Votre question

Trojans : Rapport Hijackthis

Tags :
  • Internet Explorer
  • Sécurité
Dernière réponse : dans Sécurité et virus
7 Juin 2008 21:58:45

Bonjour, j'ai l'impression d'avoir un virus.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:54:57, on 07/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdlite.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.files-ftp.com/~unicorni/phpBB2/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1535.exe 61A847B5BBF7281337983D466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\Run: [MSDisp32] rundll32.exe C:\WINDOWS\system32\drvboc.dll,startup
O4 - HKLM\..\Run: [fc22a562] rundll32.exe "C:\WINDOWS\system32\gsswttnh.dll",b
O4 - HKLM\..\RunOnce: [Regcledtkrn] C:\WINDOWS\system32\Regsvr32.exe /s "C:\Program Files\CyberLink\PowerDirector\cledtkrn.dll"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O17 - HKLM\System\CCS\Services\Tcpip\..\{7DB7D4A6-19B5-4E1F-B8DF-E171841EA9B5}: NameServer = 81.253.149.9 80.10.246.132
O17 - HKLM\System\CS1\Services\Tcpip\..\{7DB7D4A6-19B5-4E1F-B8DF-E171841EA9B5}: NameServer = 81.253.149.9 80.10.246.132
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 7217 bytes

Autres pages sur : trojans rapport hijackthis

8 Juin 2008 09:29:10

J'ai fait une analyse avec mon anti virus.
J'ai bien 3 trojans.

Que dois-je faire svp ? Aidez-moi.
a b 8 Sécurité
8 Juin 2008 12:05:21

Bonjour,

Télécharge MalwareByte's Anti-Malware sur ton Bureau.
Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées, redémarre en mode sans échec.
AIDE : Redémarrer en mode sans échec

  • Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".
  • Afin de lancer la recherche, clic sur"Rechercher".
  • Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
    -- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
    -- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.
    [#ff0000]REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]

    AIDE : Tuto en images sur MBAM
    Contenus similaires
    8 Juin 2008 13:03:50

    Malwarebytes' Anti-Malware 1.15
    Version de la base de données: 839

    12:49:28 08/06/2008
    mbam-log-6-8-2008 (12-49-19).txt

    Type de recherche: Examen complet (C:\|E:\|)
    Eléments examinés: 103709
    Temps écoulé: 2 hour(s), 0 minute(s), 58 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 2
    Clé(s) du Registre infectée(s): 13
    Valeur(s) du Registre infectée(s): 5
    Elément(s) de données du Registre infecté(s): 2
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 16

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    C:\WINDOWS\system32\vtUooNFW.dll (Trojan.Vundo) -> Unloaded module successfully.
    C:\WINDOWS\system32\wvUnOEXP.dll (Trojan.Vundo) -> Unloaded module successfully.

    Clé(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8c387d88-be25-46d1-b415-95d010874997} (Trojan.Vundo) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{8c387d88-be25-46d1-b415-95d010874997} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataDisp32 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{a0b4ffea-d466-49a8-9bb0-b7bbd2fcb449} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a0b4ffea-d466-49a8-9bb0-b7bbd2fcb449} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvunoexp (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fc22a562 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMff1196fe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSDisp32 (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{a0b4ffea-d466-49a8-9bb0-b7bbd2fcb449} (Trojan.Vundo) -> Delete on reboot.

    Elément(s) de données du Registre infecté(s):
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\vtuoonfw -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.vundo) -> Data: c:\windows\system32\vtuoonfw -> Delete on reboot.

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\WINDOWS\system32\gsswttnh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\hnttwssg.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\hlprdfbd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\dbfdrplh.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\vtUooNFW.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\WFNooUtv.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\WFNooUtv.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Deckard\System Scanner\20080608094125\backup\DOCUME~1\fg\LOCALS~1\Temp\win239.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\fg\Local Settings\Temporary Internet Files\Content.IE5\7N7I3ERC\kb713501[1] (Trojan.LowZones) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{742BAA1B-FB27-4FB0-99E0-F11EAB06F9B8}\RP39\A0004235.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\nikvixve.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
    C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sncvsrcn.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drvboc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wvUnOEXP.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
    a b 8 Sécurité
    8 Juin 2008 13:49:47

    Reposte un rapport Hijackthis.
    8 Juin 2008 14:16:28

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:13:22, on 08/06/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    C:\Program Files\Softwin\BitDefender10\bdagent.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.files-ftp.com/~unicorni/phpBB2/index.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: {5c5ccde1-808f-915b-64f4-e25350a9a1d4} - {4d1a9a05-352e-4f46-b519-f8081edcc5c5} - C:\WINDOWS\system32\nlhyscot.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [MSDisp32] rundll32.exe C:\WINDOWS\system32\drvtup.dll,startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7DB7D4A6-19B5-4E1F-B8DF-E171841EA9B5}: NameServer = 80.10.246.1 81.253.149.2
    O17 - HKLM\System\CS1\Services\Tcpip\..\{7DB7D4A6-19B5-4E1F-B8DF-E171841EA9B5}: NameServer = 80.10.246.1 81.253.149.2
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 7414 bytes


    ****

    Je précise quand même que les pubs intempestives sont toujours là, malgré que le malware me dise que les trojan aient été supprimés, et qu'il y a un icone sur ma barre, en bas à droite m'indiquant "Windows Antivirus : Windows has detected a spyware...blablabla", toutes les dix secondes y'a ce message. Et toutes les cinq minutes y'a un deuxième message qui s'affiche en plein milieu de l'écran.
    a b 8 Sécurité
    8 Juin 2008 14:24:52

    Re,

    [#ff0000]Désactive tes protections résidentes (antivirus, Spybot-S&D, etc.) ![/#f]

  • Télécharge ComboFix ([#ff0000]sUBs[/#f]) sur ton Bureau.
  • Double clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
  • Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\combofix.txt*) dans ta prochaine réponse.

    AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
    * le nom de la partition peut changer
    8 Juin 2008 14:59:53

    Re.

    Voici le rapport :

    ComboFix 08-06-07.3 - fg 2008-06-08 14:30:36.1 - NTFSx86
    Endroit: C:\Documents and Settings\fg\Bureau\ComboFix.exe
    * Création d'un nouveau point de restauration

    AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\BMff1196fe.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\drvtup.dll
    C:\WINDOWS\system32\nlhyscot.dll
    C:\WINDOWS\system32\winuqw32.dll
    C:\WINDOWS\system32\wvUnOEXP.dll

    .
    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-08 to 2008-06-08 ))))))))))))))))))))))))))))))))))))
    .

    2008-06-08 14:29 . 2008-06-08 14:29 <REP> d-------- C:\327882R2FWJFW
    2008-06-08 13:14 . 2008-06-08 13:14 <REP> d-------- C:\Program Files\Lavasoft
    2008-06-08 13:14 . 2008-06-08 13:14 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
    2008-06-08 13:14 . 2008-06-08 13:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-06-08 10:39 . 2008-06-08 10:39 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-08 10:39 . 2008-06-08 10:39 <REP> d-------- C:\Documents and Settings\fg\Application Data\Malwarebytes
    2008-06-08 10:39 . 2008-06-08 10:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-08 10:39 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-08 10:39 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-08 09:35 . 2008-06-07 21:54 401,720 --a------ C:\Program Files\fg.exe
    2008-06-08 09:33 . 2008-06-08 09:33 <REP> d-------- C:\Deckard
    2008-06-07 21:54 . 2008-06-07 21:54 401,720 --a------ C:\Program Files\HiJackThis.exe
    2008-06-07 21:49 . 2008-06-08 12:49 281,088 --------- C:\WINDOWS\system32\vtUooNFW.dll
    2008-06-07 21:44 . 2008-06-08 13:01 145 --a------ C:\WINDOWS\system32\winver.bat
    2008-06-07 21:36 . 2008-06-07 21:36 <REP> d-------- C:\Program Files\MSECache
    2008-06-07 21:19 . 2008-06-07 21:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
    2008-06-07 21:01 . 2008-06-07 21:01 <REP> d-------- C:\Documents and Settings\fg\Application Data\CyberLink
    2008-06-07 20:50 . 2008-06-07 20:50 <REP> d-------- C:\Program Files\SmartSound Software
    2008-06-07 20:50 . 2008-06-07 20:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
    2008-06-07 20:48 . 2008-06-07 20:49 <REP> d-------- C:\Program Files\Cyberlink
    2008-06-07 20:47 . 2008-06-07 20:47 <REP> d-------- C:\Program Files\QuickTime
    2008-06-07 20:46 . 2008-06-07 21:09 <REP> d-------- C:\MyWorks
    2008-06-07 20:46 . 2008-06-07 20:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-06-07 20:36 . 2008-06-07 20:36 <REP> d-------- C:\Program Files\Microsoft Works
    2008-06-07 20:35 . 2008-06-07 20:35 <REP> d-------- C:\Program Files\MSBuild
    2008-06-07 20:34 . 2008-06-07 20:34 <REP> d-------- C:\Program Files\Microsoft.NET
    2008-06-07 20:32 . 2008-06-07 20:32 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
    2008-06-07 20:31 . 2008-06-07 20:35 <REP> d-------- C:\WINDOWS\SHELLNEW
    2008-06-07 20:30 . 2008-06-07 20:30 <REP> dr-h----- C:\MSOCache
    2008-06-07 20:30 . 2008-06-07 20:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-06-07 17:36 . 2003-03-15 22:15 90,112 --a------ C:\WINDOWS\unvise32.exe
    2008-06-07 17:34 . 2003-11-21 16:48 65,536 --a------ C:\WINDOWS\system32\MFC71DEU.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 61,440 --a------ C:\WINDOWS\system32\MFC71ITA.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 61,440 --a------ C:\WINDOWS\system32\MFC71FRA.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 61,440 --a------ C:\WINDOWS\system32\MFC71ESP.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 57,344 --a------ C:\WINDOWS\system32\MFC71ENU.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 49,152 --a------ C:\WINDOWS\system32\MFC71KOR.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 49,152 --a------ C:\WINDOWS\system32\MFC71JPN.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 45,056 --a------ C:\WINDOWS\system32\MFC71CHT.DLL
    2008-06-07 17:34 . 2003-11-21 16:48 40,960 --a------ C:\WINDOWS\system32\MFC71CHS.DLL
    2008-06-07 17:30 . 2002-03-19 09:29 14,165 --------- C:\WINDOWS\system32\drivers\Pclepci.sys
    2008-06-07 14:59 . 2008-06-07 15:01 <REP> d-------- C:\Program Files\Dictionnaire
    2008-06-07 14:53 . 2008-06-07 14:53 410 --a------ C:\WINDOWS\MagicTranslator.ini
    2008-06-07 14:49 . 2008-06-07 14:49 <REP> d-------- C:\Documents and Settings\fg\Application Data\Media Player Classic
    2008-06-07 13:41 . 2008-06-07 13:41 <REP> d-------- C:\Documents and Settings\fg\Application Data\dBpoweramp
    2008-06-06 17:12 . 2008-06-06 17:12 <REP> d-------- C:\Documents and Settings\fg\Application Data\Grisoft
    2008-06-06 17:12 . 2008-06-06 17:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-06-06 17:12 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-06-06 17:02 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
    2008-06-06 16:58 . 2008-06-06 16:58 <REP> d-------- C:\WINDOWS\Downloaded Installations
    2008-06-06 16:36 . 2008-06-06 16:36 33,846 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.bmp
    2008-06-06 16:36 . 2008-06-06 16:36 13,783 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
    2008-06-06 16:26 . 2008-06-06 16:26 <REP> d-------- C:\Program Files\K-Lite Codec Pack
    2008-06-06 15:50 . 2008-06-06 15:50 <REP> d-------- C:\Program Files\Illustrate
    2008-06-06 15:50 . 2008-06-06 15:50 <REP> d-------- C:\Documents and Settings\fg\Application Data\AccurateRip
    2008-06-06 15:50 . 2008-06-06 16:29 5,052,280 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
    2008-06-06 13:48 . 2008-06-06 13:48 0 --a------ C:\WINDOWS\nsreg.dat
    2008-06-06 13:39 . 2008-06-06 13:39 <REP> d-------- C:\Program Files\VideoLAN
    2008-06-06 13:39 . 2008-06-06 13:39 <REP> d-------- C:\Documents and Settings\fg\Application Data\vlc
    2008-06-06 07:02 . 2008-06-06 07:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    2008-06-05 23:38 . 2008-06-05 23:38 1,355 --a------ C:\WINDOWS\imsins.BAK
    2008-06-05 23:37 . 2008-06-05 23:37 <REP> d-------- C:\Program Files\MSXML 4.0
    2008-06-05 21:09 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-06-05 21:09 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
    2008-06-05 21:09 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-06-05 20:55 . 2008-06-07 21:18 <REP> dr------- C:\Emule
    2008-06-05 20:14 . 2008-06-06 06:55 <REP> d-------- C:\Documents and Settings\fg\Application Data\Creative
    2008-06-05 20:13 . 2000-05-22 02:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx
    2008-06-05 20:13 . 2006-10-06 00:17 53,248 --------- C:\WINDOWS\Ctregrun.exe
    2008-06-05 20:10 . 2008-06-06 06:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Creative
    2008-06-05 20:10 . 1999-12-12 19:01 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
    2008-06-05 20:10 . 1999-11-17 19:00 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
    2008-06-05 20:09 . 2008-06-05 20:09 <REP> d-------- C:\Program Files\Fichiers communs\Creative
    2008-06-05 20:09 . 2008-06-05 20:11 <REP> d--h----- C:\Program Files\Creative Installation Information
    2008-06-05 20:09 . 2008-06-05 20:13 <REP> d-------- C:\Program Files\Creative
    2008-06-05 20:08 . 2008-06-05 20:08 <REP> d-------- C:\WINDOWS\system32\LogFiles
    2008-06-05 20:08 . 2008-06-05 20:13 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-06-05 20:00 . 2008-06-05 20:00 <REP> d-------- C:\Program Files\PhotoFiltre Studio
    2008-06-05 20:00 . 2008-06-05 20:00 45 ---h----- C:\WINDOWS\dsez8064.dat
    2008-06-05 19:58 . 2008-06-05 19:58 <REP> d-------- C:\Program Files\CCleaner
    2008-06-05 19:10 . 2008-06-07 13:39 <REP> d-------- C:\Program Files\MP3Gain
    2008-06-05 19:08 . 2008-06-05 19:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Pinnacle VideoSpin
    2008-06-05 19:01 . 2008-06-07 18:35 <REP> d-------- C:\Program Files\Pinnacle
    2008-06-05 19:01 . 2008-06-05 19:01 <REP> d-------- C:\Program Files\Fichiers communs\Yahoo!
    2008-06-05 19:01 . 2008-06-05 19:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\VideoSpin
    2008-06-05 18:59 . 2008-06-05 18:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Pinnacle
    2008-06-05 18:29 . 2008-06-05 18:29 <REP> d-------- C:\WINDOWS\Sun
    2008-06-05 18:26 . 2008-06-07 21:41 <REP> d-------- C:\Program Files\eMule
    2008-06-05 18:24 . 2008-06-05 18:24 <REP> d-------- C:\Program Files\Messenger Plus! Live
    2008-06-05 18:18 . 2008-06-05 18:18 <REP> d---s---- C:\Documents and Settings\fg\UserData
    2008-06-05 17:22 . 2008-06-05 17:22 244 --ah----- C:\sqmnoopt19.sqm
    2008-06-05 17:22 . 2008-06-05 17:22 244 --ah----- C:\sqmnoopt18.sqm
    2008-06-05 17:22 . 2008-06-05 17:22 244 --ah----- C:\sqmnoopt17.sqm
    2008-06-05 17:22 . 2008-06-05 17:22 244 --ah----- C:\sqmnoopt16.sqm
    2008-06-05 17:22 . 2008-06-05 17:22 232 --ah----- C:\sqmdata19.sqm
    2008-06-05 17:22 . 2008-06-05 17:22 232 --ah----- C:\sqmdata18.sqm
    2008-06-05 17:22 . 2008-06-05 17:22 232 --ah----- C:\sqmdata17.sqm
    2008-06-05 17:22 . 2008-06-05 17:22 232 --ah----- C:\sqmdata16.sqm
    2008-06-05 17:20 . 2008-06-05 17:20 244 --ah----- C:\sqmnoopt15.sqm
    2008-06-05 17:20 . 2008-06-05 17:20 232 --ah----- C:\sqmdata15.sqm
    2008-06-05 17:16 . 2008-06-05 17:16 244 --ah----- C:\sqmnoopt14.sqm
    2008-06-05 17:16 . 2008-06-05 17:16 244 --ah----- C:\sqmnoopt13.sqm
    2008-06-05 17:16 . 2008-06-05 17:16 232 --ah----- C:\sqmdata14.sqm
    2008-06-05 17:16 . 2008-06-05 17:16 232 --ah----- C:\sqmdata13.sqm
    2008-06-05 17:14 . 2008-06-05 17:14 244 --ah----- C:\sqmnoopt12.sqm
    2008-06-05 17:14 . 2008-06-05 17:14 244 --ah----- C:\sqmnoopt11.sqm
    2008-06-05 17:14 . 2008-06-05 17:14 232 --ah----- C:\sqmdata12.sqm
    2008-06-05 17:14 . 2008-06-05 17:14 232 --ah----- C:\sqmdata11.sqm
    2008-06-05 17:13 . 2008-06-05 17:13 244 --ah----- C:\sqmnoopt10.sqm
    2008-06-05 17:13 . 2008-06-05 17:13 244 --ah----- C:\sqmnoopt09.sqm
    2008-06-05 17:13 . 2008-06-05 17:13 232 --ah----- C:\sqmdata10.sqm
    2008-06-05 17:13 . 2008-06-05 17:13 232 --ah----- C:\sqmdata09.sqm
    2008-06-05 17:12 . 2008-06-05 17:12 244 --ah----- C:\sqmnoopt08.sqm
    2008-06-05 17:12 . 2008-06-05 17:12 232 --ah----- C:\sqmdata08.sqm
    2008-06-05 17:11 . 2008-06-05 17:11 244 --ah----- C:\sqmnoopt07.sqm
    2008-06-05 17:11 . 2008-06-05 17:11 232 --ah----- C:\sqmdata07.sqm
    2008-06-05 17:10 . 2008-06-05 17:10 244 --ah----- C:\sqmnoopt06.sqm
    2008-06-05 17:10 . 2008-06-05 17:10 232 --ah----- C:\sqmdata06.sqm
    2008-06-05 17:09 . 2008-06-05 17:09 244 --ah----- C:\sqmnoopt05.sqm
    2008-06-05 17:09 . 2008-06-05 17:09 244 --ah----- C:\sqmnoopt04.sqm
    2008-06-05 17:09 . 2008-06-05 17:09 244 --ah----- C:\sqmnoopt03.sqm
    2008-06-05 17:09 . 2008-06-05 17:09 232 --ah----- C:\sqmdata05.sqm
    2008-06-05 17:09 . 2008-06-05 17:09 232 --ah----- C:\sqmdata04.sqm
    2008-06-05 17:09 . 2008-06-05 17:09 232 --ah----- C:\sqmdata03.sqm
    2008-06-05 17:08 . 2008-06-05 17:08 244 --ah----- C:\sqmnoopt02.sqm

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-08 12:18 7,415 ----a-w C:\Program Files\hijackthis.log
    2008-06-06 15:03 --------- d-----w C:\Program Files\Fichiers communs\Adobe
    2008-06-04 16:31 --------- d-----w C:\Documents and Settings\fg\Application Data\Bitdefender
    2008-06-04 16:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\BitDefender
    2008-06-04 16:27 --------- d-----w C:\Program Files\Softwin
    2008-06-04 16:27 --------- d-----w C:\Program Files\Fichiers communs\Softwin
    2008-06-04 14:16 --------- d-----w C:\Program Files\microsoft frontpage
    2008-06-04 14:14 --------- d-----w C:\Program Files\Services en ligne
    2008-05-03 03:46 6,554,496 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
    2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
    2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
    "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 11:03 868352]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088]
    "nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016]
    "SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2007-04-02 16:48 290816]
    "BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49 69632]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
    "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
    "CTCheck"="C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 11:08 397312]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-06-07 20:47 282624]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=sockspy.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
    "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=
    "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
    "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
    "C:\\Program Files\\eMule\\emule.exe"=
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "C:\\Program Files\\Cyberlink\\PowerDirector\\PDR.exe"=
    "C:\\WINDOWS\\system32\\winver.exe"=


    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-08 14:48:03
    Windows 5.1.2600 Service Pack 2 NTFS

    Balayage processus cach‚s ...

    Balayage cach‚ autostart entries ...

    Balayage des fichiers cach‚s ...

    Scan termin‚ avec succŠs
    Les fichiers cach‚s: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTSVCCDA.EXE
    C:\WINDOWS\system32\FTRTSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\system32\ALERTM~1\ALERTM~1.EXE
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    .
    **************************************************************************
    .
    Temps d'accomplissement: 2008-06-08 14:52:51 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-08 12:52:34

    Pre-Run: 35,753,254,912 octets libres
    Post-Run: 35,941,756,928 octets libres

    238 --- E O F --- 2008-06-05 21:39:49
    a b 8 Sécurité
    8 Juin 2008 15:10:14

    Reposte un rapport Hijackthis.
    8 Juin 2008 15:16:14

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:15, on 08/06/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    C:\Program Files\Softwin\BitDefender10\bdagent.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\Program Files\Softwin\BitDefender10\vsserv.exe
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Cyberlink\PowerDirector\PDR.exe
    C:\Program Files\eMule\emule.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
    O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
    O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7DB7D4A6-19B5-4E1F-B8DF-E171841EA9B5}: NameServer = 81.253.149.9 80.10.246.132
    O17 - HKLM\System\CS1\Services\Tcpip\..\{7DB7D4A6-19B5-4E1F-B8DF-E171841EA9B5}: NameServer = 81.253.149.9 80.10.246.132
    O17 - HKLM\System\CS2\Services\Tcpip\..\{7DB7D4A6-19B5-4E1F-B8DF-E171841EA9B5}: NameServer = 80.10.246.1 81.253.149.2
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 7516 bytes
    a b 8 Sécurité
    8 Juin 2008 16:55:00

    Même problème ?
    8 Juin 2008 17:32:22

    Tout est rentré dans l'ordre !
    Merci beaucoup !
    a b 8 Sécurité
    8 Juin 2008 17:32:53

    Bon surf.
    8 Juin 2008 21:20:25

    AVG a découvert une menace : C:\WINDOWS\system32/svchost.exe
    Je n'arrive pas à le supprimer de l'ordi.
    Il s'agit de Trojan Horse Delf.DOQ
    8 Juin 2008 22:37:35

    J'ai fait un scan et l'anti virus n'a rien trouvé. Donc c'est bizarre.
    a b 8 Sécurité
    9 Juin 2008 13:54:02

    C'est un bug. Il ne faut pas toucher à ce fichier !
    Tom's guide dans le monde
    • Allemagne
    • Italie
    • Irlande
    • Royaume Uni
    • Etats Unis
    Suivre Tom's Guide
    Inscrivez-vous à la Newsletter
    • ajouter à twitter
    • ajouter à facebook
    • ajouter un flux RSS