PC infecté par plusieurs trojans

[adrian07]

Bonjour,
Mon PC est infecté par plusieurs trojans que je n'arrive pas à supprimer par Malwarebytes!
J'ai effectué un scan complet en mode sans échec et j'ai supprimé les éléments trouvés et j'ai nettoyé leur trace dans l'historique.
Ce matin, j'ai effectué un scan rapide et j'a trouvé que plusieurs éléments sont encore présents.

Envoyé par dernier rapport Malwarebytes

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1361
Windows 5.1.2600 Service Pack 2

04/11/2008 12:08:09
mbam-log-2008-11-04 (12-08-09).txt

Type de recherche: Examen rapide
Eléments examinés: 56601
Temps écoulé: 10 minute(s), 44 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
D:\Documents and Settings\WINXPPRO\svchost.exe (Trojan.Agent) -> Unloaded process successfully.
D:\WINDOWS\system32\drivers\services.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[system] (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[system] (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[system] (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: d:\windows\system32\drivers\services.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\drivers\services.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\drivers\services.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
D:\WINDOWS\system32\drivers\services.exe (Trojan.Agent) -> Delete on reboot.
D:\Documents and Settings\WINXPPRO\svchost.exe (Trojan.Agent) -> Delete on reboot.
D:\userinit.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\Documents and Settings\LocalService\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\drivers\services.exe.vir (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Envoyé par rapport HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:44, on 04/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\drivers\services.exe
D:\Documents and Settings\WINXPPRO\svchost.exe
D:\WINDOWS\system32\drivers\services.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
D:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE
D:\WINDOWS\system32\NOTEPAD.EXE
D:\Documents and Settings\WINXPPRO\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055c089-8582-441b-a0bf-17b458c2a3a8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - D:\Program Files\P2P_Energy\tbP2P_.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSConfig] D:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L08FXLRD_9156609] "G:\Encarta 2008\Microsoft Encarta 2008 - Études DVD\EDICT.EXE" -m
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: userinit.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://D:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Edit with &XML Spy - D:\Program Files\Altova\XMLSPY2004\spy.htm
O8 - Extra context menu item: ImTranslator - D:\PROGRA~1\SMARTL~1\IMTRAN~1\startup.html
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - D:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: télécharger avec idm - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: télécharger le contenu de video flv avec idm - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: télécharger tous les liens avec idm - D:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/f...trol_fr_FR.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - G:\MATLAB701\webserver\bin\win32\matlabserver.exe
O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OracleHomeFormsClientCache80 - Unknown owner - D:\ORFORMS\BIN\ONRSD80.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Planificateur de tâches (Schedule) - Apache Software Foundation - D:\WINDOWS\system32\drivers\services.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - D:\WINDOWS\system32\sfrem01.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 7922 bytes

Comment faire?

[rlgrand]

Bonjour, Adrian07

Ton infection est sans doute un infection que tu as attrapé via MSN ( message, pièce jointe, ... ).
C'est peut-être un de tes amis qui est vérolé et qui te contamine.

le vers s'est installé en service, ce qui explique que tu n'arrives pas à le supprimer :

O23 - Service: Planificateur de tâches (Schedule) - Apache Software Foundation - D:\WINDOWS\system32\drivers\services.exe

1) Commence par ceci :

En ligne de commande, tape successivement et valide à chaque fois.
sc stop Schedule
sc config schedule start=disabled

2) passe MSNFix :

extraire l'archive sur le bureau.
dans le dossier crée, double-clique sur MSNfix.bat.
Choisis l'option R. Si l'infection est détectée, il te suffit d'appuyer sur une touche du clavier.
Un redémarrage du PC peut être demandé.

Le rapport est enregistré dans le même dossier que MSNfix (date.txt).

A+

[adrian07]

J'ai effectué les taches que tu m'as demandées.
Je ne trouve pas de fichier genre date.txt, j'ai trouvé deux fichiers: md5.txt et temp.txt

[rlgrand]

1) MSNFix t'a-t-il trouvé des infections ?
pour le rapport, tu devrais le trouver dans le dossier d'installation de MSNFix.

2) Copie ou imprime ce texte ( désinfection en mode sans échec )

Tu vas utiliser SDFix téléchargeable à :

Tu installes le logiciel.
Tu peux t’aider du tuto suivant :
http://www.malekal.com/tutorial_SDFix.php

Redémarre en mode sans échec.


Tu lances SDFix en double-cliquant sur RunThis.bat dans le dossier où tu as installé le logiciel.

Ton ordinateur va redémarrer. il te sera peut-être demander d'appuyer sur une touche pour redémarrer.
L'outil va continuer à travailler, c'est normal.

Une fois affiché Finished, appuie sur une touche pour finir l'exécution du logiciel.
Ton bureau devrait réapparaitre.

Ouvre le dossier de SDFix sur ton Bureau.
Copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum.

3) Avec un nouveau log HijackThis.

A+

[adrian07]

Voici le rapport SDFix:

SDFix: Version 1.239
Run by WINXPPRO on 04/11/2008 at 19:47

Microsoft Windows XP [version 5.1.2600]
Running From: D:\SDFix

Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Restoring Default Schedule Service Path

Rebooting

Checking Files :

Trojan Files Found:

D:\Documents and Settings\LocalService\svchost.exe - Deleted
D:\Documents and Settings\WINXPPRO\svchost.exe - Deleted
D:\Documents and Settings\WINXPPRO\Mes documents\My Documents.url - Deleted
D:\Documents and Settings\WINXPPRO\Mes documents\Ma musique\My Music.url - Deleted
D:\Documents and Settings\WINXPPRO\Mes documents\Mes images\My Pictures.url - Deleted
D:\Documents and Settings\WINXPPRO\Mes documents\Mes vid‚os\My Video.url - Deleted
D:\Documents and Settings\WINXPPRO\svchost.exe - Deleted
D:\userinit.exe - Deleted
D:\WINDOWS\system32\drivers\services.exe - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-04 21:32:23
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden services & system hive ...



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:b4,53,af,86,a4,d7,e5,c6,b5,0a,83,b7,c6,c1,55,fb,a3,45,b7,97,e5,..
"p0"="D:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,bd,58,89,fc,da,58,ce,96,85,e8,bf,e3,6b,7d,b9,4b,c3,..
"khjeh"=hex:3e,c1,90,55,40,f1,60,34,db,06,09,cc,84,12,6b,93,63,59,48,b6,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:25,b0,6b,49,a4,fd,23,6d,4e,a9,b7,82,fa,25,23,74,24,29,d5,f3,30,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="D:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000001
"hdf12"=hex:dd,f1,c2,94,94,ff,17,fb,44,49,41,f4,b2,22,67,e2,31,84,33,72,76,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,23,67,19,7b,92,82,45,de,5f,74,d8,15,55,53,10,e8,85,..
"hdf12"=hex:de,35,8a,46,d2,ad,04,88,83,97,0e,a8,32,64,1a,a5,6a,d1,4c,31,1c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:a6,ac,cd,f9,4e,a4,e5,7f,60,29,5f,f4,6d,f2,6e,56,6a,20,87,c2,1e,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:76,f0,f5,ac,1a,90,9a,75,38,d9,5f,e9,e9,81,a4,68,24,b6,bc,26,b1,..
"p0"="D:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,bd,58,89,fc,da,58,ce,96,85,e8,bf,e3,6b,7d,b9,4b,c3,..
"khjeh"=hex:3e,c1,90,55,40,f1,60,34,db,06,09,cc,84,12,6b,93,63,59,48,b6,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:fa,e8,0e,1d,ea,93,7f,90,2b,c6,56,e6,52,e1,82,fd,e2,d8,c0,5e,33,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="D:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000001
"hdf12"=hex:dd,f1,c2,94,94,ff,17,fb,44,49,41,f4,b2,22,67,e2,31,84,33,72,76,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,23,67,19,7b,92,82,45,de,5f,74,d8,15,55,53,10,e8,85,..
"hdf12"=hex:de,35,8a,46,d2,ad,04,88,83,97,0e,a8,32,64,1a,a5,6a,d1,4c,31,1c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:a6,ac,cd,f9,4e,a4,e5,7f,60,29,5f,f4,6d,f2,6e,56,6a,20,87,c2,1e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:76,f0,f5,ac,1a,90,9a,75,38,d9,5f,e9,e9,81,a4,68,24,b6,bc,26,b1,..
"p0"="D:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,bd,58,89,fc,da,58,ce,96,85,e8,bf,e3,6b,7d,b9,4b,c3,..
"khjeh"=hex:3e,c1,90,55,40,f1,60,34,db,06,09,cc,84,12,6b,93,63,59,48,b6,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:fa,e8,0e,1d,ea,93,7f,90,2b,c6,56,e6,52,e1,82,fd,e2,d8,c0,5e,33,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\Atari\\Act of War - Direct Action\\ACTOFWAR.EXE"="D:\\Program Files\\Atari\\Act of War - Direct Action\\ACTOFWAR.EXE:*:Enabled:ACTOFWAR"
"D:\\Program Files\\Microsoft Visual Studio\\COMMON\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"="D:\\Program Files\\Microsoft Visual Studio\\COMMON\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE:*:Enabled:Microsoft (R) Visual Studio VSA RPC Event Creator"
"D:\\Program Files\\DAP\\DAP.exe"="D:\\Program Files\\DAP\\DAP.exe:*:Enabledownload Accelerator Plus"
"D:\\Documents and Settings\\WINXPPRO\\Mes documents\\HL2\\HL2_UK (E)\\hl2.exe"="D:\\Documents and Settings\\WINXPPRO\\Mes documents\\HL2\\HL2_UK (E)\\hl2.exe:*:Enabled:hl2"
"D:\\Program Files\\THQ\\Dawn of War\\W40k.exe"="D:\\Program Files\\THQ\\Dawn of War\\W40k.exe:*:Enabled:W40K"
"D:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"="D:\\Program Files\\Macromedia\\Flash MX\\Flash.exe:*:Enabled:Flash 6.0 r25"
"D:\\Program Files\\EA GAMES\\La Bataille pour la Terre du Milieu(tm)\\game.dat"="D:\\Program Files\\EA GAMES\\La Bataille pour la Terre du Milieu(tm)\\game.dat:*:Enabled:La Bataille pour la Terre du Milieu(tm)"
"D:\\Program Files\\QuickTime\\QuickTimePlayer.exe"="D:\\Program Files\\QuickTime\\QuickTimePlayer.exe:*:Enabled:QuickTime Player Application"
"C:\\BIA2\\System\\EiB.exe"="C:\\BIA2\\System\\EiB.exe:*:Enabled:Brothers In Arms Earned In Blood"
"D:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"="D:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe:*:Enabledreamweaver MX"
"D:\\JBuilder9\\bin\\JdsServerW.exe"="D:\\JBuilder9\\bin\\JdsServerW.exe:*isabled:JdsServerW"
"D:\\Program Files\\EasyPHP1-7\\apache\\apache.exe"="D:\\Program Files\\EasyPHP1-7\\apache\\apache.exe:*:Enabled:apache"
"D:\\JBuilder9\\bin\\JBuilder.exe"="D:\\JBuilder9\\bin\\JBuilder.exe:*:Enabled:JBuilder"
"D:\\Program Files\\ProjectViewer\\PViewer\\StartUp.exe"="D:\\Program Files\\ProjectViewer\\PViewer\\StartUp.exe:*:Enabled:StartUp"
"D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.016\\client_et_serveur\\bin\\Debug\\client_et_serveur.exe"="D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.016\\client_et_serveur\\bin\\Debug\\client_et_serveur.exe:*:Enabled: "
"D:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu II\\game.dat"="D:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu II\\game.dat:*:Enabled:La Bataille pour la Terre du Milieu T II"
"D:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe"="D:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe:*:Enabled:Fireworks MX"
"D:\\Program Files\\Lionhead Studios Ltd\\Black & White\\runblack.exe"="D:\\Program Files\\Lionhead Studios Ltd\\Black & White\\runblack.exe:*:Enabled:lh"
"D:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Chaos Theory\\Versus\\System\\SCCT_Versus_DedicatedServer.exe"="D:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Chaos Theory\\Versus\\System\\SCCT_Versus_DedicatedServer.exe:*:Enabled:SCCT_Versus_DedicatedServer"
"D:\\Program Files\\Real\\RealPlayer\\realplay.exe"="D:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Company of heroes\\BugReport\\BugReport.exe"="C:\\Company of heroes\\BugReport\\BugReport.exe:*:Enabled:BugReport"
"D:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe"="D:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"D:\\Program Files\\uTorrent\\utorrent.exe"="D:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
"D:\\JBuilderX\\jdk1.4\\bin\\javaw.exe"="D:\\JBuilderX\\jdk1.4\\bin\\javaw.exe:*:Enabled:javaw"
"D:\\JBuilderX\\bin\\JBuilderW.exe"="D:\\JBuilderX\\bin\\JBuilderW.exe:*:Enabled:JBuilderW"
"D:\\JBuilderX\\jdk1.4\\jre\\bin\\rmiregistry.exe"="D:\\JBuilderX\\jdk1.4\\jre\\bin\\rmiregistry.exe:*:Enabled:rmiregistry"
"D:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"="D:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe:*:Enabled:iMesh"
"D:\\Documents and Settings\\WINXPPRO\\Bureau\\jdevstudio10132\\jdk\\bin\\javaw.exe"="D:\\Documents and Settings\\WINXPPRO\\Bureau\\jdevstudio10132\\jdk\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"D:\\Documents and Settings\\WINXPPRO\\Bureau\\jdevstudio10132\\jdev\\bin\\jdevW.exe"="D:\\Documents and Settings\\WINXPPRO\\Bureau\\jdevstudio10132\\jdev\\bin\\jdevW.exe:*:Enabled:Oracle JDeveloper"
"D:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"="D:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe:*isabled:mRouterRuntime"
"G:\\Pro Winning 2007\\we2007.dat"="G:\\Pro Winning 2007\\we2007.dat:*:Enabled:we2007.exe"
"D:\\Program Files\\eMule\\emule.exe"="D:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\Program Files\\Shareaza\\Shareaza.exe"="D:\\Program Files\\Shareaza\\Shareaza.exe:*:Enabled:Shareaza"
"D:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe"="D:\\Program Files\\Java\\jre1.6.0_02\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.235\\Uploader.exe"="D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.235\\Uploader.exe:*:Enabled:Uploader"
"D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.360\\Uploader.exe"="D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.360\\Uploader.exe:*:Enabled:Uploader"
"D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.046\\Uploader.exe"="D:\\Documents and Settings\\WINXPPRO\\Local Settings\\Temp\\Rar$EX00.046\\Uploader.exe:*:Enabled:Uploader"
"D:\\Documents and Settings\\WINXPPRO\\Bureau\\CHIHEB\\Uploader.exe"="D:\\Documents and Settings\\WINXPPRO\\Bureau\\CHIHEB\\Uploader.exe:*:Enabled:Uploader"
"D:\\Program Files\\WebCallDirect.com\\WebCallDirect\\WebCallDirect.exe"="D:\\Program Files\\WebCallDirect.com\\WebCallDirect\\WebCallDirect.exe:*:Enabled:WebCallDirect"
"C:\\Warcraft 3\\Warcraft III\\Warcraft III.exe"="C:\\Warcraft 3\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"
"D:\\Program Files\\Internet Download Manager\\IDMan.exe"="D:\\Program Files\\Internet Download Manager\\IDMan.exe:*:Enabled:Internet Download Manager (IDM)"
"G:\\PRO 2008\\PES2008.exe"="G:\\PRO 2008\\PES2008.exe:*:Enabledro Evolution Soccer 2008"
"C:\\WoW-frFR-Installer-downloader.exe"="C:\\WoW-frFR-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\chiheb\\Bureau\\eclipse-rcp-europa-win32\\eclipse\\eclipse.exe"="C:\\Documents and Settings\\chiheb\\Bureau\\eclipse-rcp-europa-win32\\eclipse\\eclipse.exe:*:Enabled:eclipse"
"G:\\MATLAB701\\bin\\win32\\MATLAB.exe"="G:\\MATLAB701\\bin\\win32\\MATLAB.exe:*:Enabled:MATLAB"
"D:\\Program Files\\Azureus\\Azureus.exe"="D:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"D:\\Program Files\\Messenger\\msmsgs.exe"="D:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\emule0.48a-Xtreme6.1\\emule.exe"="C:\\emule0.48a-Xtreme6.1\\emule.exe:*:Enabled:eMule"
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="D:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\\Program Files\\DNA\\btdna.exe"="D:\\Program Files\\DNA\\btdna.exe:*:EnabledNA"
"D:\\Program Files\\BitTorrent\\bittorrent.exe"="D:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"G:\\SoulStorm\\Soulstorm.exe"="G:\\SoulStorm\\Soulstorm.exe:*:Enabled:Soulstorm"
"D:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="D:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"D:\\Program Files\\LimeWire\\LimeWire.exe"="D:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire PRO 4.16.6"
"D:\\Program Files\\BitLord\\BitLord.exe"="D:\\Program Files\\BitLord\\BitLord.exe:*:Enabled:BitLord"
"D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"G:\\CS1.6\\hl.exe"="G:\\CS1.6\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\utorrent.exe"="C:\\utorrent.exe:*:Enabled:æTorrent"
"D:\\Program Files\\KONAMI\\Pro Evolution Soccer 6\\PES6.exe"="D:\\Program Files\\KONAMI\\Pro Evolution Soccer 6\\PES6.exe:*:Enabled:pes6.exe"
"D:\\Program Files\\Pando Networks\\Pando\\pando.exe"="D:\\Program Files\\Pando Networks\\Pando\\pando.exe:*:Enabledando Application"
"D:\\Documents and Settings\\WINXPPRO\\Bureau\\JAFA\\eclipse-jee-europa-winter-win32\\eclipse\\eclipse.exe"="D:\\Documents and Settings\\WINXPPRO\\Bureau\\JAFA\\eclipse-jee-europa-winter-win32\\eclipse\\eclipse.exe:*:Enabled:eclipse"
"D:\\Program Files\\Macromedia\\FreeHand 10\\FreeHand 10.exe"="D:\\Program Files\\Macromedia\\FreeHand 10\\FreeHand 10.exe:*:Enabled:FreeHand 10"
"D:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"="D:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\\WOW\\World of Warcraft\\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe"="D:\\WOW\\World of Warcraft\\WoW-1.12.x-to-2.0.1-frFR-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"G:\\Counter-Strike 1.6 V32 [DiGiTALZONE]\\hl.exe"="G:\\Counter-Strike 1.6 V32 [DiGiTALZONE]\\hl.exe:*:Enabled:Half-Life Launcher"
"D:\\PES2009\\Pro Evolution So (O)\\PROMARGA\\pes2009.exe"="D:\\PES2009\\Pro Evolution So (O)\\PROMARGA\\pes2009.exe:*:Enabledro Evolution Soccer 2009"
"D:\\WINDOWS\\system32\\dpvsetup.exe"="D:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"D:\\WINDOWS\\system32\\rundll32.exe"="D:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Ex‚cuter une DLL en tant qu'application"
"D:\\WINDOWS\\system32\\mssetup.exe"="D:\\WINDOWS\\system32\\mssetup.exe:*:Enabled:Microsoft Internet Sharing"
"\\??\\D:\\WINDOWS\\system32\\winlogon.exe"="\\??\\D:\\WINDOWS\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="D:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :
File Backups: - D:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 30 Jul 2008 1,429,840 A.SH. --- "D:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Wed 30 Jul 2008 4,891,984 A.SHR --- "D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Tue 16 Sep 2008 1,833,296 A.SHR --- "D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Thu 25 Aug 2005 104 ..SHR --- "D:\WINDOWS\system32\4313F2F8C7.sys"
Thu 25 Aug 2005 10,022 A.SH. --- "D:\WINDOWS\system32\KGyGaAvL.sys"
Mon 19 Sep 2005 178,688 A..H. --- "D:\C#\RISOU\\~WRL2934.tmp"
Sun 6 Aug 2006 4,348 A.SH. --- "D:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 22 Aug 2005 118,272 A..H. --- "D:\C#\zozo\Nouveau dossier\stage2005\~WRL3797.tmp"
Tue 15 Apr 2008 0 A.SH. --- "D:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 18 Feb 2007 37,888 ...H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Manel\V\~WRL3165.tmp"
Sun 6 Aug 2006 4,348 ...H. --- "D:\Documents and Settings\WINXPPRO\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Sun 6 Aug 2006 20 A..H. --- "D:\Documents and Settings\WINXPPRO\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Wed 24 Aug 2005 312 A.SH. --- "D:\Documents and Settings\WINXPPRO\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
Sun 23 Oct 2005 30,720 ...H. --- "D:\Documents and Settings\WINXPPRO\Mes documents\samira\DEVOIRS\~WRL1173.tmp"
Sun 25 Jun 2006 55,150 A..H. --- "D:\Documents and Settings\All Users\Application Data\Microsoft\visualstudio\7.1\vs000223.tmp"
Thu 20 May 2004 1,365,504 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\COURS\Rapports\rapport p2m final\~WRL0873.tmp"
Thu 20 May 2004 108,032 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\COURS\Rapports\rapport p2m final\~WRL1081.tmp"
Fri 21 May 2004 25,600 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\COURS\Rapports\rapport p2m final\~WRL1506.tmp"
Thu 20 May 2004 173,568 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\COURS\Rapports\rapport p2m final\~WRL2103.tmp"
Thu 20 May 2004 222,208 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\COURS\Rapports\rapport p2m final\~WRL2707.tmp"
Thu 20 May 2004 1,365,504 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\PROJET ETE\ii2\Rapports\rapport p2m final\~WRL0873.tmp"
Thu 20 May 2004 108,032 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\PROJET ETE\ii2\Rapports\rapport p2m final\~WRL1081.tmp"
Fri 21 May 2004 25,600 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\PROJET ETE\ii2\Rapports\rapport p2m final\~WRL1506.tmp"
Thu 20 May 2004 173,568 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\PROJET ETE\ii2\Rapports\rapport p2m final\~WRL2103.tmp"
Thu 20 May 2004 222,208 A..H. --- "D:\Documents and Settings\WINXPPRO\Bureau\Nouveau dossier\FORMATAGE\Nouveau dossier\PROJET ETE\ii2\Rapports\rapport p2m final\~WRL2707.tmp"

Finished!

[adrian07]

et voici le rapport HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:17:56, on 04/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Documents and Settings\WINXPPRO\Menu Démarrer\Programmes\Démarrage\userinit.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\WINXPPRO\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\drivers\services.exe
O2 - BHO: IDM Helper - {0055c089-8582-441b-a0bf-17b458c2a3a8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - D:\Program Files\P2P_Energy\tbP2P_.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [[system]] D:\WINDOWS\system32\drivers\services.exe
O4 - HKLM\..\Run: [winlogon] D:\Documents and Settings\WINXPPRO\svchost.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L08FXLRD_198437] "G:\Encarta 2008\Microsoft Encarta 2008 - Études DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [[system]] D:\WINDOWS\system32\drivers\services.exe
O4 - HKCU\..\Run: [winlogon] D:\Documents and Settings\WINXPPRO\svchost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: userinit.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://D:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Edit with &XML Spy - D:\Program Files\Altova\XMLSPY2004\spy.htm
O8 - Extra context menu item: ImTranslator - D:\PROGRA~1\SMARTL~1\IMTRAN~1\startup.html
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - D:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: télécharger avec idm - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: télécharger le contenu de video flv avec idm - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: télécharger tous les liens avec idm - D:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/f...trol_fr_FR.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - G:\MATLAB701\webserver\bin\win32\matlabserver.exe
O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OracleHomeFormsClientCache80 - Unknown owner - D:\ORFORMS\BIN\ONRSD80.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Planificateur de tâches (Schedule) - Apache Software Foundation - D:\WINDOWS\system32\drivers\services.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - D:\WINDOWS\system32\sfrem01.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 8146 bytes

[rlgrand]

L'infection MSN est toujours là.

F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\drivers\services.exe

et pourtant SDFix a supprimé pas mal de fichiers dont celui-la.
cette fois-ci ne décoche rien dans MsConfig.

1) Refais un scan avec HIjackthis mais auparavant tu vas renommer l'executable Hijackthis.exe en DVP.exe.
Poste le rapport.

2) Analyse le fichier suivant sur VirusTotal.
Clique sur parcourir pour sélectionner le fichier suivant :
chemin : D:\WINDOWS\system32\4313F2F8C7.sys
puis sur envoyer.
Après analyse, poste le rapport ( pour cela, tu sélectionnes la partie résultat ).

Il faudra passer d'autres outils.

A+

[adrian07]

Salut
1)Pour ce qui est de MSNFix, je crois qu'il n'arrive pas à supprimer les infections, en effet, au moment de la suppression, il indique que plusieurs fichiers sont introuvables:

read file error: D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\winlogon.exe, Le fichier spécifié est introuvable.
read file error: D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\services.exe, Le fichier spécifié est introuvable.
read file error: D:\WINDOWS\system32\cftmon.exe, Le fichier spécifié est introuvable.
read file error: D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\winlogon.exe, Le fichier spécifié est introuvable.
read file error: D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\services.exe, Le fichier spécifié est introuvable.
read file error: D:\WINDOWS\system32\cftmon.exe, Le fichier spécifié est introuvable.
read file error: D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\winlogon.exe, Le fichier spécifié est introuvable.
read file error: D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\services.exe, Le fichier spécifié est introuvable.
read file error: D:\WINDOWS\system32\cftmon.exe, Le fichier spécifié est introuvable.

2)Voici le rapport HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:25:03, on 06/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
D:\WINDOWS\system32\drivers\services.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\drivers\services.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\drivers\services.exe
D:\Documents and Settings\WINXPPRO\Menu Démarrer\Programmes\Démarrage\userinit.exe
D:\WINDOWS\system32\msiexec.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Documents and Settings\WINXPPRO\Bureau\DVP.exe
D:\WINDOWS\system32\MsiExec.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055c089-8582-441b-a0bf-17b458c2a3a8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - D:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - D:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - D:\Program Files\P2P_Energy\tbP2P_.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [[system]] D:\WINDOWS\system32\drivers\services.exe
O4 - HKLM\..\Run: [PAC7302_Monitor] D:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [rs32net] D:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [L08FXLRD_198437] "G:\Encarta 2008\Microsoft Encarta 2008 - Études DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [[system]] D:\WINDOWS\system32\drivers\services.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [[system]] D:\WINDOWS\system32\drivers\services.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [[system]] D:\WINDOWS\system32\drivers\services.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: userinit.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://D:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Edit with &XML Spy - D:\Program Files\Altova\XMLSPY2004\spy.htm
O8 - Extra context menu item: ImTranslator - D:\PROGRA~1\SMARTL~1\IMTRAN~1\startup.html
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - D:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: télécharger avec idm - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: télécharger le contenu de video flv avec idm - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: télécharger tous les liens avec idm - D:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - D:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/f...trol_fr_FR.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D676DC5C-B21D-41F5-AACD-6EF810A645E7}: NameServer = 193.95.93.77,193.95.66.10
O20 - Winlogon Notify: qnogrbu - qnogrbu.dll (file missing)
O20 - Winlogon Notify: WinCtrl32 - D:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: Kaspersky Anti-Virus 6.0 AVPPolicyAgent (AVPPolicyAgent) - Unknown owner - .exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - D:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - G:\MATLAB701\webserver\bin\win32\matlabserver.exe
O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Machine Debug Manager MDMThemes (MDMThemes) - Unknown owner - .exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OracleHomeFormsClientCache80 - Unknown owner - D:\ORFORMS\BIN\ONRSD80.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Planificateur de tâches (Schedule) - Apache Software Foundation - D:\WINDOWS\system32\drivers\services.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - D:\WINDOWS\system32\sfrem01.exe
O23 - Service: Détection matériel noyau ShellHWDetectionProtectedStorage (ShellHWDetectionProtectedStorage) - Unknown owner - .exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Service Messenger Sharing Folders USN Journal Reader usnjsvcxmlprov (usnjsvcxmlprov) - Unknown owner - D:\WINDOWS\system32\acelpdeco.exe
O23 - Service: WebClient WebClientOracleServiceORCL (WebClientOracleServiceORCL) - Unknown owner - .exe (file missing)

--
End of file - 11042 bytes

3)Voici le résultat du scan du fichier 4313F2F8C7.sys :

Fichier 4313F2F8C7.sys reçu le 2008.11.06 18:29:03 (CET)
Situation actuelle:terminé
Résultat: 0/36 (0%)

[rlgrand]

Bonjour,

1) Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.

Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.

:processes
Explorer.exe

:Services
Schedule
usnjsvcxmlprov

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"[system]"=-
"rs32net"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"[system]"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"[system]"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"[system]"=-

:Files
D:\windows\system32\drivers\services.exe
D:\documents and settings\winxppro\svchost.exe
D:\Documents and Settings\WINXPPRO\Menu Démarrer\Programmes\Démarrage\userinit.exe
D:\WINDOWS\system32\acelpdeco.exe
D:\WINDOWS\System32\rs32net.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.

Poste le rapport ( fichier .log ) situé dans C:\_OTMoveIt\MovedFiles.
Ton ordinateur va redémarrer pour supprimer les fichiers.

2) Utilise malwarebytes que tu connais peut-être.
Si tu l'as déjà, mets le à jour.

Tu postes le rapport dans ton prochain message ainsi qu'un nouveau rapport Hijackthis.

Si tu ne retrouves pas le rapport, ouvre MalwareBytes et regarde dans l’onglet Rapport/logs . Il y est. Clique dessus et choisir ouvrir.

A+

[adrian07]

Salut,
Je m'excuse encore une fois pour le retard, mais j'ai de nouveau des pbs avec ma connexion internet.
Par chance, j'ai pas executé le message erroné, c'est maintenant que je suis arrivé à me connecter....en plus mon pc est dévasté pas W32.Virut.W....

Voici le rapport OTMoveIt3:

========== PROCESSES ==========
Process Explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Unable to stop service Schedule .
Unable to stop service usnjsvcxmlprov .
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\[system] not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\rs32net not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\[system] not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule\\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\[system] not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\\[system] not found.
========== FILES ==========
File/Folder D:\windows\system32\drivers\services.exe not found.
File/Folder D:\documents and settings\winxppro\svchost.exe not found.
File/Folder D:\Documents and Settings\WINXPPRO\Menu Démarrer\Programmes\Démarrage\userinit.exe not found.
File move failed. D:\WINDOWS\system32\acelpdeco.exe scheduled to be moved on reboot.
File/Folder D:\WINDOWS\System32\rs32net.exe not found.
========== COMMANDS ==========
File delete failed. D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\etilqs_JNKI4O1Uef4UkwtBKwma scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. D:\Documents and Settings\WINXPPRO\Local Settings\Application Data\Mozilla\Firefox\Profiles\krx75w1x.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\WINXPPRO\Local Settings\Application Data\Mozilla\Firefox\Profiles\krx75w1x.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\WINXPPRO\Local Settings\Application Data\Mozilla\Firefox\Profiles\krx75w1x.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\WINXPPRO\Local Settings\Application Data\Mozilla\Firefox\Profiles\krx75w1x.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\WINXPPRO\Local Settings\Application Data\Mozilla\Firefox\Profiles\krx75w1x.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\WINXPPRO\Local Settings\Application Data\Mozilla\Firefox\Profiles\krx75w1x.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11072008_194955

Files moved on Reboot...
D:\WINDOWS\system32\acelpdeco.exe moved successfully.
File D:\DOCUME~1\WINXPPRO\LOCALS~1\Temp\etilqs_JNKI4O1Uef4UkwtBKwma not found!
File move failed. D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
D:\Documents and Settings\WINXPPRO\Local Settings\Application Data\Mozilla\Firefox\Profiles\krx75w1x.default\Cache\_CACHE_001_ moved successfully.
D:\Documents and Settings\WINXPPRO\Local Settings\Appl