Win32:Adware-gen impossible à supprimerRésolu/Fermé

Question

Bonjour,
je n'arrive pas à supprimer cette adware : Win32:Adware-gen [Adw]. Le logiciel antivirus installé sur cet ordinatur était .. juste avast. J'ai installé spybot et ad-aware, mais à chaque fois qu'ils tentent d'effectuer une analyse, l'ordinateur redémarre. : / Comme je ne m'y connais pas particulièrement en PC je ne sais déjà plus quoi faire. Je sais sinon que l'adware s'installe souvent dans les fichiers temp, mais ils n'en sont pas la source.

Merci d'avance pour votre aide...

jlpjlp · Accepted Answer

ok ne fais pas de suite l'antivirus en ligne , fais d'abord ceci car tu es détourné quand tu surf:


# télécharger Hoster :
http://www.funkytoad.com/download/HostsXpert.zip

# Dézipper le dossier sur le bureau.
# Lancer Hoster et cliquer sur Restore Microsoft's Hosts File 

______________



AVG antispyware
http://free.grisoft.com/doc/download-free-anti-spyware/us/frt/0
https://www.01net.com/telecharger/

Tuto : 
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html 

->Relance AVG AS -> "Analyse" ->"Paramètres" 

Sous la question "Comment réagir ?" : 

-> clique sur "Actions recommandées" et choisis "Quarantaines" 
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" 

Si un fichier est infecté en fin d'analyse 

->Clique sur "Appliquer toutes les actions " 

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous". 

->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici

_______________
recolle un hijakhcits

jlpjlp · Answer

slt,


colle un rapport hijackthis 
 

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."


___________________



 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Pandorea · Answer

Ok je m'y met!

jlpjlp · Answer

ok 

a plus

Pandorea · Answer

Donc,le rapport d'AVG :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	23:07:12 24/03/2008

 + Résultat de l'analyse:	



C:\lifsdxvr.exe -> Downloader.Agent.hyy : Nettoyé et sauvegardé (mise en quarantaine).
C:\ovvbu.exe -> Downloader.Tiny.ali : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Helper\1206283618.dll -> Not-A-Virus.Adware.E404 : Nettoyé et sauvegardé (mise en quarantaine).
[52664] C:\Program Files\Helper\1206283618.dll -> Not-A-Virus.Adware.E404 : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Pandore\Local Settings\Temp\removalfile.bat -> Not-A-Virus.Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Pandore\Cookies\pandore@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@247realmedia[3].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@247realmedia[4].txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.138:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.66:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.91:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@2o7[4].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adbrite.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@aoleusearch.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@divx.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@excedence.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fnac.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@gaiainteractive.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@heavycom.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@kaboose.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@mistergooddeal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@msnaccountservices.112.2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@notrefamille.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@opodo.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@paypal.112.2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@pentonmedia.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@shopping.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@viafrplayer.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@viagaiaworlds.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@viamtvnvideo.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.abcsearch[1].txt -> TrackingCookie.Abcsearch : Nettoyé.
:mozilla.110:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.111:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@3.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@4.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@4.adbrite[4].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adbrite[4].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ads.adbrite[3].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adrenaline[1].txt -> TrackingCookie.Adrenaline : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adrevolver[1].txt -> TrackingCookie.Adrevolver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adrevolver[2].txt -> TrackingCookie.Adrevolver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adrevolver[4].txt -> TrackingCookie.Adrevolver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@media.adrevolver[3].txt -> TrackingCookie.Adrevolver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@media.adrevolver[5].txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.18:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@advertising[3].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adviva[2].txt -> TrackingCookie.Adviva : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adviva[3].txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.46:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.100:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Belstat : Nettoyé.
:mozilla.76:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.burstbeacon[3].txt -> TrackingCookie.Burstbeacon : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@burstnet[1].txt -> TrackingCookie.Burstnet : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@burstnet[2].txt -> TrackingCookie.Burstnet : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@burstnet[3].txt -> TrackingCookie.Burstnet : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.burstnet[1].txt -> TrackingCookie.Burstnet : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.burstnet[2].txt -> TrackingCookie.Burstnet : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.burstnet[3].txt -> TrackingCookie.Burstnet : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@casalemedia[1].txt -> TrackingCookie.Casalemedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@casalemedia[2].txt -> TrackingCookie.Casalemedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@casalemedia[3].txt -> TrackingCookie.Casalemedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@clickbank[1].txt -> TrackingCookie.Clickbank : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fl01.ct2.comclick[3].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@connextra[1].txt -> TrackingCookie.Connextra : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@dealtime[1].txt -> TrackingCookie.Dealtime : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@stat.dealtime[1].txt -> TrackingCookie.Dealtime : Nettoyé.
:mozilla.27:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@enhance[2].txt -> TrackingCookie.Enhance : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@e-2dj6wfkosodzcdo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@e-2dj6whl4klcjwho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@e-2dj6wjlyghcpmfq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Nettoyé.
:mozilla.29:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.etracker[1].txt -> TrackingCookie.Etracker : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@adopt.euroclick[3].txt -> TrackingCookie.Euroclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fastclick[3].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fastclick[4].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@findwhat[1].txt -> TrackingCookie.Findwhat : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@findwhat[2].txt -> TrackingCookie.Findwhat : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fortunecity[2].txt -> TrackingCookie.Fortunecity : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@fortunecity[3].txt -> TrackingCookie.Fortunecity : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@hit.gemius[1].txt -> TrackingCookie.Gemius : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@hit.gemius[2].txt -> TrackingCookie.Gemius : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-deltatre.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-findlaw.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-foxmovies.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-foxsports.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-globalgamingleague.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-lgusa.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-psychologies.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-systran.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-telecomitalia.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-telecomitalia.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-wacomtechnology.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-youtube.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-youtube.hitbox[3].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ehg-yvesrocher.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@hitbox[3].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@searchportal.information[2].txt -> TrackingCookie.Information : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@image.masterstats[1].txt -> TrackingCookie.Masterstats : Nettoyé.
:mozilla.77:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@mediaplex[2].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@mediaplex[3].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@stat.onestat[2].txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.17:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@data2.perf.overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@overture[2].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@overture[3].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@perf.overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ads.pointroll[3].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@qksrv[1].txt -> TrackingCookie.Qksrv : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@qksrv[2].txt -> TrackingCookie.Qksrv : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@questionmarket[1].txt -> TrackingCookie.Questionmarket : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@questionmarket[2].txt -> TrackingCookie.Questionmarket : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@france.real[1].txt -> TrackingCookie.Real : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@real[1].txt -> TrackingCookie.Real : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@real[2].txt -> TrackingCookie.Real : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@realguide.real[1].txt -> TrackingCookie.Real : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@realmedia[1].txt -> TrackingCookie.Realmedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@realmedia[2].txt -> TrackingCookie.Realmedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@realmedia[3].txt -> TrackingCookie.Realmedia : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@revenue[2].txt -> TrackingCookie.Revenue : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@revsci[2].txt -> TrackingCookie.Revsci : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@revsci[3].txt -> TrackingCookie.Revsci : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@edge.ru4[2].txt -> TrackingCookie.Ru4 : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.safer-networking[1].txt -> TrackingCookie.Safer-networking : Nettoyé.
:mozilla.92:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.93:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.94:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.95:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.96:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.97:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@bs.serving-sys[3].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@serving-sys[3].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@serving-sys[4].txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.30:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.31:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.33:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@smartadserver[3].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@smartadserver[4].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.101:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Spylog : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@h.starware[1].txt -> TrackingCookie.Starware : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@try.starware[2].txt -> TrackingCookie.Starware : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@statcounter[2].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@statcounter[3].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@statcounter[4].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tacoda[1].txt -> TrackingCookie.Tacoda : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tacoda[3].txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.112:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.113:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tradedoubler[3].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tradedoubler[4].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@trafficmp[1].txt -> TrackingCookie.Trafficmp : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@trafficmp[3].txt -> TrackingCookie.Trafficmp : Nettoyé.
:mozilla.109:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@tribalfusion[3].txt -> TrackingCookie.Tribalfusion : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@valueclick[2].txt -> TrackingCookie.Valueclick : Nettoyé.
:mozilla.35:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.36:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@argenius.solution.weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@weborama[3].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@statse.webtrendslive[3].txt -> TrackingCookie.Webtrendslive : Nettoyé.
:mozilla.104:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.105:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.108:C:\Documents and Settings\Pandore\Application Data\Mozilla\Firefox\Profiles\gk0bvy6j.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@ad.yieldmanager[4].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@zedo[1].txt -> TrackingCookie.Zedo : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@zedo[2].txt -> TrackingCookie.Zedo : Nettoyé.
C:\Documents and Settings\Pandore\Cookies\pandore@zedo[3].txt -> TrackingCookie.Zedo : Nettoyé.
C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP467\A0120637.sys -> Trojan.Srizbi.j : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

Pandorea · Answer

Et heu le hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:47:15, on 25/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\gqunlaws.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

jlpjlp · Answer

oui c'est pas finit!



Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\gqunlaws.dll",b
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


__________________



Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs ! 

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic 

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider. 
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport. 
__________________


télécharge OTMoveIt 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.  Ou sur  https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 

C:\WINDOWS\system32\gqunlaws.dll
c:\smaq.exe

clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

______________________


Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

jlpjlp · Answer

passe a la suite on verra apres

Pandorea · Answer

Voiloute :

Search Navipromo version 3.5.1 commencé le 25/03/2008 à 11:44:00,09

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Pandore" 

Mise à jour le 23.03.2008 à 22h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : FAT32

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***




*** Recherche dossiers dans "C:\Documents and Settings\Pandore\applic~1" *** 



*** Recherche dossiers dans "C:\Documents and Settings\Pandore\locals~1\applic~1" *** 



*** Recherche dossiers dans "C:\Documents and Settings\Pandore\menud+~1\progra~1" *** 


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUD?~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans "C:\Documents and Settings\Pandore\locals~1\applic~1" * 



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans C:\WINDOWS\system32 :


* Dans "C:\Documents and Settings\Pandore\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

C:\WINDOWS\system32\accdd.ini2 trouvé ! infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 25/03/2008 à 11:46:04,29 ***

jlpjlp · Answer

ok tu as une infection vundo qui reste!

_____



scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.

________________
puis :


virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

__________________



 colle le rapport d'un scan en ligne 
avec un des suivants:  (désativer avast le temps du scan)


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

Pandorea · Answer

Hum, vundofix n'a rien trouvé ... Je continue quand même?

jlpjlp · Answer

oui tu continue

Pandorea · Answer

Le rapport de virtumonde:

[03/25/2008, 15:43:32] - VirtumundoBeGone v1.5 ( "C:\Downloads\VirtumundoBeGone.exe" )
[03/25/2008, 15:43:43] - Detected System Information:
[03/25/2008, 15:43:43] -  Windows Version: 5.1.2600, Service Pack 2
[03/25/2008, 15:43:43] -  Current Username: Pandore (Admin)
[03/25/2008, 15:43:43] -  Windows is in NORMAL mode.
[03/25/2008, 15:43:43] - Searching for Browser Helper Objects:
[03/25/2008, 15:43:43] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/25/2008, 15:43:43] -  BHO 2: {11241072-58BB-40CE-9171-0B2BDFB22E97} ()
[03/25/2008, 15:43:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:43] -  Checking for HKLM\...\Winlogon\Notify\ljjkifc
[03/25/2008, 15:43:43] -  Found: HKLM\...\Winlogon\Notify\ljjkifc - This is probably Virtumundo.
[03/25/2008, 15:43:43] -  Assigning {11241072-58BB-40CE-9171-0B2BDFB22E97} MSEvents Object
[03/25/2008, 15:43:43] - BHO list has been changed! Starting over...
[03/25/2008, 15:43:44] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/25/2008, 15:43:44] -  BHO 2: {11241072-58BB-40CE-9171-0B2BDFB22E97} (MSEvents Object)
[03/25/2008, 15:43:44] - ALERT: Found MSEvents Object!
[03/25/2008, 15:43:44] -  BHO 3: {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} ()
[03/25/2008, 15:43:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:44] -  No filename found. Continuing.
[03/25/2008, 15:43:44] -  BHO 4: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[03/25/2008, 15:43:44] -  BHO 5: {3E43E815-A480-4200-A9A8-7C8B38694681} ()
[03/25/2008, 15:43:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:44] -  Checking for HKLM\...\Winlogon\Notify\ddcca
[03/25/2008, 15:43:44] -  Key not found: HKLM\...\Winlogon\Notify\ddcca, continuing.
[03/25/2008, 15:43:44] -  BHO 6: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/25/2008, 15:43:44] -  BHO 7: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[03/25/2008, 15:43:44] -  BHO 8: {7bcb6b29-4290-4ac7-9c61-a6c51f87bc36} ()
[03/25/2008, 15:43:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:44] -  Checking for HKLM\...\Winlogon\Notify\gfqyeckg
[03/25/2008, 15:43:44] -  Key not found: HKLM\...\Winlogon\Notify\gfqyeckg, continuing.
[03/25/2008, 15:43:44] -  BHO 9: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/25/2008, 15:43:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:44] -  No filename found. Continuing.
[03/25/2008, 15:43:44] -  BHO 10: {A97E1B61-3B4A-4A08-A337-76DE915B243B} ()
[03/25/2008, 15:43:44] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:44] -  No filename found. Continuing.
[03/25/2008, 15:43:44] -  BHO 11: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[03/25/2008, 15:43:44] -  BHO 12: {C03FD59D-9104-44B7-929A-9EAA0BA05211} (e404mgr Class)
[03/25/2008, 15:43:44] -  BHO 13: {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} (QuickTalk 2.1)
[03/25/2008, 15:43:44] - Finished Searching Browser Helper Objects
[03/25/2008, 15:43:44] - *** Detected MSEvents Object
[03/25/2008, 15:43:44] - Trying to remove MSEvents Object...
[03/25/2008, 15:43:45] -    Terminating Process: IEXPLORE.EXE
[03/25/2008, 15:43:49] -    Terminating Process: RUNDLL32.EXE
[03/25/2008, 15:43:50] -    Disabling Automatic Shell Restart
[03/25/2008, 15:43:50] -    Terminating Process: EXPLORER.EXE
[03/25/2008, 15:43:51] -    Suspending the NT Session Manager System Service
[03/25/2008, 15:43:52] -    Terminating Windows NT Logon/Logoff Manager
[03/25/2008, 15:43:53] -    Re-enabling Automatic Shell Restart
[03/25/2008, 15:43:53] -   File to disable: C:\WINDOWS\system32\ljjkifc.dll
[03/25/2008, 15:43:53] -  Renaming C:\WINDOWS\system32\ljjkifc.dll -> C:\WINDOWS\system32\ljjkifc.dll.vir
[03/25/2008, 15:43:56] -  File successfully renamed!
[03/25/2008, 15:43:56] -   Removing HKLM\...\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}
[03/25/2008, 15:43:57] -   Removing HKCR\CLSID\{11241072-58BB-40CE-9171-0B2BDFB22E97}
[03/25/2008, 15:43:58] -   Adding Kill Bit for ActiveX for GUID: {11241072-58BB-40CE-9171-0B2BDFB22E97}
[03/25/2008, 15:43:58] -   Deleting ATLEvents/MSEvents Registry entries
[03/25/2008, 15:43:58] -   Removing HKLM\...\Winlogon\Notify\ljjkifc
[03/25/2008, 15:43:59] - Searching for Browser Helper Objects:
[03/25/2008, 15:43:59] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/25/2008, 15:43:59] -  BHO 2: {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} ()
[03/25/2008, 15:43:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:59] -  No filename found. Continuing.
[03/25/2008, 15:43:59] -  BHO 3: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[03/25/2008, 15:43:59] -  BHO 4: {3E43E815-A480-4200-A9A8-7C8B38694681} ()
[03/25/2008, 15:43:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:59] -  Checking for HKLM\...\Winlogon\Notify\ddcca
[03/25/2008, 15:43:59] -  Key not found: HKLM\...\Winlogon\Notify\ddcca, continuing.
[03/25/2008, 15:43:59] -  BHO 5: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/25/2008, 15:43:59] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[03/25/2008, 15:43:59] -  BHO 7: {7bcb6b29-4290-4ac7-9c61-a6c51f87bc36} ()
[03/25/2008, 15:43:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:59] -  Checking for HKLM\...\Winlogon\Notify\gfqyeckg
[03/25/2008, 15:43:59] -  Key not found: HKLM\...\Winlogon\Notify\gfqyeckg, continuing.
[03/25/2008, 15:43:59] -  BHO 8: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/25/2008, 15:43:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:59] -  No filename found. Continuing.
[03/25/2008, 15:43:59] -  BHO 9: {A97E1B61-3B4A-4A08-A337-76DE915B243B} ()
[03/25/2008, 15:43:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:43:59] -  No filename found. Continuing.
[03/25/2008, 15:43:59] -  BHO 10: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[03/25/2008, 15:43:59] -  BHO 11: {C03FD59D-9104-44B7-929A-9EAA0BA05211} (e404mgr Class)
[03/25/2008, 15:43:59] -  BHO 12: {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} (QuickTalk 2.1)
[03/25/2008, 15:43:59] - Finished Searching Browser Helper Objects
[03/25/2008, 15:43:59] - Finishing up...
[03/25/2008, 15:43:59] - A restart is needed.
[03/25/2008, 15:44:11] - Attempting to Restart via STOP error (Blue Screen!)

[03/25/2008, 15:56:06] - VirtumundoBeGone v1.5 ( "C:\Downloads\VirtumundoBeGone.exe" )
[03/25/2008, 15:56:15] - Detected System Information:
[03/25/2008, 15:56:15] -  Windows Version: 5.1.2600, Service Pack 2
[03/25/2008, 15:56:15] -  Current Username: Pandore (Admin)
[03/25/2008, 15:56:15] -  Windows is in NORMAL mode.
[03/25/2008, 15:56:15] - Searching for Browser Helper Objects:
[03/25/2008, 15:56:15] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/25/2008, 15:56:15] -  BHO 2: {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} ()
[03/25/2008, 15:56:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:56:15] -  No filename found. Continuing.
[03/25/2008, 15:56:15] -  BHO 3: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[03/25/2008, 15:56:15] -  BHO 4: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/25/2008, 15:56:15] -  BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[03/25/2008, 15:56:15] -  BHO 6: {7bcb6b29-4290-4ac7-9c61-a6c51f87bc36} ()
[03/25/2008, 15:56:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:56:15] -  Checking for HKLM\...\Winlogon\Notify\gfqyeckg
[03/25/2008, 15:56:15] -  Key not found: HKLM\...\Winlogon\Notify\gfqyeckg, continuing.
[03/25/2008, 15:56:15] -  BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/25/2008, 15:56:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:56:15] -  No filename found. Continuing.
[03/25/2008, 15:56:15] -  BHO 8: {A97E1B61-3B4A-4A08-A337-76DE915B243B} ()
[03/25/2008, 15:56:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:56:15] -  No filename found. Continuing.
[03/25/2008, 15:56:15] -  BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[03/25/2008, 15:56:15] -  BHO 10: {C03FD59D-9104-44B7-929A-9EAA0BA05211} (e404mgr Class)
[03/25/2008, 15:56:15] -  BHO 11: {C956BC97-58BB-47DC-B43F-05AD17777F13} ()
[03/25/2008, 15:56:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/25/2008, 15:56:15] -  Checking for HKLM\...\Winlogon\Notify\ddcca
[03/25/2008, 15:56:15] -  Key not found: HKLM\...\Winlogon\Notify\ddcca, continuing.
[03/25/2008, 15:56:15] -  BHO 12: {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} (QuickTalk 2.1)
[03/25/2008, 15:56:15] - Finished Searching Browser Helper Objects
[03/25/2008, 15:56:15] - Finishing up...
[03/25/2008, 15:56:15] - Nothing found! Exiting...

jlpjlp · Answer

parfait plus que le scan en ligne

Pandorea · Answer

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-03-25 16:05:01
PROTECTIONS: 1
MALWARE: 51
SUSPECTS: 4
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
avast! antivirus 4.7.1098 [VPS 080324-0]     4.7.1098                      No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00029426  adware/sbsoft                      Adware              No        0         Yes            No           HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E1230F8-EA50-42A9-983C-D22ABC2EED3B}
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@doubleclick[1].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@atdmt[2].txt
00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@linksynergy[1].txt
00147824  Cookie/Clickbank                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@clickbank[1].txt
00156968  Cookie/ads.tripod.lycos.com        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@ads.tripod.lycos[2].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@com[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@xiti[1].txt
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@fe.lea.lycos[1].txt
00167726  Cookie/Tickle                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@tickle[2].txt
00167726  Cookie/Tickle                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@tickle[1].txt
00167738  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@fe.lea.lycos[2].txt
00167744  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@gostats[2].txt
00167747  Cookie/Azjmp                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@azjmp[1].txt
00167747  Cookie/Azjmp                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@azjmp[3].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@toplist[2].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@statcounter[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@ad.yieldmanager[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@apmebf[3].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@apmebf[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@apmebf[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@bs.serving-sys[2].txt
00168095  Cookie/888                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@888[3].txt
00168095  Cookie/888                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@888[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@weborama[1].txt
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@advertising[2].txt
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@media.adrevolver[1].txt
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@media.adrevolver[6].txt
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@media.adrevolver[2].txt
00170087  Cookie/Hbmediapro                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@adopt.hbmediapro[2].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@overture[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@zedo[1].txt
00172449  Cookie/MetriWeb                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@metriweb[1].txt
00172483  Cookie/888                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@int.sitestat[1].txt
00172484  Cookie/Cassava                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@int.sitestat[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@bluestreak[1].txt
00187949  Cookie/adstat                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@adstat.4u[1].txt
00187950  Cookie/bravenetA                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@bravenet[1].txt
00187950  Cookie/bravenetA                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@bravenet[2].txt
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@adultfriendfinder[1].txt
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@adultfriendfinder[2].txt
00207338  Cookie/Target                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@target[1].txt
00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@atwola[2].txt
00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@atwola[1].txt
00262024  Cookie/ErrorSafe                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@www.errorsafe[2].txt
00262024  Cookie/ErrorSafe                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@www.errorsafe[1].txt
00262025  Cookie/ErrorSafe                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@errorsafe[3].txt
00262025  Cookie/ErrorSafe                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@errorsafe[2].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@smartadserver[1].txt
00286732  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@www3.addfreestats[1].txt
00286734  Cookie/Adserver                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@adserver.filefront[1].txt
00286736  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@www6.addfreestats[1].txt
00286738  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@www1.addfreestats[1].txt
00296583  Cookie/DriveCleaner                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@stats.drivecleaner[2].txt
00296584  Cookie/DriveCleaner                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@drivecleaner[1].txt
00296584  Cookie/DriveCleaner                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@drivecleaner[3].txt
00320978  Cookie/Winantivirus                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@winantivirus[1].txt
00329272  Cookie/Systemdoctor                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@www.systemdoctor[1].txt
00351416  Cookie/Systemdoctor                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@systemdoctor[1].txt
01606636  Cookie/Adserver                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@adserver.easyad[2].txt
02887528  Cookie/AdvancedCleaner             TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@advancedcleaner[2].txt
02893893  Trj/Bancos.RQ                      Virus/Trojan        No        0         No             No           C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\3LLR1AQF\ComboFix[1].exe[327882R2FWJFW\pv.cfexe]
02897073  Cookie/Revenue                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Pandore\Cookies\pandore@adsrevenue[1].txt
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
C:\WINDOWS\SYSTEM32\BLUETOOTHAUTHORIZATIONAGENT.EXE
C:\WINDOWS\SYSTEM32\IESEARCH.DLL
C:\WINDOWS\SYSTEM32\WLCTRL32.DLL
C:\D.EXE
;===================================================================================================================================================================================



Voila

jlpjlp · Answer

analyse ces fichiers sur virus total et si inféctés tu les colle dans la citation otmovit:  https://www.virustotal.com/gui/
( a mettre en plus du fichier déjà mis)

C:\WINDOWS\SYSTEM32\BLUETOOTHAUTHORIZATIONAGENT.EXE
C:\WINDOWS\SYSTEM32\IESEARCH.DLL
C:\WINDOWS\SYSTEM32\WLCTRL32.DLL
C:\D.EXE

______________________


télécharge OTMoveIt 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.  Ou sur  https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E1230F8-EA50-42A9-­983C-D22ABC2EED3B}



clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

_________________

recolle un rapport hiajkchtis et ids tes soucis

jlpjlp · Answer

colle moi les rapports je te dirai

Pandorea · Answer

C:\WINDOWS\SYSTEM32\BLUETOOTHAUTHORIZATIONAGENT.EXE 


Fichier 50003.exe reçu le 2008.03.24 04:06:28 (CET)
Situation actuelle: terminé 
Résultat: 15/31 (48.39%)
 Formaté 
Impression des résultats  
Antivirus	Version	Dernière mise à jour	Résultat
AhnLab-V3	-	-	-
AntiVir	-	-	TR/Peed.A.157
Authentium	-	-	Possibly a new variant of W32/STZ_like!Generic
Avast	-	-	-
AVG	-	-	SHeur.AZGP
BitDefender	-	-	Trojan.Peed.Gen
CAT-QuickHeal	-	-	-
ClamAV	-	-	-
DrWeb	-	-	Trojan.Packed.142
eTrust-Vet	-	-	-
Ewido	-	-	-
FileAdvisor	-	-	-
Fortinet	-	-	-
F-Prot	-	-	W32/STZ_like!Generic
F-Secure	-	-	not-virus:Hoax.Win32.Renos.bgf
Ikarus	-	-	Trojan.Peed
Kaspersky	-	-	not-virus:Hoax.Win32.Renos.bgf
McAfee	-	-	New Malware.fa
Microsoft	-	-	Trojan:Win32/Tibs.FZ
NOD32v2	-	-	-
Norman	-	-	-
Panda	-	-	Suspicious file
Prevx1	-	-	Generic File Infector
Rising	-	-	-
Sophos	-	-	Mal/HckPk-A
Sunbelt	-	-	-
Symantec	-	-	-
TheHacker	-	-	-
VBA32	-	-	-
VirusBuster	-	-	-
Webwasher-Gateway	-	-	Trojan.Peed.A.157
Information additionnelle
MD5: 1b06a7cf662faf4ff8f900ebef8095ad
SHA1: 84540bc4b744bae0b9fa75e06295475675aba96b
SHA256: 42762f8ecc539488849a0201a6ff44665129d0e46c2bee9682b6317e592fd4ef
SHA512: 6dd8960b4ed3df09ee49568f24f2e3eed6c8cf8f11c5e41e322922bf3d608b93 7a89fb47e9bad7a7aa9a65b05edae24c43bb4ae9629a60516492545f868b7446



C:\WINDOWS\SYSTEM32\IESEARCH.DLL 


Fichier msram.dll.vir reçu le 2008.03.24 04:08:03 (CET)
Situation actuelle: terminé 
Résultat: 14/32 (43.75%)
 Formaté 
Impression des résultats  
Antivirus	Version	Dernière mise à jour	Résultat
AhnLab-V3	-	-	-
AntiVir	-	-	ADSPY/Flycodec.A.2
Authentium	-	-	-
Avast	-	-	-
AVG	-	-	-
BitDefender	-	-	-
CAT-QuickHeal	-	-	-
ClamAV	-	-	PUA.Packed.UPack
DrWeb	-	-	-
eSafe	-	-	suspicious Trojan/Worm
eTrust-Vet	-	-	-
Ewido	-	-	-
FileAdvisor	-	-	-
Fortinet	-	-	Dloader.E!tr
F-Prot	-	-	W32/Heuristic-162!Eldorado
F-Secure	-	-	-
Ikarus	-	-	Trojan-Spy.Win32.Banbra.hb
Kaspersky	-	-	-
McAfee	-	-	Generic Downloader.e
Microsoft	-	-	Trojan:Win32/Emurbo.A
NOD32v2	-	-	-
Norman	-	-	W32/Suspicious_U.gen
Panda	-	-	-
Prevx1	-	-	TROJAN.CE
Rising	-	-	-
Sophos	-	-	Mal/EncPk-BW
Sunbelt	-	-	-
Symantec	-	-	-
TheHacker	-	-	W32/Behav-Heuristic-060
VBA32	-	-	-
VirusBuster	-	-	Packed/Upack
Webwasher-Gateway	-	-	Ad-Spyware.Flycodec.A.2
Information additionnelle
MD5: a031896bcda3b4b5e79b9319200c667c
SHA1: f7b7d38e0842b79658fefde1ea24581475836b72
SHA256: 27fd4565a190f086607aac0a32721601547c202254e1d8844c7d016514770db0
SHA512: d59a983008faa5cac21006a8898da5dff6ab24f671fa629e54d09671d8611795 d4b9581d47a590074a1213a7ce07a40be2db8c8b2830ff82e882e0ce03d1dcbb



C:\WINDOWS\SYSTEM32\WLCTRL32.DLL 

Fichier WLCtrl32.dll reçu le 2008.03.25 15:57:19 (CET)
Situation actuelle: terminé 
Résultat: 16/32 (50.00%)
 Formaté 
Impression des résultats  
Antivirus	Version	Dernière mise à jour	Résultat
AhnLab-V3	2008.3.26.0	2008.03.25	-
AntiVir	7.6.0.75	2008.03.25	TR/Dldr.Agent.luo.19
Authentium	4.93.8	2008.03.25	-
Avast	4.7.1098.0	2008.03.24	-
AVG	7.5.0.516	2008.03.25	Downloader.Agent.ADQR
BitDefender	7.2	2008.03.25	Trojan.Dropper.Cutwail.B
CAT-QuickHeal	9.50	2008.03.24	TrojanDownloader.Agent.luo
ClamAV	0.92.1	2008.03.25	-
DrWeb	4.44.0.09170	2008.03.25	Trojan.DownLoader.50037
eSafe	7.0.15.0	2008.03.18	-
eTrust-Vet	31.3.5641	2008.03.25	-
Ewido	4.0	2008.03.25	-
FileAdvisor	1	2008.03.25	-
Fortinet	3.14.0.0	2008.03.25	W32/Agent.LUO!tr.dldr
F-Prot	4.4.2.54	2008.03.24	-
F-Secure	6.70.13260.0	2008.03.25	Trojan-Downloader.Win32.Agent.luo
Ikarus	T3.1.1.20	2008.03.25	Trojan-Downloader.Win32.Agent.luo
Kaspersky	7.0.0.125	2008.03.25	Trojan-Downloader.Win32.Agent.luo
McAfee	5258	2008.03.24	-
Microsoft	1.3301	2008.03.25	TrojanDropper:Win32/Cutwail.Y
NOD32v2	2971	2008.03.25	-
Norman	5.80.02	2008.03.25	W32/Agent.dam
Panda	9.0.0.4	2008.03.25	-
Prevx1	V2	2008.03.25	TROJAN.PANDEX.B
Rising	20.37.02.00	2008.03.24	-
Sophos	4.27.0	2008.03.25	Mal/Generic-A
Sunbelt	3.0.978.0	2008.03.18	-
Symantec	10	2008.03.25	Trojan.Pandex
TheHacker	6.2.92.253	2008.03.25	-
VBA32	3.12.6.3	2008.03.25	-
VirusBuster	4.3.26:9	2008.03.25	Trojan.DR.Pandex.Gen.4
Webwasher-Gateway	6.6.2	2008.03.25	Trojan.Dldr.Agent.luo.19
Information additionnelle
File size: 11776 bytes
MD5: e844168bcaff9bbe55ce7dfdbcfbd551
SHA1: 6873e246c0edf9dcd40f77c6832bd697017c1ce7
PEiD: -
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=060C23B600F1A4742EA80055DD2C47008BBECA7A


C:\D.EXE

Fichier VT08031910906-000001_b9a237a76197 reçu le 2008.03.22 18:39:09 (CET)
Situation actuelle: terminé 
Résultat: 17/32 (53.12%)
 Formaté 
Impression des résultats  
Antivirus	Version	Dernière mise à jour	Résultat
AhnLab-V3	-	-	-
AntiVir	-	-	TR/Dldr.Agent.lnh.2
Authentium	-	-	-
Avast	-	-	-
AVG	-	-	Downloader.Agent.ADNW
BitDefender	-	-	-
CAT-QuickHeal	-	-	Win32.Backdoor.PoisonIvy.ay2
ClamAV	-	-	PUA.Packed.MEW-1
DrWeb	-	-	-
eSafe	-	-	suspicious Trojan/Worm
eTrust-Vet	-	-	-
Ewido	-	-	-
FileAdvisor	-	-	-
Fortinet	-	-	-
F-Prot	-	-	-
F-Secure	-	-	Trojan-Downloader.Win32.Agent.lnh
Ikarus	-	-	Trojan-Proxy.Win32.Small.DT
Kaspersky	-	-	Trojan-Downloader.Win32.Agent.lnh
McAfee	-	-	-
Microsoft	-	-	Trojan:Win32/Emurbo.A
NOD32v2	-	-	-
Norman	-	-	Suspicious_M.gen
Panda	-	-	Suspicious file
Prevx1	-	-	Generic.Malware
Rising	-	-	-
Sophos	-	-	Mal/EncPk-BA
Sunbelt	-	-	VIPRE.Suspicious
Symantec	-	-	-
TheHacker	-	-	W32/Behav-Heuristic-066
VBA32	-	-	-
VirusBuster	-	-	Packed/MEW
Webwasher-Gateway	-	-	Trojan.Dldr.Agent.lnh.2
Information additionnelle
MD5: b9a237a761976ab3ead774a0f7dd1aed
SHA1: 4637c28c9a6d58e3a57339e11279f7533bb4ed6f
SHA256: 7cde9b9ee484520242c849e236dcc94638b1f3ce42a83e240f563a074234cc6f
SHA512: ca92774103c29ea48b80b574dd76597988910ef1d699c3a4bea251cb71217cfe dbb7fba63ab865e3aa41f1dc67f8b444167d691b004976781dd7760e0dc1a20b

jlpjlp · Answer

ok tout est infécté tu les mets dans la citation otmovit

jlpjlp · Answer

vire ce qui est dans moved files en allant dans psote de travail puis c puis otmovit

___________

recolle un rapport hiajkchtis et ids tes soucis

Pandorea · Answer

:) Ok et je mets un peu ou j'en suis avec le pc:
Alors avast me signale depuis hier un trojan qu'il n'arrive pas à maintenir en quarantaine ou supprimer (Win32:TratBHO [Trj])
L'odinateur est plutot lent au démarrage, mais bon rien d'horrible, et je ne suis plus détournée quand
je surfe (mais j'ai toujours de fenetres qui s'ouvrent sans cesse).

X) Qu'est-ce q tu voulais dire par "ids" tes soucis?

jlpjlp · Answer

ok le rapport est bon


encore des soucis?????????






















pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français   ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/-    si tea timer non active de spybot: 
 WINDOWS    DEFENDER ou  SPYWARE TERMINATOR

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) 

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

 https://forum.pcastuces.com/sujet.asp?f=25&s=35606 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus  touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

jlpjlp · Answer

quel fichiers sont inféctés selon avast?

Pandorea · Answer

Bonjour! Merci pour toutes les infos! :)

Heu il y a : C:\WINDOWS\system32\ddcca.dll et un fichier temp mais je n'arrive pas a retrouver lequel.

jlpjlp · Answer

parfait tu mets les fichiers inféctés dans otmovit pour les virer






télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\system32\ddcca.dll



clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

Pandorea · Answer

C'est bon c'est supprimé :)
Je n'ai plus de problèmes du coup! MERCI BEAUCOUP!!!!! ^3^!

jlpjlp · Answer

parfait

bonne suite si soucis tu dis

Pandorea · Answer

Et également vundo dans C:WINDOWS\system32\ixagtcug.dll

jlpjlp · Answer

télécharge OTMoveIt 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.  Ou sur  https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 

C:WINDOWS\system32\ixagtcug.dll


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

____________


refais un combofix et colle le rapport

____________

colle un rapport antivir

Pandorea · Answer

Et de un :
File/Folder C:WINDOWS\system32\ixagtcug.dll not found.
 
OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03312008_121015

Pandorea · Answer

Hey! Je n'arrive toujours pas à faire marcher combofix : c'est juste un écran bleu et vide qui s'affiche... Que farem?

jlpjlp · Answer

alors 

colle un rapport antivir  et dis tes soucis actuels

Pandorea · Answer

Donc, le rapport :) : AntiVir PersonalEdition Classic Report file date: lundi 31 mars 2008 17:22 Scanning for 1172298 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: BOITEDEPANDORE Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:30 AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:52 LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:48 LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:22 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:16 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 15:16:20 ANTIVIR2.VDF : 7.0.3.85 434176 Bytes 27/03/2008 15:16:20 ANTIVIR3.VDF : 7.0.3.97 56320 Bytes 31/03/2008 15:15:08 AVEWIN32.DLL : 7.6.0.78 3408384 Bytes 30/03/2008 15:16:22 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:28 AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:18 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 30/03/2008 15:16:22 AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:08 AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:34 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:20 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:44 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:14 RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:38 SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:22 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: lundi 31 mars 2008 17:22 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'CIDAEMON.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'wscntfy.exe' - '1' Module(s) have been scanned Scan process 'bittorrent.exe' - '1' Module(s) have been scanned Scan process 'BTDNA.EXE' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned Scan process 'MsnMsgr.Exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'HPGS2WNF.EXE' - '1' Module(s) have been scanned Scan process 'QTTASK.EXE' - '1' Module(s) have been scanned Scan process 'HPGS2WND.EXE' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'ADMTRAY.EXE' - '1' Module(s) have been scanned Scan process 'ElkCtrl.exe' - '1' Module(s) have been scanned Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned Scan process 'QtZgAcer.EXE' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned Scan process 'eDSloader.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'PCMService.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'Monitor.exe' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'ALG.EXE' - '1' Module(s) have been scanned Scan process 'CLSched.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'CLMLService.exe' - '1' Module(s) have been scanned Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned Scan process 'CISVC.EXE' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'admServ.exe' - '1' Module(s) have been scanned Scan process 'GUARD.EXE' - '0' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'SCHED.EXE' - '1' Module(s) have been scanned Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'LSASS.EXE' - '1' Module(s) have been scanned Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned Scan process 'SMSS.EXE' - '1' Module(s) have been scanned 69 processes with 69 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. C:\WINDOWS\system32\vgixgvqy.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\vgixgvqy.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen The registry was scanned ( '44' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\hiberfil.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\ddcca.dll [DETECTION] Is the Trojan horse TR/Vundo.AG [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\vpiipfpg.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '485a068f.qua'! C:\WINDOWS\system32\ccyedyph.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\ccmnkwgq.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '485e068c.qua'! C:\WINDOWS\system32 qviehge.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '4867069d.qua'! C:\WINDOWS\system32\wcmabgea.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '485e0691.qua'! C:\WINDOWS\system32\gfqyeckg.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48620697.qua'! C:\WINDOWS\system32\xcrryknt.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\vgixgvqy.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\Wju57.sys [WARNING] The file could not be opened! C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\4850affb.qua [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BG.7 [INFO] The file was deleted! C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\H8MCXKIO\ptch[1] [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was deleted! C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\0I7KTNO4\hctp[1] [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was deleted! C:\Documents and Settings\Pandore\Application Data\Grisoft\AVG Antispyware 7.5\quarantine\fil17242F99.dat [0] Archive type: GZ --> fil17242F99 [DETECTION] Is the Trojan horse TR/Agent.aox [INFO] The file was deleted! C:\Program Files\Panda Security\TotalScan\pskavs.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [INFO] The file was deleted! C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll [DETECTION] Is the Trojan horse TR/Agent.bux.1 [INFO] The file was deleted! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP467\A0120638.exe [DETECTION] Contains detection pattern of the dropper DR/Virtumonde.kto [INFO] The file was moved to '48224d5d.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP467\A0120639.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224d60.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP468\A0120646.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224d63.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP468\A0120654.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224d65.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP468\A0120663.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224d67.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP468\A0120710.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224d69.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP468\A0120721.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224d6b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP469\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48364d85.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP470\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48364d87.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP471\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48364d89.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP472\A0121710.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224d75.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP472\A0121719.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224d77.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP472\A0122710.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224d79.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP472\A0122722.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224d7b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP472\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48364d93.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP473\A0123710.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e56.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP473\A0123721.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e59.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP473\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48364e73.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0124710.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e5f.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0124723.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e61.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125710.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e62.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125722.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e65.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125754.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e67.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125758.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e69.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125837.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e6b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125846.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e6d.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125859.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e6f.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125874.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e70.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125894.exe [DETECTION] Is the Trojan horse TR/Dldr.JJPT [INFO] The file was moved to '48224e72.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0125895.exe [DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen [INFO] The file was moved to '48224e74.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0126859.dll [DETECTION] Is the Trojan horse TR/Downloader.Gen [INFO] The file was moved to '48224e76.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0126860.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e78.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0126868.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e7a.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0126894.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e7b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0126903.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224e7d.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0126928.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224e88.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\A0126941.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '49951441.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP474\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48364e9f.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP475\A0127263.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48224eb2.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP475\A0127289.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.6 [INFO] The file was moved to '48224eb3.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP475\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '48364ecb.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0128286.sys [DETECTION] Is the Trojan horse TR/Dldr.Agent.lxa.23 [INFO] The file was moved to '48224eb6.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0128315.exe [DETECTION] Contains detection pattern of the Phish-File/Email PHISH/FraudTool.AntiVirPro.K [INFO] The file was moved to '48224eb8.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0128317.dll [DETECTION] Contains detection pattern of the Phish-File/Email PHISH/FraudTool.AntiVirPro.K.1 [INFO] The file was moved to '48224eb9.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0128327.dll [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BK.12 [INFO] The file was moved to '48224eba.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0128335.sys [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BL [INFO] The file was moved to '49951473.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0129327.dll [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BL [INFO] The file was moved to '48224ebb.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0129344.sys [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BL [INFO] The file was moved to '48224ebc.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0129362.exe [DETECTION] Is the Trojan horse TR/Dldr.Agent.lnh.2 [INFO] The file was moved to '49951475.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0129363.exe [DETECTION] Is the Trojan horse TR/Peed.A.157 [INFO] The file was moved to '48224ebd.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0129365.dll [DETECTION] Is the Trojan horse TR/Dldr.Agent.luo.19 [INFO] The file was moved to '49951476.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0129388.dll [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BL [INFO] The file was moved to '48224ebe.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP476\A0129396.sys [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BL [INFO] The file was moved to '49951477.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP477\A0129449.dll [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BL [INFO] The file was moved to '48224ec0.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP477\A0129458.sys [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224ec1.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP477\A0130449.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '4995140a.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP477\A0130461.sys [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224ec2.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP477\A0130464.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '4995140b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP477\snapshot\MFEX-1.DAT [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48364ed9.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP478\A0131382.exe [DETECTION] Contains detection pattern of the dropper DR/Tool.Reboot.F.71 [INFO] The file was moved to '48224ecd.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP480\A0131510.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224ed3.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP480\A0131511.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '4995141c.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP480\A0131512.exe [DETECTION] Is the Trojan horse TR/Dldr.Mutant.BG.7 [INFO] The file was moved to '48224ed4.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP480\A0131513.exe [DETECTION] Is the Trojan horse TR/Dldr.Adload.XH [INFO] The file was moved to '4995141d.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0133376.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48224ee9.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0133377.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '49951422.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0134376.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224eeb.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0135376.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224eea.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0136376.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '49951423.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0137376.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '49951424.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138376.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '48224eed.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138410.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '49951426.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138725.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48224ef1.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138726.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '4995143a.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138727.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48224ef2.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138728.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '4995143b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138729.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48224ef4.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138734.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [INFO] The file was moved to '48224ef3.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP481\A0138735.dll [DETECTION] Is the Trojan horse TR/Agent.bux.1 [INFO] The file was moved to '4995143c.qua'! C:\_OTMoveIt\MovedFiles\03312008_125604\WINDOWS\system32\awvgoaov.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48674f5a.qua'! Begin scan in 'D:\' End of the scan: lundi 31 mars 2008 22:54 Used time: 5:32:06 min The scan has been done completely. 6831 Scanning directories 382263 Files were scanned 96 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 6 files were deleted 0 files were repaired 85 files were moved to quarantine 0 files were renamed 4 Files cannot be scanned 382167 Files not concerned 6979 Archives were scanned 9 Warnings 1 Notes

jlpjlp · Answer

télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\vpiipfpg.dll
C:\WINDOWS\system32\ccyedyph.dll
C:\WINDOWS\system32\ccmnkwgq.dll
C:\WINDOWS\system32	qviehge.dll
C:\WINDOWS\system32\wcmabgea.dll
C:\WINDOWS\system32\gfqyeckg.dll
C:\WINDOWS\system32\xcrryknt.dll
C:\WINDOWS\system32\vgixgvqy.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\H8MCXKIO\ptch[1]
C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\0I7KTNO4\hctp[1]
C:\Program Files\Panda Security\TotalScan\pskavs.dll
C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll




clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

_________________ 


utilise  pour supprimer tes traces 

CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo 

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
----------------------- 

vire ce qui est dans moved files en allant dans psote de travail puis C puis otmovit
____________
vire ce qui est en quarantaine dans avg et antivir

____________


si tout c'est bien passé désactive la restauration système pour purger les virus qui seraient dedans 
puis redemarre ton ordi
puis réactive là :  https://www.informatruc.com

______________
installe:
SPYWAREBLASTER pour immuniser le système contre vundo que tu as notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/28872.html
________________

recolle un rapport antivir et hijackthis et dis tes soucis actuels

Pandorea · Answer

Rapport OTMoveit: DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcca.dll C:\WINDOWS\system32\ddcca.dll NOT unregistered. File move failed. C:\WINDOWS\system32\ddcca.dll scheduled to be moved on reboot. File/Folder C:\WINDOWS\system32\vpiipfpg.dll not found. File/Folder C:\WINDOWS\system32\ccyedyph.dll not found. File/Folder C:\WINDOWS\system32\ccmnkwgq.dll not found. File/Folder C:\WINDOWS\system32 qviehge.dll not found. File/Folder C:\WINDOWS\system32\wcmabgea.dll not found. File/Folder C:\WINDOWS\system32\gfqyeckg.dll not found. File/Folder C:\WINDOWS\system32\xcrryknt.dll not found. File/Folder C:\WINDOWS\system32\vgixgvqy.dll not found. File/Folder C:\WINDOWS\system32\drivers\Wju57.sys not found. File/Folder C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\H8MCXKIO\ptch[1] not found. File/Folder C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\0I7KTNO4\hctp[1] not found. File/Folder C:\Program Files\Panda Security\TotalScan\pskavs.dll not found. File/Folder C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll not found. [Custom Input] < C:\WINDOWS\system32\ddcca.dll > DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcca.dll C:\WINDOWS\system32\ddcca.dll NOT unregistered. File move failed. C:\WINDOWS\system32\ddcca.dll scheduled to be moved on reboot. < C:\WINDOWS\system32\vpiipfpg.dll > File/Folder C:\WINDOWS\system32\vpiipfpg.dll not found. < C:\WINDOWS\system32\ccyedyph.dll > File/Folder C:\WINDOWS\system32\ccyedyph.dll not found. < C:\WINDOWS\system32\ccmnkwgq.dll > File/Folder C:\WINDOWS\system32\ccmnkwgq.dll not found. < C:\WINDOWS\system32 qviehge.dll > File/Folder C:\WINDOWS\system32 qviehge.dll not found. < C:\WINDOWS\system32\wcmabgea.dll > File/Folder C:\WINDOWS\system32\wcmabgea.dll not found. < C:\WINDOWS\system32\gfqyeckg.dll > File/Folder C:\WINDOWS\system32\gfqyeckg.dll not found. < C:\WINDOWS\system32\xcrryknt.dll > File/Folder C:\WINDOWS\system32\xcrryknt.dll not found. < C:\WINDOWS\system32\vgixgvqy.dll > File/Folder C:\WINDOWS\system32\vgixgvqy.dll not found. < C:\WINDOWS\system32\drivers\Wju57.sys > File move failed. C:\WINDOWS\system32\drivers\Wju57.sys scheduled to be moved on reboot. < C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\H8MCXKIO\ptch[1] > File/Folder C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\H8MCXKIO\ptch[1] not found. < C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\0I7KTNO4\hctp[1] > File/Folder C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\0I7KTNO4\hctp[1] not found. < C:\Program Files\Panda Security\TotalScan\pskavs.dll > File/Folder C:\Program Files\Panda Security\TotalScan\pskavs.dll not found. < C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll > File/Folder C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll not found. OTMoveIt2 by OldTimer - Version 1.0.21 log created on 04012008_114303

jlpjlp · Answer

ok colle un antivir, hijakchits et combofix



Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs ! 

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic 

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider. 
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Pandorea · Answer

Antivir : ntiVir PersonalEdition Classic Report file date: mardi 1 avril 2008 12:19 Scanning for 1172298 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: BOITEDEPANDORE Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:30 AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:52 LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:48 LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:22 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:16 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 15:16:20 ANTIVIR2.VDF : 7.0.3.85 434176 Bytes 27/03/2008 15:16:20 ANTIVIR3.VDF : 7.0.3.97 56320 Bytes 31/03/2008 15:15:08 AVEWIN32.DLL : 7.6.0.78 3408384 Bytes 30/03/2008 15:16:22 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:28 AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:18 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 30/03/2008 15:16:22 AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:08 AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:34 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:20 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:44 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:14 RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:38 SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:22 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mardi 1 avril 2008 12:19 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'flashget.exe' - '1' Module(s) have been scanned Scan process 'cidaemon.exe' - '1' Module(s) have been scanned Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned Scan process 'wscntfy.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'bittorrent.exe' - '1' Module(s) have been scanned Scan process 'BTDNA.EXE' - '1' Module(s) have been scanned Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned Scan process 'MsnMsgr.Exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'admtray.exe' - '1' Module(s) have been scanned Scan process 'ElkCtrl.exe' - '1' Module(s) have been scanned Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned Scan process 'QtZgAcer.EXE' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned Scan process 'eDSloader.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'PCMService.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'Monitor.exe' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'ALG.EXE' - '1' Module(s) have been scanned Scan process 'CLSched.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'CLMLService.exe' - '1' Module(s) have been scanned Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned Scan process 'CISVC.EXE' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'admServ.exe' - '1' Module(s) have been scanned Scan process 'GUARD.EXE' - '0' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'SCHED.EXE' - '1' Module(s) have been scanned Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'LSASS.EXE' - '1' Module(s) have been scanned Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned Scan process 'SMSS.EXE' - '1' Module(s) have been scanned 66 processes with 66 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '43' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\hiberfil.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\ddcca.dll [DETECTION] Is the Trojan horse TR/Vundo.AG [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\Wju57.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: mardi 1 avril 2008 13:02 Used time: 43:01 min The scan has been done completely. 6699 Scanning directories 358456 Files were scanned 1 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 4 Files cannot be scanned 358455 Files not concerned 6974 Archives were scanned 5 Warnings 1 Notes

jlpjlp · Answer

ok un rapport combofix et hijakchtis svp

Pandorea · Answer

Le rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:25:39, on 01/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DNA\btdna.exe
D:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\qpnmmmor.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Pandorea · Answer

Sinon pour combofix c'est toujours pareil, j'ai fais ce qui était marqué mais il n'y a rien qui s'affiche quand je l'ouvre...

Etj'ai toujours le fichier C:\WINDOWS\system32\ddcca.dll qui est infecté par vundo, mais tout le reste a l'air clean.

jlpjlp · Answer

Télécharge DSS (Deckard's System Scanner de Deckard) sur ton Bureau à partir de ce lien : 

http://www.techsupportforum.com/sectools/Deckard/dss.exe 

Choisis "enregistrer" et "Bureau" comme emplacement. 

Ferme toutes les applications en cours (très important, sinon l'ordi peut planter). 

Double-clique sur dss.exe pour lancer l'outil. 

S'il ne trouve pas HijackThis, clique sur Oui. 

Clique sur OK à chaque fois que cela sera demandé. 

L'analyse finie, un fichier texte s'affichera. Poste son contenu dans ta réponse. 

Le rapport se trouve ici : C:\Deckard\System Scanner\main.txt. 


______________________

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum



_________________


Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\qpnmmmor.dll",b

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk

___________


Relance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :

C:\WINDOWS\system32\ddcca.dll
c:\smaq.exe/r
C:\WINDOWS\system32\qpnmmmor.dll
C:\WINDOWS\system32\drivers\Wju57.sys

* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix, ainsi qu'un nouveau log hijackthis et combofix



_____________

essaye de refaire combofix apres désactivation de la protection resisdente de spybt et antivir


_______________

Pandorea · Answer

Le rapport DSS:

Run by Pandore on 2008-04-01 16:46:12
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 3 Restore Point(s) --
3: 2008-04-01 14:46:21 UTC - RP3 - Deckard's System Scanner Restore Point
2: 2008-04-01 10:13:55 UTC - RP2 - premiere
1: 2008-04-01 10:12:12 UTC - RP1 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Pandore.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:47:57, on 01/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Pandore\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Pandore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {3ACD83D9-41E3-458D-A0FA-4F590F4090FE} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: {6ec83da7-4194-5dd9-fe14-845dba64f6bd} - {db6f46ab-d548-41ef-9dd5-49147ad38ce6} - C:\WINDOWS\system32\kaxbffyl.dll
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {3ACD83D9-41E3-458D-A0FA-4F590F4090FE} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: {6ec83da7-4194-5dd9-fe14-845dba64f6bd} - {db6f46ab-d548-41ef-9dd5-49147ad38ce6} - C:\WINDOWS\system32\kaxbffyl.dll
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r

O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\



_____________________



pour fusionner: regarde ici:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif



_______________

telecharge combofix: sans le renommer

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs ! 

___________________

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






Driver ::
Wju57

File::
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ddcca.dll 
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqqqrs.dll


Registry::

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dbabe930-af45-434f-ab22-447a3304be5b}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"advap32"=-





Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt



_____________

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 
-------------- 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {3ACD83D9-41E3-458D-A0FA-4F590F4090FE} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: {6ec83da7-4194-5dd9-fe14-845dba64f6bd} - {db6f46ab-d548-41ef-9dd5-49147ad38ce6} - C:\WINDOWS\system32\kaxbffyl.dll
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)

O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\


_________________



pour fusionner: regarde ici

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
______________



telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs !  sans le renommer cette fois




Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






Driver ::
Wju57


File::
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
 C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll



Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]





Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 
-------------- 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {3ACD83D9-41E3-458D-A0FA-4F590F4090FE} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: {6ec83da7-4194-5dd9-fe14-845dba64f6bd} - {db6f46ab-d548-41ef-9dd5-49147ad38ce6} - C:\WINDOWS\system32\kaxbffyl.dll
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)

O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\


_________________



pour fusionner: regarde ici

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
______________



telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs !  sans le renommer cette fois




Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






Driver ::
Wju57


File::
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
 C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll



Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]





Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

hhh

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 
-------------- 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {3ACD83D9-41E3-458D-A0FA-4F590F4090FE} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: {6ec83da7-4194-5dd9-fe14-845dba64f6bd} - {db6f46ab-d548-41ef-9dd5-49147ad38ce6} - C:\WINDOWS\system32\kaxbffyl.dll
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)

O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\


_________________



pour fusionner: regarde ici

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
______________



telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs !  sans le renommer cette fois




Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






Driver ::
Wju57


File::
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
 C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll



Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]





Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Pandorea · Answer

Oki, je n'ai pas le temps de faire ça aujourd'hui, j'essayerai demain.
:) Merci pour ton aide en tout cas, bonne soirée

jlpjlp · Answer

ok tiens au jus

a plus

Pandorea · Answer

Bonjour!
Je n'ai pas eu le temps de m'occuper de l'odinateur pendant quelques jours, mais me revoilà.
Je pense que je vais désinstaller antivir, qui dès que la garde est lancée empêche le fonctionnement de l'ordi avec ces interminables messages d'erreur (pour 2 fichiers dans system32!)... Je remettrai avast qui est peut-être moins efficace mais qui ne bloque pas l'ordi!
Bon, comme je n'étais pas la j'ai peur que d'autre fichiers soient infectés. Donc avant de faire ce que tu as marqué je te remets un hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:37:45, on 09/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32	fnngblh.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

jlpjlp · Answer

oui colle moi le rapport antivir pour voir, tu as aussi le rapport combofix?


_____________

fix ces lignes:

O4 - HKLM\..\Run: [advap32] c:\smaq.exe/r

O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32	fnngblh.dll",b 

_________


télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :


C:\WINDOWS\system32	fnngblh.dll

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

Pandorea · Answer

Voila enfin antivir :) : AntiVir PersonalEdition Classic Report file date: mercredi 9 avril 2008 10:42 Scanning for 1188283 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: BOITEDEPANDORE Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:30 AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:52 LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:48 LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:22 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:16 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 08:29:00 ANTIVIR2.VDF : 7.0.3.127 649216 Bytes 07/04/2008 08:29:00 ANTIVIR3.VDF : 7.0.3.136 58880 Bytes 09/04/2008 08:29:00 AVEWIN32.DLL : 7.6.0.81 3424768 Bytes 09/04/2008 08:29:02 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:28 AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:18 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 09/04/2008 08:29:02 AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:08 AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:34 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:20 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:44 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:14 RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:38 SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:22 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mercredi 9 avril 2008 10:42 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'cidaemon.exe' - '1' Module(s) have been scanned Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'BTDNA.EXE' - '1' Module(s) have been scanned Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'admtray.exe' - '1' Module(s) have been scanned Scan process 'ElkCtrl.exe' - '1' Module(s) have been scanned Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'QtZgAcer.EXE' - '1' Module(s) have been scanned Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned Scan process 'eDSloader.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'PCMService.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'Monitor.exe' - '1' Module(s) have been scanned Scan process 'ALG.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'CLSched.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'CLMLService.exe' - '1' Module(s) have been scanned Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned Scan process 'CISVC.EXE' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'admServ.exe' - '1' Module(s) have been scanned Scan process 'GUARD.EXE' - '0' Module(s) have been scanned Scan process 'SCHED.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'LSASS.EXE' - '1' Module(s) have been scanned Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned Scan process 'SMSS.EXE' - '1' Module(s) have been scanned 63 processes with 63 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. C:\WINDOWS\system32 fnngblh.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '486a8200.qua'! C:\WINDOWS\system32 fnngblh.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen C:\WINDOWS\system32\WLCtrl32.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '483f81e7.qua'! C:\WINDOWS\system32\WLCtrl32.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen The registry was scanned ( '45' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\hiberfil.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\ddcca.dll [DETECTION] Is the Trojan horse TR/Vundo.AG [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\qpnmmmor.dll [DETECTION] Is the Trojan horse TR/Vundo.EFQ [INFO] The file was moved to '486a8a1e.qua'! C:\WINDOWS\system32\mwtpeybs.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48708a26.qua'! C:\WINDOWS\system32\ipcpjuag.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '485f8a21.qua'! C:\WINDOWS\system32\bsqkvoca.dll [DETECTION] Is the Trojan horse TR/Vundo.EFU [INFO] The file was moved to '486d8a25.qua'! C:\WINDOWS\system32\kaxbffyl.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48748a13.qua'! C:\WINDOWS\system32\stytgmso.dll [DETECTION] Is the Trojan horse TR/PCK.Monder.86528 [INFO] The file was moved to '48758a27.qua'! C:\WINDOWS\system32\kwagorep.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '485d8a2a.qua'! C:\WINDOWS\system32\osgxctjs.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48638a27.qua'! C:\WINDOWS\system32\jtuuqngg.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48718a28.qua'! C:\WINDOWS\system32\vbcyctej.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '485f8a16.qua'! C:\WINDOWS\system32 qfpyhfy.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48628a27.qua'! C:\WINDOWS\system32\iefjseib.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48628a1c.qua'! C:\WINDOWS\system32\woandagt.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '485d8a26.qua'! C:\WINDOWS\system32\hlncfjso.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003 [WARNING] The file could not be deleted! C:\WINDOWS\system32\ukjlbfct.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '48668a26.qua'! C:\WINDOWS\system32\dqohjyeb.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '486b8a2d.qua'! C:\WINDOWS\system32\ekqapsqm.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '486d8a28.qua'! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\Wju57.sys [WARNING] The file could not be opened! C:\Documents and Settings\Pandore\Local Settings\Temp\fbrundui.dll [DETECTION] Is the Trojan horse TR/Vundo.EFQ [INFO] The file was moved to '486e8b5c.qua'! C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\GBMQ09Y6\glas[1] [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '485d8b75.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP3\A0000225.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '482c922c.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP4\A0002268.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '482c9230.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP5\A0002355.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c9233.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP8\A0003552.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '482c923b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP10\A0003783.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c9241.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004783.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c9243.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004805.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c9244.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004806.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] The file was moved to '490d1b75.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004809.dll [DETECTION] Is the Trojan horse TR/Vundo.EFQ [INFO] The file was moved to '482c9245.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004810.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '490d1b76.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004811.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c9247.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004812.dll [DETECTION] Is the Trojan horse TR/Vundo.EFU [INFO] The file was moved to '482c9246.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004813.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '490d1b77.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004814.dll [DETECTION] Is the Trojan horse TR/PCK.Monder.86528 [INFO] The file was moved to '490d1b78.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004815.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c9249.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004816.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '490d1b7a.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004817.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c9248.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004818.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '490d1b79.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004819.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c924a.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004820.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c924b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004821.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '490d1b7c.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004822.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '482c924d.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004823.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '490d1b7b.qua'! C:\_OTMoveIt\MovedFiles\04012008_150020\WINDOWS\system32\eowaenpu.dll [DETECTION] Is the Trojan horse TR/Vundo.EFQ [INFO] The file was moved to '487392de.qua'! Begin scan in 'D:\' End of the scan: mercredi 9 avril 2008 12:03 Used time: 1:20:44 min The scan has been done completely. 6883 Scanning directories 360812 Files were scanned 46 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 44 files were moved to quarantine 0 files were renamed 4 Files cannot be scanned 360766 Files not concerned 7038 Archives were scanned 6 Warnings 1 Notes Et là je vais faire tout ce que tu as marqué au dessus doc on va voir si combofix veut bien marcher!

jlpjlp · Answer

oui colle moi le rapport combofix
comme ceci  et garde antivir meme si tu as des alertes! car il montre les infections contrairement a avast!






pour fusionner: regarde ici

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
______________



telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs ! sans le renommer cette fois




Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






Driver ::
Wju57


File::
C:\WINDOWS\system32	fnngblh.dll
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll



Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]





Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Pandorea · Answer

Toujours rien à faire pour combofix : même en suivant toutes les instructions, la fenêtre bleue reste désespérement vide...

Pandorea · Answer

Le rapport OTMoveit:
File/Folder C:\WINDOWS\system32	fnngblh.dll not found.
[Custom Input]
< C:\WINDOWS\system32	fnngblh.dll >
File/Folder C:\WINDOWS\system32	fnngblh.dll not found.
 
OTMoveIt2 by OldTimer - Version 1.0.21 log created on 04092008_151606

jlpjlp · Answer

fais le message 59 et colle le rapport combofix  apres avoir désactivé tes protection (antivir, spybot...)

jlpjlp · Answer

si combofix toujours impossible fais ceci: Accepte de suivre strictement cette procédure SVP: 1)-Télécharge The Avenger par Swandog46 sur le Bureau avec ce lien: < http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/ > Click sur Avenger.zip pour ouvrir le fichier; en extraire "avenger.exe" sur votre bureau 2)- Sélectionner ( mettre en surbrillance ) TOUT le texte en gras ci-dessous, et appuyer simultanément sur les touches (Ctrl+C): drivers to unload: Wju57 Files to delete: C:\WINDOWS\system32 fnngblh.dll c:\smaq.exe/r C:\WINDOWS\system32\gqunlaws.dll c:\windows\system32\drivers\wju57.sys C:\WINDOWS\system32\kaxbffyl.dll C:\WINDOWS\system32\ipcpjuag.dll C:\WINDOWS\system32\mwtpeybs.dll C:\WINDOWS\system32\qpnmmmor.dll C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com C:\Program Files\AntiVirusPro C:\WINDOWS\system32\gqunlaws.dll C:\WINDOWS\system32\accdd.ini2 C:\WINDOWS\system32\ddcca.dll C:\WINDOWS\system32\ssqqqrs.dll C:\WINDOWS\system32\drivers\Wju57.sys C:\WINDOWS\system32\ddcca.dll Registry keys to delete: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ljjkifc] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys] 3)- Double-clic sur l'icône "avenger.exe" du bureau, puis [OK] ( sur le message qui s'affiche ). •- Sous "Script file to execute" cocher le bouton ratio devant "Input Script Manually". < http://img78.imageshack.us/img78/5258/screenshot265wz9.gif > Puis clique sur l'icône " en forme de loupe " qui va ouvrir une nouvelle fenêtre "View/edit script" Dans cette fenêtre, pointer la souris dans le coin supérieur gauche, cliquer 1 fois, puis appuyer simultanément sur les touches (CTL+V) •- Cliquer Done Ensuite clique sur l'icône en forme de Feu Vert pour démarrer l'exécution du script Réponds "Yes" deux fois quand demandé. 4)- The Avenger va automatiquement faire ce qui suit: Il va re-démarrer le système. Pendant le re-démarrage, il apparaîtra brièvement une fenêtre de commande de windows noire sur ton bureau, ceci est NORMAL. Après le re-démarrage, il crée un fichier log qui s'ouvrira, faisant apparaître les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt 5)- Pour finir copie/colle le contenu du ficher c:\avenger.txt dans ta réponse avec un nouveau rapport hijackthis.

Pandorea · Answer

Je n'ai pas la même fenêtre à l'ouverture, moi j'ai ça :
https://app.photobucket.com/ . Je copir ce que tu m'a donné directement dedans? ^^ Je suppose que oui mais bon on sait jamais hein...

jlpjlp · Answer

oui

Pandorea · Answer

Quand je met "execute"  après avoir rentré les lignes, un message d'erreur saffiche : "error invalid script. a valid script must begin with a command directive. aborting execution".

jlpjlp · Answer

Accepte de suivre strictement cette procédure SVP: 1)-Télécharge The Avenger par Swandog46 sur le Bureau avec ce lien: < http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/ > Click sur Avenger.zip pour ouvrir le fichier; en extraire "avenger.exe" sur votre bureau 2)- Sélectionner ( mettre en surbrillance ) TOUT le texte en gras ci-dessous, et appuyer simultanément sur les touches (Ctrl+C): drivers to unload: Wju57 Files to delete: C:\WINDOWS\system32 fnngblh.dll c:\smaq.exe/r C:\WINDOWS\system32\gqunlaws.dll c:\windows\system32\drivers\wju57.sys C:\WINDOWS\system32\kaxbffyl.dll C:\WINDOWS\system32\ipcpjuag.dll C:\WINDOWS\system32\mwtpeybs.dll C:\WINDOWS\system32\qpnmmmor.dll C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com C:\Program Files\AntiVirusPro C:\WINDOWS\system32\gqunlaws.dll C:\WINDOWS\system32\accdd.ini2 C:\WINDOWS\system32\ddcca.dll C:\WINDOWS\system32\ssqqqrs.dll C:\WINDOWS\system32\drivers\Wju57.sys C:\WINDOWS\system32\ddcca.dll Registry keys to delete: HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC} HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6} HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ljjkifc HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys 3)- Double-clic sur l'icône "avenger.exe" du bureau, puis [OK] ( sur le message qui s'affiche ). •- Sous "Script file to execute" cocher le bouton ratio devant "Input Script Manually". < http://img78.imageshack.us/img78/5258/screenshot265wz9.gif > Puis clique sur l'icône " en forme de loupe " qui va ouvrir une nouvelle fenêtre "View/edit script" Dans cette fenêtre, pointer la souris dans le coin supérieur gauche, cliquer 1 fois, puis appuyer simultanément sur les touches (CTL+V) •- Cliquer Done Ensuite clique sur l'icône en forme de Feu Vert pour démarrer l'exécution du script Réponds "Yes" deux fois quand demandé. 4)- The Avenger va automatiquement faire ce qui suit: Il va re-démarrer le système. Pendant le re-démarrage, il apparaîtra brièvement une fenêtre de commande de windows noire sur ton bureau, ceci est NORMAL. Après le re-démarrage, il crée un fichier log qui s'ouvrira, faisant apparaître les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt 5)- Pour finir copie/colle le contenu du ficher c:\avenger.txt dans ta réponse avec un nouveau rapport hijackthis.

Pandorea · Answer

Tu n'as pas lu ce que j'ai écris avant? L'avenger que tu m'as dis de télécharger ne correspond pas avec les instructions que tu me donnes, je ne peux pas les apliquer. Je t'ai même mis un lien pour que tu vois à quoi ressemble ma fenêtre, ça serait gentil que tu regardes, c'est dans mon message d'avant...

jlpjlp · Answer

ok je vais regarder mais en ce moment peu de temps, recolle moi un rapport hijackhtis

Pandorea · Answer

D'accord mais pas de souci hein, prend ton temps, moi je trouve déjà que c'est super que tu m'aides :).

hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:24:35, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\CF2603.exe
C:\WINDOWS\system32\CF2603.exe
C:\WINDOWS\explorer.exe
D:\Program Files\BitTorrent\bittorrent.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\btnlkyel.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

jlpjlp · Answer

essaye ceci:

Copiez/coller le texte ci-dessous dans le Bloc-note :  (demarrer puis tous les programmes puis
accessoire)


drivers to unload:
Wju57


Files to delete:
C:\WINDOWS\system32	fnngblh.dll
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll

Registry keys to delete:
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys



Dans le menu du bloc notes, clic sur "Fichier" >> Enregistrer sous.
Choisis le bureau comme lieu d'enregistrement, puis dans:

Type -> choisis "tous les fichiers"
Nom du fichier -> remove.txt
clic sur enregistrer. 



Téléchargez The Avenger 

    * Dézipez le contenu de l'archive sur votre bureau et doublez-clic sur avenger.exe
    * Cliquez sur "Ok" 
    * Sélectionnez "Load Script from File" et cliquez sur l'icône en forme de dossier. 
    * Sélectionnez le fichier remove.txt qui est sur votre bureau 
    * Cliquez sur le feu vert pour lancer le script 
    * Cliquez sur "Oui" 
    * Acceptez de redémarrer le pc.

jlpjlp · Answer

Télécharge ComboScan sur ton Bureau.
---> http://deckard.geekstogo.com/dss.exe

Ferme toutes les applications en cours ; antivirus, pare-feu, etc ..
Double-clic sur comboscan.exe A la fenêtre qui s'affiche, clic sur OK.
Soit patient ..
Le rapport Comboscan.txt s'affichera, copie et colle le contenu de ce fichier ici.

Pandorea · Answer

Voilaaaaaaa :

Deckard's System Scanner v20071014.68
Run by Pandore on 2008-04-10 18:32:50
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Pandore.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:32:57, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\CF2603.exe
C:\WINDOWS\system32\CF2603.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Pandore\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Pandore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {4854196A-4AA7-4232-9945-B4D853F45231} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)
O2 - BHO: {43aa8068-c7c8-3ad8-c644-c0ce74ca5f0c} - {c0f5ac47-ec0c-446c-8da3-8c7c8608aa34} - C:\WINDOWS\system32\xvkcmigm.dll
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\frveutth.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Pandorea · Answer

???

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gaiaonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)

O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)

O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {4854196A-4AA7-4232-9945-B4D853F45231} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)

O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - (no file)
O2 - BHO: {43aa8068-c7c8-3ad8-c644-c0ce74ca5f0c} - {c0f5ac47-ec0c-446c-8da3-8c7c8608aa34} - C:\WINDOWS\system32\xvkcmigm.dll
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)

O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\frveutth.dll",b

O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll

_____________________



scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.


puis :




virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe



________________

Copiez/coller le texte ci-dessous dans le Bloc-note : (demarrer puis tous les programmes puis
accessoire)


drivers to unload:
Wju57


Files to delete:
C:\WINDOWS\system32	fnngblh.dll
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\xvkcmigm.dll 

Registry keys to delete:
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys
320d18a1"=-


Dans le menu du bloc notes, clic sur "Fichier" >> Enregistrer sous.
Choisis le bureau comme lieu d'enregistrement, puis dans:

Type -> choisis "tous les fichiers"
Nom du fichier -> remove.txt
clic sur enregistrer.



Téléchargez The Avenger

* Dézipez le contenu de l'archive sur votre bureau et doublez-clic sur avenger.exe
* Cliquez sur "Ok"
* Sélectionnez "Load Script from File" et cliquez sur l'icône en forme de dossier.
* Sélectionnez le fichier remove.txt qui est sur votre bureau
* Cliquez sur le feu vert pour lancer le script
* Cliquez sur "Oui"
* Acceptez de redémarrer le pc.

elgorte · Answer

voici le rapport hijackthis

de l'aide svp



Logfile of HijackThis v1.99.1
Scan saved at NADIR-09:28:52, on 21/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Keys\Keys.exe
E:\Keys\Keys.exe
E:\Keys\Keys.exe
C:\Documents and Settings
adir\Bureau\scanée.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://famous2.topcities.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy2.ep.sonatrach.dz:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 172.16.5.5,mail.ep.sonatrach.dz;<local>
F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [firewall 2008] C:\windows\system32\logoneui.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\windows\system32\klogon.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)

jlpjlp · Answer

cré ton propre message et on t'aidera

Pandorea · Answer

:) Rapport virtumonde, désolée pour lé délai!
Il marque rien de trouvé apparamment, mais avast lui repère
toujours une infection dans le fichier C:\WINDOWS\system32\ddcca.dll,
que je n'arrive pas à supprimer.



[04/22/2008, 19:50:38] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Pandore\Bureau\VirtumundoBeGone.exe" )
[04/22/2008, 19:50:45] - Detected System Information:
[04/22/2008, 19:50:45] -  Windows Version: 5.1.2600, Service Pack 2
[04/22/2008, 19:50:45] -  Current Username: Pandore (Admin)
[04/22/2008, 19:50:45] -  Windows is in NORMAL mode.
[04/22/2008, 19:50:45] - Searching for Browser Helper Objects:
[04/22/2008, 19:50:45] -  BHO 1: {00B64E9C-1D4E-44F9-9441-0DE12C965A01} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/22/2008, 19:50:45] -  BHO 3: {11241072-58BB-40CE-9171-0B2BDFB22E97} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 4: {1ad15e05-8894-4805-9b71-53a28306c196} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 5: {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 6: {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 7: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[04/22/2008, 19:50:45] -  BHO 8: {346EFF42-3479-4051-A7FD-FCBB8887DAC3} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 9: {3660847C-FD73-46F9-9371-56E312BA3C0A} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 10: {4D68209D-26FE-4700-86F6-1328D9B80C4F} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  Checking for HKLM\...\Winlogon\Notify\ddcca
[04/22/2008, 19:50:45] -  Key not found: HKLM\...\Winlogon\Notify\ddcca, continuing.
[04/22/2008, 19:50:45] -  BHO 11: {60ed0664-2325-4fac-85d3-fc3206962ee4} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 12: {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 13: {65dc3fde-e848-42a3-ab68-5a752b0813dd} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  Checking for HKLM\...\Winlogon\Notify\efhaenmt
[04/22/2008, 19:50:45] -  Key not found: HKLM\...\Winlogon\Notify\efhaenmt, continuing.
[04/22/2008, 19:50:45] -  BHO 14: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/22/2008, 19:50:45] -  BHO 15: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 16: {A97E1B61-3B4A-4A08-A337-76DE915B243B} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 17: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[04/22/2008, 19:50:45] -  BHO 18: {C03FD59D-9104-44B7-929A-9EAA0BA05211} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 19: {C2E9F82D-7835-492C-892A-AFA2301AF6E5} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 20: {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] -  BHO 21: {dbabe930-af45-434f-ab22-447a3304be5b} ()
[04/22/2008, 19:50:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2008, 19:50:45] -  No filename found. Continuing.
[04/22/2008, 19:50:45] - Finished Searching Browser Helper Objects
[04/22/2008, 19:50:45] - Finishing up...
[04/22/2008, 19:50:45] - Nothing found! Exiting...

Je vais de ce pas appliquer avenger!

Pandorea · Answer

Avenger refuse toujours d'exécuter le script : "invalid script"

jlpjlp · Answer

télécharge OTMoveIt 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.  Ou sur  https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 

C:\WINDOWS\system32	fnngblh.dll
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\xvkcmigm.dll
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 
______________


Désactives tes protection , antivirus....



Driver ::
Wju57


File::
c:\smaq.exe/r
C:\WINDOWS\system32\gqunlaws.dll
c:\windows\system32\drivers\wju57.sys
C:\WINDOWS\system32\kaxbffyl.dll
C:\WINDOWS\system32\ipcpjuag.dll
C:\WINDOWS\system32\mwtpeybs.dll
C:\WINDOWS\system32\qpnmmmor.dll
C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com
C:\Program Files\AntiVirusPro
C:\WINDOWS\system32\gqunlaws.dll
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\ssqqqrs.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll



Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db6f46ab-d548-41ef-9dd5-49147ad38ce6}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]





Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Pandorea · Answer

Bizarrement pas de rapport dans le disque C donc je te met ce qui est dans la fenêtre: File/Folder C:\WINDOWS\system32 fnngblh.dll not found. File/Folder c:\smaq.exe/r not found. File/Folder C:\WINDOWS\system32\gqunlaws.dll not found. File move failed. c:\windows\system32\drivers\wju57.sys scheduled to be moved on reboot. File/Folder C:\WINDOWS\system32\kaxbffyl.dll not found. File/Folder C:\WINDOWS\system32\ipcpjuag.dll not found. File/Folder C:\WINDOWS\system32\mwtpeybs.dll not found. File/Folder C:\WINDOWS\system32\qpnmmmor.dll not found. File/Folder C:\Documents and Settings\Pandore\Application Data\Anti-Virus-Pro.com not found. File/Folder C:\Program Files\AntiVirusPro not found. File/Folder C:\WINDOWS\system32\gqunlaws.dll not found. File/Folder C:\WINDOWS\system32\accdd.ini2 not found. DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcca.dll C:\WINDOWS\system32\ddcca.dll NOT unregistered. File move failed. C:\WINDOWS\system32\ddcca.dll scheduled to be moved on reboot. File/Folder C:\WINDOWS\system32\ssqqqrs.dll not found. File/Folder C:\WINDOWS\system32\drivers\Wju57.sys not found. DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcca.dll C:\WINDOWS\system32\ddcca.dll NOT unregistered. File move failed. C:\WINDOWS\system32\ddcca.dll scheduled to be moved on reboot. File/Folder C:\WINDOWS\system32\xvkcmigm.dll not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97} not found. File/Folder HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ljjkifc not found. [Custom Input] < C:\WINDOWS\system32 fnngblh.dll > File/Folder C:\WINDOWS\system32 fnngblh.dll not found. < c:\smaq.exe/r >

jlpjlp · Answer

ok

toujours ces deux là , essaye de faire la suite pour les virer:

c:\windows\system32\drivers\wju57.sys 
C:\WINDOWS\system32\ddcca.dll

Pandorea · Answer

Ah et toujours pareil pour combofix :
ouvre une fenetre bleue et vide et puis c'est tout.

jlpjlp · Answer

meme apres désactivation de tes antivirus....?


________________


Télécharge The Avenger (Swandog46) sur ton bureau

* Clic droit sur Avenger.zip
* Extrais avenger.exe sur ton bureau (clic sur "extraire")


Copie le texte ci dessous EN ENTIER en le sélectionnant puis en faisant CTRL+C (copier) : et mets le dans
la partie blanche (input script here)


registry keys to delete:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]


Files to delete:
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll

Drivers to unload:
Wju57



puis clique sur EXECUTE

Note: Ce code a été créé spécifiquement pour cet utilisateur ! Si vous n'êtes pas cet utilisateur en question, ne suivez pas ces instructions au risque d'endommager votre PC !!!


The Avenger va faire ceci :

* Il va redémarrer ton PC
* Lors du redémarrage du PC, une console noire va apparaître, ne pas s'inquiéter c'est normal !
* Après le rédémarrage, il va ouvrir un rapport avec les actions qu'il a effectué. Ce rapport est situé ici : C:\avenger.txt
* Tous les fichiers supprimés sont gardés en mémoire et compressés dans ce fichier : C:\avenger\backup.zip

Copie et colle le contenu de ce fichier dans ta prochaine réponse : c:\avenger.txt

Pandorea · Answer

Oui je n'avais que antivir et le pare-feu windows, enlvés tous les deux

Pandorea · Answer

Avenger me dis : invalid script, must begin with a command directive

jlpjlp · Answer

esssaye avec ceci:






registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys


Files to delete:
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll

Drivers to unload:
Wju57

Pandorea · Answer

Toujours pareil : /
Invalid script, valid script must begin with a command directive

jlpjlp · Answer

essaye avec ceci

sinon je regarderai pour faire autrement vu que tu ne peux faire combofix!



drivers to unload:
Wju57

registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys



Files to Delete:
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll

Pandorea · Answer

X( Toujours pareil!
Je ne comprend pas pourquoi ça ne marche pas... Peut-être que j'oublie quelque chose?!

jlpjlp · Answer

the avenger :

Sélectionne cette liste :

Drivers to unload:
Wju57


Files to delete:
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll


registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}


--> Clic droit copier

- Ouvre le Bloc-Note et clic sur le menu Edition/Coller afin de coller le contenu qui est dans le cadre ci-dessus
- Enregistre le fichier sur ton bureau sous le nom remove.txt

- Télécharge The Avenger : http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/
- Dézip le contenu de l'archive sur ton bureau et double-clic sur avenger.exe
- Clique sur "Ok"
- Sélectionne "Load Script from File" et clique sur l'icône en forme de dossier.
- Sélectionne le fichier remove.txt qui est sur ton bureau
- Clique sur le feu vert pour lancer le script
- Clique sur "Oui"
- Accepte de redémarrer ton pc.

Quand le PC a redémarre ouvre le fichier C:\avenger.txt et copie/colle le contenu ici.

@+

Pandorea · Answer

Bonjour!
En fait  j'avais déjà fait ça hier quand j'avais vu qu'un simple c/c ne marchait pas... Et ca ne marche pas non plus...

jlpjlp · Answer

tu a bien donné le nom de  remove.txt   au fichier?


_______________

avec combofix: tu l'enregistre bien sur le bureau ? et tu donne le bon nom au fichier créer (attention aux majuscules)?

jlpjlp · Answer

sinon essaye ceci:



* Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

n´y touche pas

redemarre en mode sans echec:

Comment redémarrer en mode sans echec?

Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
capture d´ecran : http://www.coupdepoucepc.com/
Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
Ps : si F8 ne marche pas utilise la touche F5.

Note : en mode sans echec tu n´auras plus acces au net alors imprime ou copie les instructions ci dessous dans un fichier texte que tu pourras consulter a souhait
une fois en mode sans echec.

Fix.reg

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(x)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ACD83D9-41E3-458D-A0FA-4F590F4090FE}


XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin.
Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll



* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

Redemarre normalement et post le rapport de ot_move it ici stp ainsi qu´un nouveau rapport hijack this.

jlpjlp · Answer

ensuite que tu y arrive ou pas tu me collera un rapport hijackthis et comboscan pour voir

Télécharge ComboScan sur ton Bureau.
---> http://deckard.geekstogo.com/dss.exe

Ferme toutes les applications en cours ; antivirus, pare-feu, etc ..
Double-clic sur comboscan.exe A la fenêtre qui s'affiche, clic sur OK.
Soit patient ..
Le rapport Comboscan.txt s'affichera, copie et colle le contenu de ce fichier ici.

Pandorea · Answer

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:17, on 23/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DNA\btdna.exe
D:\Program Files\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/?login_success=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\kriicumx.dll",b
O4 - HKLM\..\Run: [BM313e2b3d] Rundll32.exe "C:\WINDOWS\system32\hnktoogo.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Pandorea · Answer

Comboscan:

Deckard's System Scanner v20071014.68
Run by Pandore on 2008-04-23 12:02:23
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]System Drive C: has 4.99 GiB (less than 15%) free.[/color]


-- HijackThis (run as Pandore.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:25, on 23/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\FlashGet\flashget.exe
C:\Documents and Settings\Pandore\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Pandore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/?login_success=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1AFD9085-1FE8-4B74-A6C8-9FE3835686C6} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: {b919ae31-1d81-d43b-2894-6239ddbf128d} - {d821fbdd-9326-4982-b34d-18d113ea919b} - C:\WINDOWS\system32\dxwsvwvc.dll
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\kriicumx.dll",b
O4 - HKLM\..\Run: [BM313e2b3d] Rundll32.exe "C:\WINDOWS\system32\hnktoogo.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

jlpjlp · Answer

non il persiste, et je vois que pendant ton absence tu a rechopé des infections! tu as fais une restauration?


on va déjà virer le maximum d'infections vundo avant le script
_______________


Fais DEMARRER puis EXECUTER et tape    mrt   puis clique ok et suis la procedure (logiciel de windows se mettant a jour tous les moi et pouvant virer depuis mars des infections vundo)

____________

scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.

puis :

virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe


puis Symantec Vundo Remove Tool B

https://www.broadcom.com/support/security-center

et  Symantec Vundo Remove Tool

https://www.broadcom.com/support/security-center
____________


télécharge OTMoveIt 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.  Ou sur  https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 
C:\WINDOWS\system32\accdd.ini2 
C:\WINDOWS\system32\kriicumx.dll
C:\WINDOWS\system32\hnktoogo.dll
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d821fbdd-9326-4982-b34d-18d113ea919b}
C:\WINDOWS\system32\dxwsvwvc.dll 


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 


______________

colle un rapport antivir
_______________

recolle un comboscan et on reverra pour un script pour virer ce qui reste

Pandorea · Answer

"Windows ne trouve pas mrt" -_-"""""

jlpjlp · Answer

bon passe à la suite

Pandorea · Answer

Vundofix n'a rien trouvé, voilà le rapport de virtumonde :
[04/24/2008, 16:27:20] - VirtumundoBeGone v1.5 ( "C:\Downloads\VirtumundoBeGone.exe" )
[04/24/2008, 16:27:27] - Detected System Information:
[04/24/2008, 16:27:27] -  Windows Version: 5.1.2600, Service Pack 2
[04/24/2008, 16:27:27] -  Current Username: Pandore (Admin)
[04/24/2008, 16:27:27] -  Windows is in NORMAL mode.
[04/24/2008, 16:27:27] - Searching for Browser Helper Objects:
[04/24/2008, 16:27:27] -  BHO 1: {00B64E9C-1D4E-44F9-9441-0DE12C965A01} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/24/2008, 16:27:27] -  BHO 3: {11241072-58BB-40CE-9171-0B2BDFB22E97} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 4: {1ad15e05-8894-4805-9b71-53a28306c196} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 5: {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 6: {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 7: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[04/24/2008, 16:27:27] -  BHO 8: {346EFF42-3479-4051-A7FD-FCBB8887DAC3} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 9: {3660847C-FD73-46F9-9371-56E312BA3C0A} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 10: {60ed0664-2325-4fac-85d3-fc3206962ee4} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 11: {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 12: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/24/2008, 16:27:27] -  BHO 13: {7AF6125D-152A-4597-BECF-ED6AEC0349D5} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  Checking for HKLM\...\Winlogon\Notify\ddcca
[04/24/2008, 16:27:27] -  Key not found: HKLM\...\Winlogon\Notify\ddcca, continuing.
[04/24/2008, 16:27:27] -  BHO 14: {7b62003c-7798-4b38-a287-8a52d625f5a8} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  Checking for HKLM\...\Winlogon\Notify\fvxnytns
[04/24/2008, 16:27:27] -  Key not found: HKLM\...\Winlogon\Notify\fvxnytns, continuing.
[04/24/2008, 16:27:27] -  BHO 15: {A97E1B61-3B4A-4A08-A337-76DE915B243B} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 16: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[04/24/2008, 16:27:27] -  BHO 17: {C2E9F82D-7835-492C-892A-AFA2301AF6E5} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 18: {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] -  BHO 19: {dbabe930-af45-434f-ab22-447a3304be5b} ()
[04/24/2008, 16:27:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/24/2008, 16:27:27] -  No filename found. Continuing.
[04/24/2008, 16:27:27] - Finished Searching Browser Helper Objects
[04/24/2008, 16:27:27] - Finishing up...
[04/24/2008, 16:27:27] - Nothing found! Exiting...

Pandorea · Answer

OTMoveIt : C:\WINDOWS\system32\accdd.ini2 moved successfully. File/Folder C:\WINDOWS\system32\kriicumx.dll not found. DllUnregisterServer procedure not found in C:\WINDOWS\system32\hnktoogo.dll C:\WINDOWS\system32\hnktoogo.dll NOT unregistered. C:\WINDOWS\system32\hnktoogo.dll moved successfully. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC} not found. File/Folder HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d821fbdd-9326-4982-b34d-18d113ea919b} not found. DllUnregisterServer procedure not found in C:\WINDOWS\system32\dxwsvwvc.dll C:\WINDOWS\system32\dxwsvwvc.dll NOT unregistered. C:\WINDOWS\system32\dxwsvwvc.dll moved successfully. [Custom Input] < C:\WINDOWS\system32\accdd.ini2 > File/Folder C:\WINDOWS\system32\accdd.ini2 not found. < C:\WINDOWS\system32\kriicumx.dll > File/Folder C:\WINDOWS\system32\kriicumx.dll not found. < C:\WINDOWS\system32\hnktoogo.dll > File/Folder C:\WINDOWS\system32\hnktoogo.dll not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}\ not found. < HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d821fbdd-9326-4982-b34d-18d113ea919b} > Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d821fbdd-9326-4982-b34d-18d113ea919b}\ not found. < C:\WINDOWS\system32\dxwsvwvc.dll > File/Folder C:\WINDOWS\system32\dxwsvwvc.dll not found. OTMoveIt2 by OldTimer - Version 1.0.21 log created on 04242008_164319 Sur les deux symantec précédents, un n'a rien trouvé et l'autre n'a pas fonctioné.

jlpjlp · Answer

colle un rapport antivir
_______________

recolle un comboscan et on reverra pour un script pour virer ce qui reste

Pandorea · Answer

Antivir : Avira AntiVir Personal Report file date: jeudi 24 avril 2008 16:45 Scanning for 1229227 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: BOITEDEPANDORE Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 16/04/2008 11:58:46 AVSCAN.DLL : 8.1.1.0 53505 Bytes 16/04/2008 11:58:46 LUKE.DLL : 8.1.2.9 151809 Bytes 16/04/2008 11:58:46 LUKERES.DLL : 8.1.2.1 12033 Bytes 16/04/2008 11:58:46 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:16 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 08:29:00 ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 22/04/2008 14:33:04 ANTIVIR3.VDF : 7.0.3.198 2048 Bytes 22/04/2008 14:33:04 Engineversion : 8.1.0.32 AEVDF.DLL : 8.1.0.5 102772 Bytes 16/04/2008 11:58:46 AESCRIPT.DLL : 8.1.0.26 233850 Bytes 19/04/2008 11:56:56 AESCN.DLL : 8.1.0.14 119156 Bytes 19/04/2008 11:56:54 AERDL.DLL : 8.1.0.19 418164 Bytes 16/04/2008 11:58:46 AEPACK.DLL : 8.1.1.2 364917 Bytes 19/04/2008 11:56:54 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 19/04/2008 11:56:52 AEHEUR.DLL : 8.1.0.18 1167735 Bytes 16/04/2008 11:58:46 AEHELP.DLL : 8.1.0.14 115063 Bytes 19/04/2008 11:56:50 AEGEN.DLL : 8.1.0.17 299380 Bytes 19/04/2008 11:56:48 AEEMU.DLL : 8.1.0.5 430450 Bytes 16/04/2008 11:58:46 AECORE.DLL : 8.1.0.27 168310 Bytes 19/04/2008 11:56:48 AVWINLL.DLL : 1.0.0.7 14593 Bytes 16/04/2008 11:58:46 AVPREF.DLL : 8.0.0.1 25857 Bytes 16/04/2008 11:58:46 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVREG.DLL : 8.0.0.0 30977 Bytes 16/04/2008 11:58:46 AVARKT.DLL : 1.0.0.23 307457 Bytes 16/04/2008 11:58:46 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 16/04/2008 11:58:46 SQLITE3.DLL : 3.3.17.1 339968 Bytes 16/04/2008 11:58:46 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 16/04/2008 11:58:46 NETNT.DLL : 8.0.0.1 7937 Bytes 16/04/2008 11:58:46 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 16/04/2008 11:58:40 RCTEXT.DLL : 8.0.32.0 86273 Bytes 16/04/2008 11:58:40 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: C:, D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: jeudi 24 avril 2008 16:45 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'VLC.EXE' - '1' Module(s) have been scanned Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'RUNDLL32.EXE' - '1' Module(s) have been scanned Scan process 'RUNDLL32.EXE' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned Scan process 'cidaemon.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'emule.exe' - '1' Module(s) have been scanned Scan process 'bittorrent.exe' - '1' Module(s) have been scanned Scan process 'btdna.exe' - '1' Module(s) have been scanned Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned Scan process 'MsnMsgr.Exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'admtray.exe' - '1' Module(s) have been scanned Scan process 'ElkCtrl.exe' - '1' Module(s) have been scanned Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned Scan process 'QtZgAcer.EXE' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned Scan process 'eDSloader.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'PCMService.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'Monitor.exe' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'ALG.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned Scan process 'CLSched.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'CLMLService.exe' - '1' Module(s) have been scanned Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned Scan process 'CISVC.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'admServ.exe' - '1' Module(s) have been scanned Scan process 'GUARD.EXE' - '0' Module(s) have been scanned Scan process 'SCHED.EXE' - '1' Module(s) have been scanned Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'LSASS.EXE' - '1' Module(s) have been scanned Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned Scan process 'SMSS.EXE' - '1' Module(s) have been scanned 69 processes with 69 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. C:\WINDOWS\system32\WLCtrl32.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '48539d74.qua'! C:\WINDOWS\system32\dexllgwy.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48889d8f.qua'! C:\WINDOWS\system32\bxyvdjjs.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] The registry was scanned ( '46' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\hiberfil.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\ddcca.dll [DETECTION] Is the Trojan horse TR/Vundo.AG [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] C:\WINDOWS\system32\msidntl.dll [DETECTION] Contains detection pattern of the rootkit RKIT/Podnuha.AY.6 [NOTE] The file was moved to '48799f84.qua'! C:\WINDOWS\system32\pljfobvc.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '487a9f7e.qua'! C:\WINDOWS\system32 akppcyl.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487b9f74.qua'! C:\WINDOWS\system32\xvxrpqve.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48889f8c.qua'! C:\WINDOWS\system32\bivtjbxr.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48869f80.qua'! C:\WINDOWS\system32\lkwrwdwj.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48879f86.qua'! C:\WINDOWS\system32\umelmhno.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48759f89.qua'! C:\WINDOWS\system32\htuadidk.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48859f90.qua'! C:\WINDOWS\system32\hlncfjso.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487e9f89.qua'! C:\WINDOWS\system32\crfkophx.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48769f8f.qua'! C:\WINDOWS\system32\frveutth.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48869f90.qua'! C:\WINDOWS\system32\qqnkfexi.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '487e9f90.qua'! C:\WINDOWS\system32\kddknnus.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48749f84.qua'! C:\WINDOWS\system32\omxgkwfb.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48889f8d.qua'! C:\WINDOWS\system32\eoywbdvm.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48899f90.qua'! C:\WINDOWS\system32\ljwlbovq.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48879f8b.qua'! C:\WINDOWS\system32 qrklrer.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48829f93.qua'! C:\WINDOWS\system32\ptojxgma.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487f9f97.qua'! C:\WINDOWS\system32\stegyedf.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48759f98.qua'! C:\WINDOWS\system32\luisfbbd.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48799f99.qua'! C:\WINDOWS\system32 budjuik.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '48859f86.qua'! C:\WINDOWS\system32\knrbxjno.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49341bdc.qua'! C:\WINDOWS\system32 cjlqcae.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '487a9f89.qua'! C:\WINDOWS\system32\yxiadqty.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48799f9f.qua'! C:\WINDOWS\system32\qcbojmpm.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48729f8b.qua'! C:\WINDOWS\system32\pqswusrc.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48839f99.qua'! C:\WINDOWS\system32 ssmhskj.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48839f9c.qua'! C:\WINDOWS\system32 dysblqw.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48899f8e.qua'! C:\WINDOWS\system32\yjowawpr.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487f9f94.qua'! C:\WINDOWS\system32\ycbsirbo.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48729f8e.qua'! C:\WINDOWS\system32\ycceprrx.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48739f8f.qua'! C:\WINDOWS\system32\lsflxase.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48769f9f.qua'! C:\WINDOWS\system32\oiwvhpur.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48879f96.qua'! C:\WINDOWS\system32 ncgcpvo.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48739f9b.qua'! C:\WINDOWS\system32\ycmlujqs.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487d9f91.qua'! C:\WINDOWS\system32\dpfuahoi.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49c01be8.qua'! C:\WINDOWS\system32 nqljllh.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48819f9d.qua'! C:\WINDOWS\system32\efhaenmt.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48789f96.qua'! C:\WINDOWS\system32\aehkcwwd.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48789f95.qua'! C:\WINDOWS\system32\wsxcmvof.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48889fa3.qua'! C:\WINDOWS\system32\dpkgcvrd.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] C:\WINDOWS\system32\anjddrgr.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] C:\WINDOWS\system32\cryiqxsr.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48899fa5.qua'! C:\WINDOWS\system32\ergwdbvb.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '48779fa6.qua'! C:\WINDOWS\system32\gwtsdnwi.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] C:\WINDOWS\system32\bxyvdjjs.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] C:\WINDOWS\system32\fvxnytns.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\Wju57.sys [WARNING] The file could not be opened! C:\Documents and Settings\Pandore\Local Settings\Temporary Internet Files\Content.IE5\CJ8WC2E5\glas[1] [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4871a1eb.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP11\A0004825.dll [DETECTION] Is the Trojan horse TR/Vundo.EFQ [NOTE] The file was moved to '4840a90b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP12\A0005830.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a913.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP12\A0005831.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '49f47bc4.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP12\A0006838.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '4840a914.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP13\A0006913.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a918.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP14\A0007026.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a91b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP15\A0007077.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a91e.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP15\A0007078.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47bcf.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP15\A0007079.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a900.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP15\A0007080.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47bd1.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP15\A0007081.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a91f.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP15\A0007082.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47bf0.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP17\A0009081.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '4840a925.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP17\A0009089.DLL [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47bf6.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP17\A0009090.DLL [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a926.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP17\A0009091.DLL [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47bf7.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP19\A0009251.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a92c.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP19\A0009252.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47bfd.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP19\A0009253.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a92e.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP19\A0009288.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47bff.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP20\A0009352.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a934.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP21\A0009548.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a939.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP21\A0009623.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '4840a93c.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP21\A0009632.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '49f47bed.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP21\A0009644.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '4840a93f.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009701.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a941.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009747.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '4840a943.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009748.dll [DETECTION] Contains detection pattern of the rootkit RKIT/Podnuha.AY.6 [NOTE] The file was moved to '49f47b94.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009749.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a944.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009750.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b95.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009751.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a945.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009752.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '49f47b96.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009753.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a947.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009754.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '49f47b98.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009755.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a946.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009756.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b97.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009757.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a948.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009758.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a949.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009759.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '49f47b9a.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009760.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a94b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009761.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '49f47b9c.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009762.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '49f47b99.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009763.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a94a.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009764.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b9b.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009765.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a94d.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009766.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b9e.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009767.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a94f.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009768.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a94c.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009769.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b9d.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009770.dll [DETECTION] Is the Trojan horse TR/Agent.3648.1 [NOTE] The file was moved to '4840a94e.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009771.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b80.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009772.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a951.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009773.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b82.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009774.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b9f.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009775.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a970.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009776.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47ba1.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009777.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a953.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009778.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b84.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009779.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a955.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009780.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b86.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009781.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a972.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009782.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47ba3.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009783.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a957.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009784.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b88.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009785.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a950.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009786.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '49f47b81.qua'! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009787.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4840a952.qua'! C:\VundoFix Backups\drwwkidl.dll.bad [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4887a9ba.qua'! C:\VundoFix Backups\mqkarqhl.dll.bad [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487ba9ba.qua'! C:\VundoFix Backups\pafyvjjp.dll.bad [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4876a9aa.qua'! C:\VundoFix Backups\suslbuyb.dll.bad [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4883a9be.qua'! C:\VundoFix Backups\yeklqnbl.dll.bad [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487ba9af.qua'! C:\_OTMoveIt\MovedFiles\04242008_164319\WINDOWS\system32\hnktoogo.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '487ba9bd.qua'! C:\_OTMoveIt\MovedFiles\04242008_164319\WINDOWS\system32\dxwsvwvc.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '4887a9c7.qua'! Begin scan in 'D:\' End of the scan: jeudi 24 avril 2008 17:40 Used time: 54:59 min The scan has been done completely. 6990 Scanning directories 378613 Files were scanned 126 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 119 files were moved to quarantine 0 files were renamed 4 Files cannot be scanned 378487 Files not concerned 7030 Archives were scanned 11 Warnings 119 Notes

Pandorea · Answer

En redémarrant après antivir l'ordinateur a planté évidemment, donc je suppose que ca n'a pnettoyé grand chose...

DSS :
Deckard's System Scanner v20071014.68
Run by Pandore on 2008-04-24 17:57:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]System Drive C: has 1.87 GiB (less than 15%) free.[/color]


-- HijackThis (run as Pandore.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:57:33, on 24/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\DNA\btdna.exe
D:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Pandore\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Pandore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/?login_success=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1B4AA3F4-A0C1-4ECB-9472-0BDE8DEE0B92} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: {8a5f526d-25a8-782a-83b4-8977c30026b7} - {7b62003c-7798-4b38-a287-8a52d625f5a8} - C:\WINDOWS\system32\fvxnytns.dll (file missing)
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\bxyvdjjs.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

jlpjlp · Answer

analyse ces fichiers sur virus total et si inféctés tu les mets dans la citation otmovit aussi: https://www.virustotal.com/gui/


C:\WINDOWS\system32\oajpgcow.dll
C:\WINDOWS\system32\vrdyspfg.dll
C:\WINDOWS\system32\itdpvggm.dll
C:\WINDOWS\system32\cfqcvlmk.dll
C:\WINDOWS\system32\hempixji.dll
C:\WINDOWS\system32\eqorbqdw.dll
C:\WINDOWS\system32\xxdsvwsu.dll 
C:\WINDOWS\system32\upneawoe.ini2 

______________

refais otmovit et mets ceci dans la citation:

C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\dpfuahoi.dll
C:\WINDOWS\system32	nqljllh.dll
C:\WINDOWS\system32\efhaenmt.dll
C:\WINDOWS\system32\aehkcwwd.dll
C:\WINDOWS\system32\wsxcmvof.dll
C:\WINDOWS\system32\dpkgcvrd.dll
C:\WINDOWS\system32\anjddrgr.dll
C:\WINDOWS\system32\cryiqxsr.dll
C:\WINDOWS\system32\ergwdbvb.dll
C:\WINDOWS\system32\gwtsdnwi.dll
C:\WINDOWS\system32\bxyvdjjs.dll
C:\WINDOWS\system32\fvxnytns.dll
C:\WINDOWS\system32\accdd.ini2



_______________________________________

vire ce qui est dnas le dossier vundofic backups en allant dans poste de travail puis C puis 
C:\VundoFix Backups\yeklqnbl.dll.bad

__________________________________________

vire ce qui est dans moved files en allant dans poste de travail puis C puis OTMOVIT

__________________________________________

repare windows avec zeb restore;   http://telechargement.zebulon.fr/zeb-restore.html
____________________________________________
essaye de refaire ceci si impossible recolle un comboscan

telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs ! sans le renommer cette fois




Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






Driver ::
Wju57


File::

C:\WINDOWS\system32\fvxnytns.dll
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\bxyvdjjs.dll
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\drivers\Wju57.sys
C:\WINDOWS\system32\ddcca.dll



Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00B64E9C-1D4E-44F9-9441-0DE12C965A01}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11241072-58BB-40CE-9171-0B2BDFB22E97}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ad15e05-8894-4805-9b71-53a28306c196}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1B4AA3F4-A0C1-4ECB-9472-0BDE8DEE0B92}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22481B3B-C037-4A26-AA1F-DDCDD5160DC7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346EFF42-3479-4051-A7FD-FCBB8887DAC3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3660847C-FD73-46F9-9371-56E312BA3C0A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60ed0664-2325-4fac-85d3-fc3206962ee4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7b62003c-7798-4b38-a287-8a52d625f5a8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A97E1B61-3B4A-4A08-A337-76DE915B243B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2E9F82D-7835-492C-892A-AFA2301AF6E5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF26FAC0-7D4E-46D8-AE64-B277B11443AC}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dbabe930-af45-434f-ab22-447a3304be5b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"320d18a1"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ljjkifc]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WLCtrl32]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wju57.sys]
@="Driver"-







Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Pandorea · Answer

Hello!
Je coche quelles cases pour zeb-restore?

jlpjlp · Answer

coche tout

Pandorea · Answer

ComboFix n'a pas marché, il a même fait sévèrement planté l'ordinateur. :) A part ça antivir me laisse enfin tranquille avec les alertes, donc ddcca.dll a enfin été supprimé!

Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:24:35, on 26/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
D:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/?login_success=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: {8654a3cc-fc15-2cf8-0ba4-52c8611f2dd0} - {0dd2f116-8c25-4ab0-8fc2-51cfcc3a4568} - C:\WINDOWS\system32\lvjykfmu.dll (file missing)
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BM313e2b3d] Rundll32.exe "C:\WINDOWS\system32\dvvyffhh.dll",s
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\pprvrqjy.dll",b
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

jlpjlp · Answer

relance hijackhis et fix ces lignes:


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/?login_success=1

O2 - BHO: (no name) - {00B64E9C-1D4E-44F9-9441-0DE12C965A01} - (no file)

O2 - BHO: {8654a3cc-fc15-2cf8-0ba4-52c8611f2dd0} - {0dd2f116-8c25-4ab0-8fc2-51cfcc3a4568} - C:\WINDOWS\system32\lvjykfmu.dll (file missing)
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - (no file)
O2 - BHO: (no name) - {1ad15e05-8894-4805-9b71-53a28306c196} - (no file)
O2 - BHO: (no name) - {1E8FFFD3-CF45-490E-ACD3-85FE15A8D42C} - (no file)
O2 - BHO: (no name) - {22481B3B-C037-4A26-AA1F-DDCDD5160DC7} - (no file)

O2 - BHO: (no name) - {346EFF42-3479-4051-A7FD-FCBB8887DAC3} - (no file)
O2 - BHO: (no name) - {3660847C-FD73-46F9-9371-56E312BA3C0A} - (no file)
O2 - BHO: (no name) - {60ed0664-2325-4fac-85d3-fc3206962ee4} - (no file)
O2 - BHO: (no name) - {62a3fdc0-8e92-4ce7-bf52-e56fa97bac6c} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A97E1B61-3B4A-4A08-A337-76DE915B243B} - (no file)

O2 - BHO: (no name) - {C2E9F82D-7835-492C-892A-AFA2301AF6E5} - (no file)
O2 - BHO: (no name) - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - (no file)
O2 - BHO: (no name) - {dbabe930-af45-434f-ab22-447a3304be5b} - (no file)

O4 - HKLM\..\Run: [BM313e2b3d] Rundll32.exe "C:\WINDOWS\system32\dvvyffhh.dll",s
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\pprvrqjy.dll",b

O20 - Winlogon Notify: ljjkifc - C:\WINDOWS\


____________

recolle un hijckhtis et antivir a plus

Pandorea · Answer

Hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:33:24, on 27/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DNA\btdna.exe
D:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cidaemon.exe
E:\Opendisc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.gaiaonline.com/?login_success=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BluetoothAuthorizationAgent] C:\WINDOWS\system32\BluetoothAuthorizationAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Pandore\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Pandorea · Answer

antivir : Avira AntiVir Personal Report file date: dimanche 27 avril 2008 16:11 Scanning for 1237787 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: BOITEDEPANDORE Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 16/04/2008 11:58:46 AVSCAN.DLL : 8.1.1.0 53505 Bytes 16/04/2008 11:58:46 LUKE.DLL : 8.1.2.9 151809 Bytes 16/04/2008 11:58:46 LUKERES.DLL : 8.1.2.1 12033 Bytes 16/04/2008 11:58:46 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:16 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 08:29:00 ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 22/04/2008 14:33:04 ANTIVIR3.VDF : 7.0.3.216 137216 Bytes 25/04/2008 09:54:00 Engineversion : 8.1.0.35 AEVDF.DLL : 8.1.0.5 102772 Bytes 16/04/2008 11:58:46 AESCRIPT.DLL : 8.1.0.27 233851 Bytes 25/04/2008 09:54:34 AESCN.DLL : 8.1.0.14 119156 Bytes 19/04/2008 11:56:54 AERDL.DLL : 8.1.0.20 418165 Bytes 25/04/2008 09:54:32 AEPACK.DLL : 8.1.1.2 364917 Bytes 19/04/2008 11:56:54 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 19/04/2008 11:56:52 AEHEUR.DLL : 8.1.0.20 1196406 Bytes 25/04/2008 09:54:26 AEHELP.DLL : 8.1.0.14 115063 Bytes 19/04/2008 11:56:50 AEGEN.DLL : 8.1.0.18 299381 Bytes 25/04/2008 09:54:12 AEEMU.DLL : 8.1.0.5 430450 Bytes 16/04/2008 11:58:46 AECORE.DLL : 8.1.0.27 168310 Bytes 19/04/2008 11:56:48 AVWINLL.DLL : 1.0.0.7 14593 Bytes 16/04/2008 11:58:46 AVPREF.DLL : 8.0.0.1 25857 Bytes 16/04/2008 11:58:46 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVREG.DLL : 8.0.0.0 30977 Bytes 16/04/2008 11:58:46 AVARKT.DLL : 1.0.0.23 307457 Bytes 16/04/2008 11:58:46 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 16/04/2008 11:58:46 SQLITE3.DLL : 3.3.17.1 339968 Bytes 16/04/2008 11:58:46 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 16/04/2008 11:58:46 NETNT.DLL : 8.0.0.1 7937 Bytes 16/04/2008 11:58:46 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 16/04/2008 11:58:40 RCTEXT.DLL : 8.0.32.0 86273 Bytes 16/04/2008 11:58:40 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: C:, D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: dimanche 27 avril 2008 16:11 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned Scan process 'cidaemon.exe' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'CLI.EXE' - '1' Module(s) have been scanned Scan process 'CLI.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'emule.exe' - '1' Module(s) have been scanned Scan process 'bittorrent.exe' - '1' Module(s) have been scanned Scan process 'btdna.exe' - '1' Module(s) have been scanned Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned Scan process 'MsnMsgr.Exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'admtray.exe' - '1' Module(s) have been scanned Scan process 'ElkCtrl.exe' - '1' Module(s) have been scanned Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned Scan process 'QtZgAcer.EXE' - '1' Module(s) have been scanned Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned Scan process 'eDSloader.exe' - '1' Module(s) have been scanned Scan process 'CLI.EXE' - '1' Module(s) have been scanned Scan process 'PCMService.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'Monitor.exe' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'ALG.EXE' - '1' Module(s) have been scanned Scan process 'CLSched.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'CLMLService.exe' - '1' Module(s) have been scanned Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned Scan process 'CISVC.EXE' - '1' Module(s) have been scanned Scan process 'admServ.exe' - '1' Module(s) have been scanned Scan process 'GUARD.EXE' - '0' Module(s) have been scanned Scan process 'SCHED.EXE' - '1' Module(s) have been scanned Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'LSASS.EXE' - '1' Module(s) have been scanned Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned Scan process 'SMSS.EXE' - '1' Module(s) have been scanned 67 processes with 67 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. C:\WINDOWS\system32\WLCtrl32.dll [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [NOTE] The file was moved to '485789f7.qua'! The registry was scanned ( '42' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\hiberfil.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\Wju57.sys [WARNING] The file could not be opened! C:\System Volume Information\_restore{DA93E6EB-CF98-47EB-B731-377A4E5ABEC4}\RP22\A0009791.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [NOTE] The file was moved to '484495d6.qua'! Begin scan in 'D:\' End of the scan: dimanche 27 avril 2008 17:08 Used time: 56:39 min The scan has been done completely. 6973 Scanning directories 374573 Files were scanned 2 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 2 files were moved to quarantine 0 files were renamed 4 Files cannot be scanned 374571 Files not concerned 7037 Archives were scanned 4 Warnings 2 Notes

jlpjlp · Answer

ok
vire ce qui est en quarantaine dans antivir, désactive ta restauration systeme puis redemarre l'ordi puis réactive là
et verifie que antivir ne trouve rien


si rien c'est bon!!!

Pandorea · Answer

Il y a eut quelques alertes mais rien d'autres. Je mets quand même le rapport : Avira AntiVir Personal Report file date: dimanche 27 avril 2008 22:17 Scanning for 1237787 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: BOITEDEPANDORE Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 16/04/2008 11:58:46 AVSCAN.DLL : 8.1.1.0 53505 Bytes 16/04/2008 11:58:46 LUKE.DLL : 8.1.2.9 151809 Bytes 16/04/2008 11:58:46 LUKERES.DLL : 8.1.2.1 12033 Bytes 16/04/2008 11:58:46 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:16 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 08:29:00 ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 22/04/2008 14:33:04 ANTIVIR3.VDF : 7.0.3.216 137216 Bytes 25/04/2008 09:54:00 Engineversion : 8.1.0.35 AEVDF.DLL : 8.1.0.5 102772 Bytes 16/04/2008 11:58:46 AESCRIPT.DLL : 8.1.0.27 233851 Bytes 25/04/2008 09:54:34 AESCN.DLL : 8.1.0.14 119156 Bytes 19/04/2008 11:56:54 AERDL.DLL : 8.1.0.20 418165 Bytes 25/04/2008 09:54:32 AEPACK.DLL : 8.1.1.2 364917 Bytes 19/04/2008 11:56:54 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 19/04/2008 11:56:52 AEHEUR.DLL : 8.1.0.20 1196406 Bytes 25/04/2008 09:54:26 AEHELP.DLL : 8.1.0.14 115063 Bytes 19/04/2008 11:56:50 AEGEN.DLL : 8.1.0.18 299381 Bytes 25/04/2008 09:54:12 AEEMU.DLL : 8.1.0.5 430450 Bytes 16/04/2008 11:58:46 AECORE.DLL : 8.1.0.27 168310 Bytes 19/04/2008 11:56:48 AVWINLL.DLL : 1.0.0.7 14593 Bytes 16/04/2008 11:58:46 AVPREF.DLL : 8.0.0.1 25857 Bytes 16/04/2008 11:58:46 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVREG.DLL : 8.0.0.0 30977 Bytes 16/04/2008 11:58:46 AVARKT.DLL : 1.0.0.23 307457 Bytes 16/04/2008 11:58:46 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 16/04/2008 11:58:46 SQLITE3.DLL : 3.3.17.1 339968 Bytes 16/04/2008 11:58:46 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 16/04/2008 11:58:46 NETNT.DLL : 8.0.0.1 7937 Bytes 16/04/2008 11:58:46 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 16/04/2008 11:58:40 RCTEXT.DLL : 8.0.32.0 86273 Bytes 16/04/2008 11:58:40 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: C:, D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: dimanche 27 avril 2008 22:17 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned Scan process 'emule.exe' - '1' Module(s) have been scanned Scan process 'bittorrent.exe' - '1' Module(s) have been scanned Scan process 'btdna.exe' - '1' Module(s) have been scanned Scan process 'MsnMsgr.Exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'admtray.exe' - '1' Module(s) have been scanned Scan process 'ElkCtrl.exe' - '1' Module(s) have been scanned Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned Scan process 'QtZgAcer.EXE' - '1' Module(s) have been scanned Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned Scan process 'eDSloader.exe' - '1' Module(s) have been scanned Scan process 'cli.exe' - '1' Module(s) have been scanned Scan process 'PCMService.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'SynTPLpr.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'Monitor.exe' - '1' Module(s) have been scanned Scan process 'ALG.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'CLSched.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'CLMLService.exe' - '1' Module(s) have been scanned Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned Scan process 'CISVC.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'admServ.exe' - '1' Module(s) have been scanned Scan process 'GUARD.EXE' - '0' Module(s) have been scanned Scan process 'SCHED.EXE' - '1' Module(s) have been scanned Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'LSASS.EXE' - '1' Module(s) have been scanned Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned Scan process 'SMSS.EXE' - '1' Module(s) have been scanned 64 processes with 64 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '41' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\hiberfil.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\Wju57.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: dimanche 27 avril 2008 23:20 Used time: 1:03:07 min The scan has been done completely. 6875 Scanning directories 375354 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 4 Files cannot be scanned 375354 Files not concerned 7038 Archives were scanned 4 Warnings 0 Notes OwO Ca veut dire que c'est bon?

jlpjlp · Answer

ok parfait pour verifier fais sdfix:




Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum 












__________________________


sinon pour finir : pour proteger gratos ton ordinateur:






pour protéger gratos ton ordi

securite

mettre un antivirus

AVAST en français ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions:

MalwareByte's Anti-Malware + SPYBOT
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...


--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
zonealarm

-----------

CCLEANER pour effacer les traces de surf
------------
naviguer de preference avec firefox ou opera ou safari moins touchés par les infections

Pandorea · Answer

Désolée pour le retard voilà le rapport :

[b]SDFix: Version 1.177 [/b]
Run by Pandore on 03/05/2008 at 17:56

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Pandore\Bureau\SDFix

[b]Checking Services [/b]:

[b]Name [/b]: 
grande48
yeyqase
WJU57

[b]Path [/b]:
\??\C:\WINDOWS\system32\drivers\grande48.sys 
\??\C:\WINDOWS\system32as\yeyqase.mis 
System32\Drivers\Wju57.sys 

grande48 - Deleted
yeyqase - Deleted
WJU57 - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default Desktop Wallpaper  

Rebooting

Service WJU57 - Deleted

[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\SYSTEM32\EDGNEP.BMP - Deleted
C:\WINDOWS\SYSTEM32\DGJMHK~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\CBMDKJ~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\ELCJQL~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\PGBAH.BMP - Deleted
C:\WINDOWS\SYSTEM32\CFIDKB~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\APKJALCN.BMP - Deleted
C:\WINDOWS\SYSTEM32\DKRITS~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\SNQHGB~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\PGNEDO~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\HKJATC~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\NADORA~1.BMP - Deleted
C:\WINDOWS\SYSTEM32\KJEHCBQD.BMP - Deleted
C:\WINDOWS\SYSTEM32\FIHONQ~1.BMP - Deleted
C:\WINDOWS\antiv.exe  - Deleted
C:\WINDOWS\system32\drivers\hosts  - Deleted
C:\WINDOWS\system32\WLCtrl32.dll  - Deleted
C:\WINDOWS\system32as\yeyqase.mis  - Deleted
C:\WINDOWS\system32\drivers\WJU57.sys - Deleted



Folder C:\Program Files\Helper - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-03 18:06:33
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Acer\Acer Arcade\PCMService.exe"="C:\Program Files\Acer\Acer Arcade\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\World of Warcraft\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"="D:\World of Warcraft\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-2.0.3-frFR-downloader.exe"="D:\World of Warcraft\WoW-2.0.3-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-2.0.3.6299-to-2.0.7.6383-frFR-downloader.exe"="D:\World of Warcraft\WoW-2.0.3.6299-to-2.0.7.6383-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe"="D:\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\World of Warcraft\Repair.exe"="D:\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\Program Files\World of Warcraft\WoW-2.0.3-frFR-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.3-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.7.6383-frFR-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.7.6383-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-2.0.8.6403-to-2.0.10.6448-frFR-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.8.6403-to-2.0.10.6448-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\ABC\abc.exe"="C:\Program Files\ABC\abc.exe:*:Enabled:abc"
"C:\Program Files\World of Warcraft\WoW-2.0.10.6448-to-2.0.12.6546-frFR-downloader.exe"="C:\Program Files\World of Warcraft\WoW-2.0.10.6448-to-2.0.12.6546-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:æTorrent"
"C:\Program Files\Caplio Software\RGateLXP.exe"="C:\Program Files\Caplio Software\RGateLXP.exe:*:Enabled:RICOH Gate La for DSC"
"D:\runblack.exe"="D:\runblack.exe:*:Enabled:lh"
"D:\Warcraft III\Warcraft III.exe"="D:\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Program Files\Kaneva\World of Kaneva\KepClient.exe"="C:\Program Files\Kaneva\World of Kaneva\KepClient.exe:*:Enabled:KEP Game Client"
"C:\Program Files\adslTV\adsltv.exe"="C:\Program Files\adslTV\adsltv.exe:*:Enabled:adsltv"
"C:\Program Files\adslTV\vlc.exe"="C:\Program Files\adslTV\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\Program Files\BitTorrent\bittorrent.exe"="D:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"

[b]Remaining Files [/b]:


File Backups: - C:\DOCUME~1\Pandore\Bureau\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sat  5 Apr 2003         1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
Sat  5 Apr 2003         1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Sat  5 Apr 2003         1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll"
Sat  5 Apr 2003         1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll"
Sat  5 Apr 2003         1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll"
Thu 24 Apr 2008           153 ..SH. --- "C:\WINDOWS\system32\yjqrvrpp.tmp"
Fri 18 Apr 2008     1,529,753 ..SH. --- "C:\WINDOWS\system32\vgqtuuse.tmp"
Sun 20 Apr 2008     1,530,225 ..SH. --- "C:\WINDOWS\system32\gvlgdtch.tmp"
Sun 20 Apr 2008     1,530,285 ..SH. --- "C:\WINDOWS\system32\ovpcgcnr.tmp"
Thu  1 Mar 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat  3 May 2008       103,222 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d9a5b0653e225e7928dc354755296ea7\BIT3.tmp"
Sat  3 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\27351338b61f8a3b1808532ac895046b\BIT4.tmp"
Sat  3 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5f7e6ca31b0549017e70d2963c0f01bb\BIT5.tmp"
Sat  3 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\be5a8d8b4961cdba5d71ff93cd231ba8\BIT6.tmp"
Sat  3 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\56d9570fa70634b6e4c2692a27d72905\BIT7.tmp"
Sat  3 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2d0d9d422195602d1972c095e2379255\BIT8.tmp"
Wed  3 Jan 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 29 May 2007        71,680 ...H. --- "C:\Documents and Settings\Pandore\Bureau\Psycho\S2\Observation\~WRL3696.tmp"
Tue 29 May 2007        71,680 ...H. --- "C:\Documents and Settings\Pandore\Bureau\Psycho\S2\Observation\~WRL3835.tmp"

[b]Finished![/b]

jlpjlp · Answer

analyse ces fichiers sur virus total et si inféctés tu les vire avec otmovit

https://www.virustotal.com/gui/

C:\WINDOWS\system32\vgqtuuse.tmp
C:\WINDOWS\system32\gvlgdtch.tmp
C:\WINDOWS\system32\ovpcgcnr.tmp


voilà cela devrait etre bon!!!!

encore des soucis??

Pandorea · Answer

C'est tout bon et je n'ai plus de soucis! Happy!
XD Marci pour ton aide <333 !!!

jlpjlp · Answer

de rien


lance tools cleaner pour virer ce que je t'ai fais mettre:

http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner





bonne continuation

Pandorea · Answer

Oki oki! Encore merci, bonne continuation :)

Win32:Adware-gen impossible à supprimer

113 réponses

Discussions similaires

Newsletters