2010-02-04 09:05 . 2009-11-21 16:42	470528	-c----w-	c:\windows\system32\dllcache\aclayers.dll
2010-01-22 18:51 . 2010-01-22 18:51	72488	----a-w-	c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-05 18:07 . 2008-04-22 12:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-02-05 16:59 . 2006-03-20 05:30	74630	----a-w-	c:\windows\system32\perfc00C.dat
2010-02-05 16:59 . 2006-03-20 05:30	466974	----a-w-	c:\windows\system32\perfh00C.dat
2010-02-04 23:13 . 2008-04-24 00:33	--------	d-----w-	c:\program files\eMule
2010-02-04 22:43 . 2006-03-20 14:41	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-02-04 14:11 . 2008-04-22 20:56	696352	--sha-w-	c:\windows\system32\drivers\fidbox2.dat
2010-02-04 14:11 . 2008-04-22 20:56	32864	--sha-w-	c:\windows\system32\drivers\fidbox2.idx
2010-02-04 14:11 . 2008-04-22 20:56	188720	--sha-w-	c:\windows\system32\drivers\fidbox.idx
2010-02-04 14:11 . 2008-04-22 20:56	13932832	--sha-w-	c:\windows\system32\drivers\fidbox.dat
2010-02-04 14:05 . 2008-08-31 11:25	--------	d-----w-	c:\documents and settings\Moi\Application Data\Apple Computer
2010-02-04 13:56 . 2008-04-22 12:02	--------	d-----w-	c:\program files\Kaspersky Lab
2010-02-04 13:53 . 2008-04-22 20:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-02-04 13:50 . 2008-04-24 00:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
2010-02-04 10:25 . 2008-04-23 18:52	--------	d-----w-	c:\program files\Mozilla Firefox 3 Beta 2
2010-01-05 09:56 . 2006-03-20 05:29	832512	----a-w-	c:\windows\system32\wininet.dll
2010-01-05 09:56 . 2006-03-20 05:29	78336	----a-w-	c:\windows\system32\ieencode.dll
2010-01-05 09:56 . 2006-03-20 05:29	17408	------w-	c:\windows\system32\corpol.dll
2009-11-22 14:04 . 2009-11-22 14:04	204601	----a-w-	c:\documents and settings\Moi\Application Data\Sony Online Entertainment
psoeact.dll
2009-11-21 16:42 . 2006-03-20 05:28	470528	----a-w-	c:\windows\AppPatch\aclayers.dll
2009-11-14 23:48 . 2009-11-14 23:48	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-11-14 23:47 . 2009-11-14 23:47	152576	----a-w-	c:\documents and settings\Moi\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-12 21:10 . 2008-04-22 20:53	95259	----a-w-	c:\windows\system32\drivers\klick.dat
2009-11-12 21:10 . 2008-04-22 20:53	108059	----a-w-	c:\windows\system32\drivers\klin.dat
2008-04-22 20:51 . 2008-04-22 20:50	31920464	----a-w-	c:\program files\kaspersky 7.0.exe
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-06 7557120]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-17 118784]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 45056]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2005-12-13 217088]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-11 151552]
"PDService.exe"="c:\program files\Utimaco\SafeGuard PrivateDisk\pdservice.exe" [2004-07-06 40960]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 483328]
"PrepareYourVAIO"="c:\program files\Sony\Prepare your VAIO\PYVAlert.exe" [2005-01-21 118784]
"WooCnxMon"="c:\progra~1\Wanadoo\CnxMon.exe" [2004-10-13 24576]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-10-13 24576]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\TaskbarIcon.exe" [2004-10-13 49152]
"EPSON Stylus D88 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE" [2005-01-27 98304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-14 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="d:\bureau\iTunesHelper.exe" [2010-01-22 141608]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 340456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-12-7 1744896]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-20 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\VESWinlogon]
2005-05-20 16:42	73728	----a-w-	c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Adobe\Photoshop Elements 4.0\AdobePhotoshopElementsMediaServer.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Messenger\livecall.exe"=
"c:\Program Files\Ubisoft\THE SETTLERS - Bâtisseurs d'Empire\base\bin\Settlers6.exe"=
"c:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe"=
"c:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"d:\Bureau\iTunes.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 36880]
R1 PrivateDisk;PrivateDisk;c:\windows\system32\drivers\privatediskm.sys [06/07/2004 14:07 45627]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 18:02 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02/10/2009 19:39 19472]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [20/03/2006 06:30 29184]
R3 ti21sony;ti21sony;c:\windows\system32\drivers	i21sony.sys [20/03/2006 06:30 226304]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]
.
Contenu du dossier 'Tâches planifiées'

2009-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
IE: Ajouter à l'Anti-bannière - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: buy-internetsecurity10.com
Trusted Zone: buy-is2010.com
Trusted Zone: is-software-download25.com
Trusted Zone: sony-europe.com
Trusted Zone: sonystyle-europe.com
Trusted Zone: vaio-link.com
Trusted Zone: buy-internetsecurity10.com
Trusted Zone: buy-is2010.com
FF - ProfilePath - c:\documents and settings\Moi\Application Data\Mozilla\Firefox\Profiles\djzc6s6a.default\
FF - component: c:\program files\Mozilla Firefox 3 Beta 2\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: d:\bureau\Mozilla Plugins
pitunes.dll

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\Mozilla Firefox 3 Beta 2\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 19:07
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1607439802-1336390301-2252363875-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bf,db,34,d1,73,6c,d1,2a,45,e1,77,46,78,23,45,fc,e5,9e,9d,02,e0,61,aa,
   ca,ed,b1,91,4f,ff,df,fc,d2,ad,d2,fb,c5,5b,0d,b8,71,7d,d8,f8,e6,3d,7b,53,0a,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-1607439802-1336390301-2252363875-1006\Software\SecuROM\License information*]
"datasecu"=hex:ee,04,1a,6a,01,a5,44,9f,5c,d5,5e,5f,56,4c,f4,f0,d4,99,25,d8,2f,
   4b,b1,c2,1a,6f,d6,ce,54,02,25,c9,c0,23,f9,5b,c7,16,6a,cd,e4,e0,ae,69,e5,9a,\
"rkeysecu"=hex:cd,9f,f9,2e,b4,e0,93,82,94,f3,83,79,98,65,f0,2d
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1908)
c:\windows\system32\VESWinlogon.dll

- - - - - - - > 'explorer.exe'(3976)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\ICO.EXE
c:\windows\eHome\ehmsas.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack	osOBEX.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack	osBtProc.exe
.
**************************************************************************
.
Heure de fin: 2010-02-05  19:12:30 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-02-05 18:12

Avant-CF: 27 248 115 712 octets libres
Après-CF: 27 557 896 192 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptOut

- - End Of File - - E502BBA8E9FEC2946B87F43C873B8E95



Faut faire autre chose ensuite ?

Miragien · Answer

Refais un scan hijack this

Cipra · Answer

Voila le dernier scan

PS : j'ai pas réussi à installer internet explorer 8 mais je l'utilise pas, je me sers de mozilla, je sais pas si c'est important....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:10:26, on 05/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
D:\Bureau\iTunesHelper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack	osOBEX.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack	osBtProc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\WINDOWS\system32\msiexec.exe
D:\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKLM\..\Run: [EPSON Stylus D88 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE /P23 "EPSON Stylus D88 Series" /O6 "USB001" /M "Stylus D88"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Bureau\iTunesHelper.exe"
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\Moi\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Startup: Xfire.lnk = D:\Bureau\Nouveau dossier\Xfire\Xfire.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
O15 - Trusted Zone: http://*.buy-internetsecurity10.com
O15 - Trusted Zone: http://*.buy-is2010.com
O15 - Trusted Zone: http://*.is-software-download25.com
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O15 - Trusted Zone: http://*.buy-internetsecurity10.com (HKLM)
O15 - Trusted Zone: http://*.buy-is2010.com (HKLM)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

Miragien · Answer

Laisse tomber pour internet explorer ^^


Relancez HijackThis > puis : Do a system scan only > coche ces lignes: 

O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\Moi\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe

ensuite valides sur Fix checked 

Le problème persiste ?

Cipra · Answer

Coucou, hier soir j'ai refais un coup de kaspersky, il a trouvé un truc encore et depuis j'ai plus de soucis. J'ai fais la manip indiquée dans le post précédent. Merci beaucoup en tout cas pour cette précieuse aide. Je dois faire autre chose tu crois ?

Miragien · Answer

Oui une dernière vérification :

Fait une analyse avec ceci :
https://www.bitdefender.com/toolbox/

Puis poste le rapport.

Cipra · Answer

Voila : BitDefender QuickScan Beta 32-bit v0.9.9.0 ------------------------------------------ Date de l'analyse : Sat Feb 06 17:14:37 2010 ID de la machine : 54A58EF0 Aucune infection détectée. ---------------------------- Processus --------- AcroTray - Adobe Acrobat Distiller helper applicat 2436 C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe Application CnxMon 2652 C:\Program Files\Wanadoo\CnxMon.exe Bluetooth Stack for Windows by TOSHIBA 3928 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe Bluetooth Stack for Windows by Toshiba 532 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe Bluetooth Stack for Windows par TOSHIBA 2772 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe Bluetooth Stack for Windows par TOSHIBA 3824 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe Intel(R) PROSet/Wireless Event Log 456 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe Intel(R) PROSet/Wireless Registry Service 1056 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe Intel(R) PROSet/Wireless Service 512 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe ISB Utility 1040 C:\Program Files\Sony\ISB Utility\ISBMgr.exe Microsoft SQL Server 984 C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe PhotoshopElementsFileAgent.exe 1792 C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe PrivateDisk 2176 C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe QuickTime 3020 C:\Program Files\QuickTime\QTTask.exe TaskbarIcon.exe 2852 C:\Program Files\Wanadoo\TaskbarIcon.exe TOSHIBA CORPORATION 1528 C:\Program Files\Toshiba\Bluetooth Toshiba Stack osBtProc.exe tosOBEX 3096 C:\Program Files\Toshiba\Bluetooth Toshiba Stack osOBEX.exe VAIO Camera Utility 1164 C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe VAIO Entertainment 2960 C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe VAIO Entertainment 3316 C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe VAIO Entertainment 2788 C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe VAIO Event Service 2808 C:\Program Files\Sony\VAIO Event Service\VESMgr.exe VAIO Power Management 1232 C:\Program Files\Sony\VAIO Power Management\SPMgr.exe VAIO Update 2096 C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe Wireless Switch Setting Utility 2052 C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe Alps Pointing-device Driver 1612 C:\Program Files\Apoint\Apoint.exe Alps Pointing-device Driver for Windows NT/2000/XP 4008 C:\Program Files\Apoint\Apntex.exe Apple Mobile Device Service 1872 C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe Bonjour 572 C:\Program Files\Bonjour\mDNSResponder.exe EPSON Status Monitor 3 2876 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE Firefox 328 C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe iTunes 2544 C:\Program Files\iPod\bin\iPodService.exe iTunes 3100 D:\Bureau\iTunesHelper.exe Java(TM) Platform SE 6 U17 864 C:\Program Files\Java\jre6\bin\jqs.exe Java(TM) Platform SE 6 U17 2976 C:\Program Files\Java\jre6\bin\jusched.exe Kaspersky Anti-Virus 1956 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe Kaspersky Anti-Virus 3188 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe Kaspersky Anti-Virus 4816 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe Microsoft® Windows® Operating System 2316 C:\WINDOWS\eHome\ehmsas.exe Microsoft® Windows® Operating System 524 C:\WINDOWS\eHome\ehRecvr.exe Microsoft® Windows® Operating System 836 C:\WINDOWS\ehome\ehtray.exe Microsoft® Windows® Operating System 3172 C:\WINDOWS\ehome\mcrdsvc.exe Microsoft® Windows® Operating System 2372 C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe Microsoft® Windows® Operating System 4024 C:\WINDOWS\System32\alg.exe Microsoft® Windows® Operating System 1868 C:\WINDOWS\system32\csrss.exe Microsoft® Windows® Operating System 3300 C:\WINDOWS\system32\ctfmon.exe Microsoft® Windows® Operating System 1952 C:\WINDOWS\system32\lsass.exe Microsoft® Windows® Operating System 776 C:\WINDOWS\system32\spoolsv.exe Microsoft® Windows® Operating System 2272 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System 1532 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System 1496 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System 248 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System 828 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System 400 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System 2948 C:\WINDOWS\System32\svchost.exe Microsoft® Windows® Operating System 356 C:\WINDOWS\System32\svchost.exe Microsoft® Windows® Operating System 300 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System 4592 C:\WINDOWS\system32\wscntfy.exe Microsoft® Windows® Operating System 6024 C:\WINDOWS\system32\wuauclt.exe MouseSuite 98 1064 C:\WINDOWS\system32\ICO.EXE NVIDIA Driver Helper Service, Version 84.18 892 C:\WINDOWS\system32 vsvc32.exe Système d'exploitation Microsoft® Windows® 1740 C:\WINDOWS\Explorer.EXE Système d'exploitation Microsoft® Windows® 1940 C:\WINDOWS\system32\services.exe Système d'exploitation Microsoft® Windows® 1820 C:\WINDOWS\System32\smss.exe Système d'exploitation Microsoft® Windows® 2580 C:\WINDOWS\system32\wbem\wmiapsrv.exe Système d'exploitation Microsoft® Windows® 1892 C:\WINDOWS\system32\winlogon.exe Activité du réseau ------------------ Processus avp.exe (1956) connecté sur le port 80 (HTTP) - a88-221-173-115.deploy.akamaitechnologies.com Processus avp.exe (1956) connecté sur le port 80 (HTTP) - a92-123-128-20.deploy.akamaitechnologies.com Processus avp.exe (1956) connecté sur le port 80 (HTTP) - 66.235.142.2 Processus avp.exe (1956) connecté sur le port 80 (HTTP) - ew-in-f101.1e100.net Processus svchost.exe (300) écoute sur les ports: 135 (RPC) Processus svchost.exe (1532) écoute sur les ports: 2869 (SSDP event notification, UPNP) Processus avp.exe (1956) écoute sur les ports: 1110, 19780 Processus VCSW.exe (2960) écoute sur les ports: 51493 Fichiers critiques et Autorun ----------------------------- AcroTray - Adobe Acrobat Distiller helper applicat C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe Application CnxMon C:\Program Files\Wanadoo\CnxMon.exe ISB Utility C:\Program Files\Sony\ISB Utility\ISBMgr.exe Kit de Connexion et de Services C:\Program Files\Wanadoo\Watch.exe Microsoft Office 2000 C:\Program Files\Microsoft Office\Office\OSA9.EXE PrivateDisk C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe Préparez votre VAIO C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe QuickTime C:\Program Files\QuickTime\QTTask.exe TaskbarIcon.exe C:\Program Files\Wanadoo\TaskbarIcon.exe VAIO Camera Utility C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe VAIO Event Service C:\WINDOWS\system32\VESWinlogon.dll VAIO Power Management C:\Program Files\Sony\VAIO Power Management\SPMgr.exe VAIO Update C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe Wireless Switch Setting Utility C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe Alps Pointing-device Driver C:\Program Files\Apoint\Apoint.exe Apple Software Update C:\Program Files\Apple Software Update\SoftwareUpdate.exe EPSON Status Monitor 3 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABE.EXE iTunes D:\Bureau\iTunesHelper.exe Java(TM) Platform SE 6 U17 C:\Program Files\Java\jre6\bin\jusched.exe Kaspersky Anti-Virus C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe Kaspersky Anti-Virus c:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll Kaspersky Anti-Virus C:\WINDOWS\system32\klogon.dll Microsoft® Windows® Operating System C:\WINDOWS\ehome\ehtray.exe Microsoft® Windows® Operating System C:\WINDOWS\system32\cryptnet.dll Microsoft® Windows® Operating System C:\WINDOWS\system32\ctfmon.exe Microsoft® Windows® Operating System C:\WINDOWS\system32\WPDShServiceObj.dll MouseSuite 98 C:\WINDOWS\system32\ICO.EXE NVIDIA Compatible Windows 2000 Display driver, Ver C:\WINDOWS\system32 vcpl.dll Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\browseui.dll Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\crypt32.dll Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\cscdll.dll Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\logonui.exe Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\sclgntfy.dll Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\shell32.dll Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\stobject.dll Système d'exploitation Microsoft® Windows® c:\windows\system32\userinit.exe Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\wlnotify.dll Windows® Internet Explorer C:\WINDOWS\system32\webcheck.dll Plugins du navigateur --------------------- Adobe Acrobat C:\Program Files\Internet Explorer\plugins ppdf32.dll Application Messager C:\Program Files\Wanadoo Messager\Wanadoo Messager.exe Bonjour C:\Program Files\Bonjour\mdnsNSP.dll Java(TM) Platform SE 6 U17 c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll nppdf32.FRA C:\Program Files\Internet Explorer\plugins ppdf32.FRA QuickTime Plug-in 7.6.5 C:\Program Files\Internet Explorer\plugins pqtplugin.dll QuickTime Plug-in 7.6.5 C:\Program Files\Internet Explorer\plugins pqtplugin2.dll QuickTime Plug-in 7.6.5 C:\Program Files\Internet Explorer\plugins pqtplugin3.dll QuickTime Plug-in 7.6.5 C:\Program Files\Internet Explorer\plugins pqtplugin4.dll QuickTime Plug-in 7.6.5 C:\Program Files\Internet Explorer\plugins pqtplugin5.dll QuickTime Plug-in 7.6.5 C:\Program Files\Internet Explorer\plugins pqtplugin6.dll QuickTime Plug-in 7.6.5 C:\Program Files\Internet Explorer\plugins pqtplugin7.dll QuickTime Plug-in 7.6.5 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pqtplugin.dll QuickTime Plug-in 7.6.5 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pqtplugin2.dll QuickTime Plug-in 7.6.5 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pqtplugin3.dll QuickTime Plug-in 7.6.5 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pqtplugin4.dll QuickTime Plug-in 7.6.5 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pqtplugin5.dll QuickTime Plug-in 7.6.5 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pqtplugin6.dll QuickTime Plug-in 7.6.5 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pqtplugin7.dll SearchPageURL Module c:\program files\wanadoo\searchpageurl.dll SYNERTEL/I Win-Minitel Plugin C:\Program Files\Internet Explorer\plugins\NPWMin32.dll AcroIEHelper Library C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll BitDefender QuickScan C:\Documents and Settings\Moi\Application Data\Mozilla\Firefox\Profiles/djzc6s6a.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll BitDefender QuickScan C:\Documents and Settings\Moi\Application Data\Mozilla\Firefox\Profiles/djzc6s6a.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins pqscan.dll Facebook Photo Uploader 5 C:\WINDOWS\Downloaded Program Files\ImageUploader5.ocx Java Deployment Toolkit 6.0.170.4 C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pdeploytk.dll Java(TM) Platform SE 6 U17 c:\program files\java\jre6\bin\jp2ssv.dll Kaspersky Anti-Virus c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll Kaspersky Anti-Virus c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll Microsoft® Windows® Operating System C:\WINDOWS\Network Diagnostic\xpnetdiag.exe Microsoft® Windows® Operating System C:\WINDOWS\system32 svpsp.dll Microsoft® Windows® Operating System C:\WINDOWS\system32\winrnr.dll Mozilla Default Plug-in C:\Program Files\Mozilla Firefox 3 Beta 2\plugins pnul32.dll npitunes.dll D:\Bureau\Mozilla Plugins pitunes.dll NPSWF32.dll C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll Silverlight Plug-In C:\Program Files\Microsoft Silverlight\3.0.50106.0 pctrl.dll Système d'exploitation Microsoft® Windows® C:\WINDOWS\system32\mswsock.dll Windows® Internet Explorer C:\WINDOWS\system32\ieframe.dll Analyse ------- Aucun fichier téléchargé vers le serveur. Analyse terminée - la communication a duré 3 secondes Trafic total - 0.08 Mo envoyés, 3.62 Ko reçus 1567 fichiers et modules analysés - 71 seconds

Miragien · Answer

Voila c'est terminé je te souhaite une bonne soirée;
Au revoir (en espérant que la prochaine fois sa ne sera pas pour des virus ^_^)

Cipra · Answer

En tout cas merci beaucoup, j'espère aussi que la prochaine fois ce ne sera pas pour une invasion de virus...
J'ai tout de même une dernière petite question: je dois désinstaller Hijack this et Malwarebytes ?

Merci encore et à bientôt (pas trop tôt tout de même!)

Miragien · Answer

Pour HJT désinstalle le sinon pour Malwarebytes tu peut le garder et lui faire exécuter un scan de temps en temps il n'ai pas dangereux ! ^^

Pense a mettre le sujet en résolut !

Cipra · Answer

Merci encore une fois pour tout !
A+

Trojan-Cliker.Win32.Vesloruki.dco

16 réponses

Discussions similaires

Newsletters