Problemme avec SystemeDefender.com

[darkspeeds]

Bonjour,
J'ai le même probleme que Akinator > http://www.pc-infopratique.com/forum-in ... tml#249516
Cette page la> http://www.system-defender.com/freeware ... id=37&p=01 ne fait que s'fficher...
Et j'espèrais que vous pouviez m'aidez.


Voici le raport fait par hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:41:18, on 16/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
C:Program FilesWIDCOMMLogiciel Bluetoothintwdins.exe
C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
C:Program FilesJavajre1.6.0_05injusched.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSTwain_32USB2.0CameraSnapTrap.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.EXE
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesFichiers communsAheadlibNMBgMonitor.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Program FilesMessengermsmsgs.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Program FilesWIDCOMMLogiciel BluetoothBTTray.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:PROGRA~1WIDCOMMLOGICI~1BTSTAC~1.EXE
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {e802027b-1f2b-40bd-b307-0bd96d036835} - (no file)
O2 - BHO: (no name) - {3BB16E16-7954-441A-AA0D-189203856A93} - C:WINDOWSsystem32jkkKeeBT.dll (file missing)
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:PROGRA~1VMNTOO~1VMNTOO~1.DLL
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:Program FilesCanonEasy-WebPrintEWPBrowseLoader.dll
O2 - BHO: (no name) - {73984FE0-9702-4C55-9C7B-9BA3C5861F25} - C:WINDOWSsystem32yXPJDwW.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_05inssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.1.1119.1736swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:Program FilesCanonEasy-WebPrintToolband.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:PROGRA~1VMNTOO~1VMNTOO~1.DLL
O3 - Toolbar: (no name) - {e802027b-1f2b-40bd-b307-0bd96d036835} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:Program FilesDAEMON Tools ToolbarDTToolbar.dll
O3 - Toolbar: sqvgnrpx - {9437C997-89E6-4B84-A745-BEFD3A910FF5} - C:WINDOWSsqvgnrpx.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar1.dll
O4 - HKLM..Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_05injusched.exe"
O4 - HKLM..Run: [SSBkgdUpdate] "C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" -Embedding -boot
O4 - HKLM..Run: [OpwareSE4] "C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe"
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [STICAP] C:WINDOWSTwain_32USB2.0CameraSnapTrap.exe
O4 - HKLM..Run: [StartCCC] "C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [Hold option boob bin] C:Documents and SettingsAll UsersApplication Dataford does hold option oad eggs.exe
O4 - HKLM..Run: [antiviirus] C:Program Filesantiviirus.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:Program FilesFichiers communsAheadlibNMBgMonitor.exe"
O4 - HKCU..Run: [First Plan] C:DOCUME~1GUILLA~1APPLIC~1ARMYIN~1Movebias.exe
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Preview.html
O8 - Extra context menu item: Envoyer à &Bluetooth - C:Program FilesWIDCOMMLogiciel Bluetoothtsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:Program FilesWIDCOMMLogiciel Bluetoothtsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:Program FilesWIDCOMMLogiciel Bluetoothtsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/re ... NPUpld.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5014118691
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005 ... scan53.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Registe ... lashax.cab
O20 - Winlogon Notify: byXPJDwW - byXPJDwW.dll (file missing)
O21 - SSODL: fdxbameg - {2493F2CE-B6B9-4662-8051-B9C90BD07F26} - (no file)
O21 - SSODL: fsrpknov - {231F40B2-48F5-488E-8C47-B289D229F532} - C:WINDOWSfsrpknov.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:Program FilesWIDCOMMLogiciel Bluetoothintwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesFichiers communsInstallShieldDriver1150Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:Program Filesma-config.commaconfservice.exe

--
End of file - 10952 bytes



Merci de votre aide.

M.A.J: Pourtant avec IE j'ai bloquer cette fenêtre. mais elle continue a s'afficher.

[DouDou9455]

Bonjour,

A fixer :

O4 - HKLM..Run: [Hold option boob bin] C:Documents and SettingsAll UsersApplication Dataford does hold option oad eggs.exe

O4 - HKLM..Run: [antiviirus] C:Program Filesantiviirus.exe

O4 - HKCU..Run: [First Plan] C:DOCUME~1GUILLA~1APPLIC~1ARMYIN~1Movebias.exe

[darkspeeds]

Ce sont les lignes a supprimé?

[DouDou9455]

Oui

[darkspeeds]

Voilà c'est fait merci.

[DouDou9455]

Now suis ce dossier nettoyage, une fois cela fait dit nous si tu a toujours tes pub

[darkspeeds]

Merci, j'ai tout fait et sa marche parfaitement maintenant^^
Juste un probleme pour la defragmentation:
Elle ne marche plus.
Quand j'analyse avec le defragmentateur et ben j'ai un message d'erreurs :
-"La défragmentation de (C: ) a été abandonnée en raison d'incohérences détéctés dans le système de fichiers. Exécutez CHKDSK ou SCANDISK sur (C: ) pour réparer les incohérences, puis relancez le défragmentateur de disque."

[darkspeeds]

Sa se trouve ou scandisk?^^ svp

[DouDou9455]

Un petit coup d'oeil .::ICI::. et tout devrait rentrer dans l'ordre

[darkspeeds]

A ouai tout de suite c'est beaucoup mieu!! Merci a vous tous!
/kiss aux femmes^^
Et un grand merci a tout ceux qui mon aidé!
Site exelent continué comme sa!

[DouDou9455]

Content que tout soit rentré dans l'ordre.
Peut - tu mettre un [Réglé] dans le titre de ton premier poste en l'éditant
Comme çà c'est clerc.
Merci

[r@in | b0w]

Bonjour.

Je pense que l'infection est encore active et il y a des traces de Vundo (certaines obsolètes mais d'autres encore d'actualité) ainsi que d'un trojan.

1_ ComboFix:

Tu télécharges ComboFix.exe.

Tu le lances ensuite en double cliquant dessus, tu confirmes l'ouverture en cliquant sur Exécuter.

A la fenêtre Disclaimer, tu tapes sur [1].

L'analyse se lancera par la suite avec création d'un point de restauration et sauvegarde des fichiers Windows.
Patientes, ComboFix nettoie en 41 étapes.

Tu ne t'inquiètes surtout pas, il se charge de tout.
Laisse-le faire et suis bien les instructions à l'écran, il est possible qu'il te demande de redémarrer.

Surtout, tant que tu n'as pas un message de ComboFix t'informant que le ménage est terminé, tu ne fais rien de plus que ce que l'utilitaire t'indique, c'est important car il peut être long mais travaille efficacement.

Quand tout sera fini, tu liras:

Code: Tout sélectionner

Almost done... This window will close in a short while
Please wait a few seconds for the report log to pop up

ComboFix's log shall be located at C:ComboFix.txt

Normalement, le rapport s'ouvrira dans le Bloc-notes, tu nous copies-colles l'intégralité du fichier.
Si le Bloc-notes ne s'ouvre pas, tu iras chercher le rapport ici: C:ComboFix.txt et tu nous le colles dans ton prochain message.

2_ Tu télécharges SmitFraudix.

Tu redémarres en Mode sans échec ([F8] au démarrage).

Tu te logges ensuite sur ta session puis tu lances SmitFraudix.

Tu appuis sur la touche [2] puis [Entrée].
Si tu as une ligne demandant le nettoyage de la base de registre, appuies sur la touche [O] - pour Oui.

Quand l'analyse sera finie, un rapport sera généré.
Tu l'enregistres car il n'est pas sauvegardé par défaut.

3_ Tu fais un nouveau scan HiJackThis pour voir l'évolution.

[darkspeeds]

Re,
Tout d'abord désolé de n'avoir pas répondu plus tot mais je suis parti une semaine en vacances...
donc voilà la réponse a combofix:


ComboFix 08-07-18.1 - Guillaume 2008-07-27 23:10:45.1 - NTFSx86
Microsoft Windows XP Edition familiale 5.1.2600.2.1252.1.1036.18.361 [GMT 2:00]
Endroit: C:Mes téléchargementsComboFix.exe

AVERTISSEMENT - LA CONSOLE DE RECUPERATION N'EST PAS INSTALLEE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:Documents and SettingsGuillaumeApplication Dataaddon.dat
C:Documents and SettingsGuillaume
ew.txt
C:WINDOWScookies.ini
C:WINDOWSegxk.exe
C:WINDOWSgpefaowr.exe
C:WINDOWSsystem32kgewlrte.ini
C:WINDOWSsystem32
acmqkwu.ini
C:WINDOWSsystem32
poxlftn.ini
C:WINDOWSsystem32omkhcjtc.ini
C:WINDOWSsystem32TBeeKkkj.ini
C:WINDOWSsystem32TBeeKkkj.ini2
C:WINDOWSsystem32xmsxqtos.ini

.
((((((((((((((((((((((((((((( Fichiers cr,,s 2008-06-27 to 2008-07-27 ))))))))))))))))))))))))))))))))))))
.

2008-07-16 16:36 . 2008-07-16 16:38 308 --a------ C:WINDOWSwininit.ini
2008-07-16 15:54 . 2008-07-16 20:04 <REP> d-------- C:Program FilesSpybot - Search & Destroy
2008-07-16 15:54 . 2008-07-16 20:04 <REP> d-------- C:Documents and SettingsAll UsersApplication DataSpybot - Search & Destroy
2008-07-16 15:34 . 2008-07-16 15:34 <REP> d-------- C:Program FilesToniArts
2008-07-16 12:39 . 2008-07-16 12:39 <REP> d-------- C:Program FilesTrend Micro
2008-07-16 10:53 . 2008-07-16 10:53 <REP> d-------- C:Documents and SettingsGuillaumeLogs
2008-07-15 16:18 . 2008-07-15 16:17 25,294,781 --a------ C:WINDOWSLPT$VPN.407
2008-07-15 16:16 . 2008-07-15 16:17 25,294,781 --a------ C:WINDOWSVPTNFILE.407
2008-07-15 16:15 . 2008-07-15 16:17 <REP> d-------- C:WINDOWSAU_Temp
2008-07-09 21:42 . 2008-07-27 23:01 <REP> d-------- C:Documents and SettingsAll UsersApplication DataGoogle Updater
2008-07-09 18:02 . 2008-07-09 18:02 <REP> d-------- C:Documents and SettingsAll UsersApplication DataNFS Underground
2008-07-09 18:01 . 2008-07-09 18:01 <REP> d-------- C:Program FilesFichiers communsDirectX
2008-07-09 17:52 . 2008-07-10 12:03 <REP> d-------- C:Program FilesRegistry Defender Platinum
2008-07-09 12:30 . 2008-07-09 12:29 102,664 --a------ C:WINDOWSsystem32drivers mcomm.sys
2008-07-09 12:29 . 2008-07-09 12:30 <REP> d-------- C:Documents and SettingsGuillaume.housecall6.6
2008-07-09 07:12 . 2008-07-09 17:51 <REP> d-------- C:WINDOWSsystem32778670
2008-07-09 01:19 . 2008-07-09 18:05 <REP> d-------- C:Program FilesEA GAMES
2008-07-09 01:04 . 2008-07-09 12:07 <REP> d-------- C:Program FilesDAEMON Tools Toolbar
2008-07-02 08:48 . 2008-07-02 08:48 <REP> d-------- C:Program FilesValve Software
2008-06-30 21:18 . 2008-06-30 21:18 <REP> d-------- C:Program FilesArmy Inter Build

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 21:03 --------- d-----w C:Program FilesJava
2008-07-18 16:50 --------- d-----w C:Documents and SettingsGuillaumeApplication Data eamspeak2
2008-07-17 17:14 --------- d-----w C:Documents and SettingsGuillaumeApplication Datavmntoolbar
2008-07-17 16:33 --------- d-----w C:Documents and SettingsGuillaumeApplication DataArmy Inter Build
2008-07-16 13:40 --------- d-----w C:Program FilesNvu
2008-07-16 13:40 --------- d-----w C:Program FileseMule
2008-07-16 13:40 --------- d-----w C:Documents and SettingsGuillaumeApplication DataLimeWire
2008-07-16 13:40 --------- d-----w C:Documents and SettingsGuillaumeApplication DataAzureus
2008-07-16 13:34 --------- d--h--w C:Program FilesInstallShield Installation Information
2008-07-16 07:53 --------- d-----w C:Program FilesWorld of Warcraft
2008-07-15 14:17 91,744 -c--a-w C:WINDOWSBPMNT.dll
2008-07-15 14:17 1,213,784 -c--a-w C:WINDOWSvsapi32.dll
2008-07-09 19:52 --------- d-----w C:Program FilesGoogle
2008-07-09 10:33 71,749 -c--a-w C:WINDOWShcextoutput.dll
2008-07-09 10:33 333,576 -c--a-w C:WINDOWS sc.exe
2008-07-09 07:36 --------- d-----w C:Program Filesvmntoolbar
2008-07-03 22:59 --------- d-----w C:Program FilesAzureus
2008-06-30 19:19 --------- d-----w C:Documents and SettingsPascaleApplication DataArmy Inter Build
2008-06-30 19:19 --------- d-----w C:Documents and SettingsAll UsersApplication Dataford does hold option
2008-06-25 15:32 --------- d-----w C:Program FilesSafari
2008-06-22 12:41 --------- d-----w C:Program FilesWrath of the Lich King Friends and Family Alpha
2008-06-18 10:29 --------- d---a-w C:Documents and SettingsAll UsersApplication DataTEMP
2008-06-15 03:01 --------- d-----w C:Program FilesElectronic Arts
2008-06-14 17:59 272,768 ------w C:WINDOWSsystem32driversthport.sys
2008-06-04 10:58 --------- d-----w C:Program FilesiVideo
2008-06-04 10:51 --------- d-----w C:Program FilesCircle Developement
2008-05-29 16:36 --------- d-----w C:Program FilesAstroburnBar
2008-05-29 16:28 --------- d-----w C:Documents and SettingsGuillaumeApplication DataAstroburn
2008-05-28 19:19 --------- d-----w C:Program Fileslol
.

Code: Tout sélectionner

<pre>
----a-w             5,418 2008-07-09 00:02:31  C:Documents and SettingsGuillaumeBureauNeed for Speed Underground[PC 2CD][Spanish]Serial + Crack [www.newpct.com]K E Y G E N .exe
</pre>

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ,l,ments vides & les ,l,ments initiaux l,gitimes ne sont pas list,s

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"= "C:Program FilesDAEMON Tools ToolbarDTToolbar.dll" [2008-07-08 17:59 683464]

[HKEY_CLASSES_ROOTclsid{32099aac-c132-4136-9e9a-4e364a424e17}]
[HKEY_CLASSES_ROOTDTToolbar.ToolBandObj.1]
[HKEY_CLASSES_ROOTTypeLib{3E288F79-03E4-4983-A48E-0D879B51FF19}]
[HKEY_CLASSES_ROOTDTToolbar.ToolBandObj]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
"{32099AAC-C132-4136-9E9A-4E364A424E17}"= "C:Program FilesDAEMON Tools ToolbarDTToolbar.dll" [2008-07-08 17:59 683464]

[HKEY_CLASSES_ROOTclsid{32099aac-c132-4136-9e9a-4e364a424e17}]
[HKEY_CLASSES_ROOTDTToolbar.ToolBandObj.1]
[HKEY_CLASSES_ROOTTypeLib{3E288F79-03E4-4983-A48E-0D879B51FF19}]
[HKEY_CLASSES_ROOTDTToolbar.ToolBandObj]

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"ctfmon.exe"="C:WINDOWSsystem32ctfmon.exe" [2004-08-05 14:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:Program FilesFichiers communsAheadlibNMBgMonitor.exe" [2005-10-28 16:25 94208]
"MSMSGS"="C:Program FilesMessengermsmsgs.exe" [2004-10-13 18:24 1694208]
"swg"="C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe" [2008-07-09 21:43 68856]
"First Plan"="C:DOCUME~1GUILLA~1APPLIC~1ARMYIN~1Movebias.exe" [N/A]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"SunJavaUpdateSched"="C:Program FilesJavajre1.6.0_07injusched.exe" [2008-06-10 04:27 144784]
"SSBkgdUpdate"="C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" [2003-09-30 01:14 155648]
"OpwareSE4"="C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe" [2006-03-21 14:19 69632]
"NeroFilterCheck"="C:WINDOWSsystem32NeroCheck.exe" [2001-07-09 10:50 155648]
"STICAP"="C:WINDOWSTwain_32USB2.0CameraSnapTrap.exe" [2004-11-05 09:59 155648]
"StartCCC"="C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2006-11-10 12:35 90112]
"Adobe Reader Speed Launcher"="C:Program FilesAdobeReader 8.0ReaderReader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:Program FilesQuickTimeQTTask.exe" [2008-03-28 23:37 413696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 18:07 61952 C:WINDOWSsystem32HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 17:58 16264192 C:WINDOWSRTHDCPL.exe]

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileAuthorizedApplicationsList]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"C:\Program Files\HLSW\hlsw.exe"=
"C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.12.6546-frFR-downloader.exe"=
"C:\Program Files\World of Warcraft\WoW-2.0.3.6299-to-2.0.10.6448-frFR-downloader.exe"=
"C:\Program Files\World of Warcraft\WoW-2.0.3-frFR-downloader.exe"=
"C:\Program Files\World of Warcraft\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"=
"C:\Program Files\World of Warcraft\WoW-1.12.0.5595-to-1.12.1.5875-frFR-downloader.exe"=
"C:\Program Files\World of Warcraft\WoW-1.12.0-frFR-downloader.exe"=
"C:\Program Files\Valve\Steam\SteamApps\darkspeed81\counter-strike source\hl2.exe"=
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"C:\Program Files\Windows Live\Messenger\livecall.exe"=
"C:\Program Files\iTunes\iTunes.exe"=

[HKLM~servicessharedaccessparametersfirewallpolicystandardprofileGloballyOpenPortsList]
"12919:TCP"= 12919:TCP:*:Disabled:emule
"12942:UDP"= 12942:UDP:*:Disabled:emulme
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 aswSP;avast! Self Protection;C:WINDOWSsystem32driversaswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;C:WINDOWSsystem32DRIVERSaswFsBlk.sys [2008-07-19 16:37]
R3 fbxusb;Carte réseau virtuelle FreeBox USB;C:WINDOWSsystem32DRIVERSfbxusb32.sys [2004-10-20 14:23]
S3 apmbatt;Pilote de batterie APM hérité Microsoft;C:WINDOWSsystem32DRIVERSapmbatt.sys [2004-08-05 14:00]
S3 maconfservice;Ma-Config Service;C:Program Filesma-config.commaconfservice.exe [2008-05-23 18:37]
S3 NtApm;Pilote d'interface NT APM/hérité;C:WINDOWSsystem32DRIVERSNtApm.sys [2004-08-05 14:00]
S3 SQTECH930B;i-Spy PC Cam;C:WINDOWSsystem32DriversCapt930b.sys [2005-01-26 10:27]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi,es'
"2008-07-27 21:00:00 C:WINDOWSTasksADB61A3191858DB5.job"
- c:docume~1pascaleapplic~1armyin~1five web meta.exe
"2008-07-16 15:26:21 C:WINDOWSTasksAppleSoftwareUpdate.job"
- C:Program FilesApple Software UpdateSoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{3BB16E16-7954-441A-AA0D-189203856A93} - C:WINDOWSsystem32jkkKeeBT.dll
Toolbar-{e802027b-1f2b-40bd-b307-0bd96d036835} - (no file)
WebBrowser-{E802027B-1F2B-40BD-B307-0BD96D036835} - (no file)
SSODL-fdxbameg-{2493F2CE-B6B9-4662-8051-B9C90BD07F26} - (no file)
SSODL-fsrpknov-{231F40B2-48F5-488E-8C47-B289D229F532} - C:WINDOWSfsrpknov.dll
Notify-byXPJDwW - byXPJDwW.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-27 23:17:17
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach,s ...

Balayage cach, autostart entries ...

Balayage des fichiers cach,s ...

Scan termin, avec succSs
Les fichiers cach,s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:WINDOWSsystem32ati2evxx.exe
C:WINDOWSsystem32ati2evxx.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
C:Program FilesWIDCOMMLogiciel Bluetoothintwdins.exe
C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
C:Program FilesWIDCOMMLogiciel BluetoothBTTray.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticCCC.exe
C:Program FilesWIDCOMMLogiciel BluetoothBTStackServer.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-27 23:21:47 - machine was rebooted [Guillaume]
ComboFix-quarantined-files.txt 2008-07-27 21:21:41

Pre-Run: 96,040,808,448 octets libres
Post-Run: 96,196,661,248 octets libres

186 --- E O F --- 2008-07-18 08:46:16

[darkspeeds]

La le raport de hijackhis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:37:26, on 28/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
C:Program FilesWIDCOMMLogiciel Bluetoothintwdins.exe
C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre1.6.0_07injusched.exe
C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSTwain_32USB2.0CameraSnapTrap.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesFichiers communsAheadlibNMBgMonitor.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesWIDCOMMLogiciel BluetoothBTTray.exe
C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.EXE
C:Program FilesATI TechnologiesATI.ACECore-Staticccc.exe
C:PROGRA~1WIDCOMMLOGICI~1BTSTAC~1.EXE
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {e802027b-1f2b-40bd-b307-0bd96d036835} - (no file)
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:PROGRA~1VMNTOO~1VMNTOO~1.DLL
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:Program FilesCanonEasy-WebPrintEWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07inssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.1.1119.1736swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:Program FilesCanonEasy-WebPrintToolband.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:PROGRA~1VMNTOO~1VMNTOO~1.DLL
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:Program FilesDAEMON Tools ToolbarDTToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar1.dll
O4 - HKLM..Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07injusched.exe"
O4 - HKLM..Run: [SSBkgdUpdate] "C:Program FilesFichiers communsScansoft SharedSSBkgdUpdateSSBkgdupdate.exe" -Embedding -boot
O4 - HKLM..Run: [OpwareSE4] "C:Program FilesScanSoftOmniPageSE4.0OpwareSE4.exe"
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [STICAP] C:WINDOWSTwain_32USB2.0CameraSnapTrap.exe
O4 - HKLM..Run: [StartCCC] "C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:Program FilesFichiers communsAheadlibNMBgMonitor.exe"
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [First Plan] C:DOCUME~1GUILLA~1APPLIC~1ARMYIN~1Movebias.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesFichiers communsAdobeCalibrationAdobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:Program FilesCanonEasy-WebPrintToolband.dll/RC_Preview.html
O8 - Extra context menu item: Envoyer à &Bluetooth - C:Program FilesWIDCOMMLogiciel Bluetoothtsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:Program FilesWIDCOMMLogiciel Bluetoothtsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:Program FilesWIDCOMMLogiciel Bluetoothtsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/re ... NPUpld.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5014118691
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005 ... scan53.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Registe ... lashax.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:Program FilesWIDCOMMLogiciel Bluetoothintwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesFichiers communsInstallShieldDriver1150Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:Program Filesma-config.commaconfservice.exe

--
End of file - 9242 bytes

[Skynet]

Salut,

pour le rapport HijackThis, à effacer :

O4 - HKCU..Run: [First Plan] C:DOCUME~1GUILLA~1APPLIC~1ARMYIN~1Movebias.exe

O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe (file missing)

O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:PokerTitan Pokercasino.exe (file missing)

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Registe ... lashax.cab