Bonjour, à tous
voila depuis 2 jours, j'ai des pub qui ouvre dans mon navigateur Mozilla Firefox 3.0.6
allor, j'ai désinfecté avec Spyware Terminator et Spybot - Search & Destroy
puis j'ai fait un scan avec mon antivirus Avast
et j'ai effacé mon registre avec C-Cleaner
mai rien ne change, j'ai toujours des fenêtre publicitaire qui ouvre automatiquement ( princeminister, conforama et même des site pour adulte, etc.. )
je ne c'est plus quoi faire :(
J'ai vue que Hijackthis pouvait m'aidé à trouver le problème
donc je le colle ici, pour que quelqu'un ce penche sur mon problème :
merci d'avance ^^
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:00:04, on 20/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\gtsrp\gtsrp.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Sprite Software\Sprite Backup\SpriteService.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\documents and settings\mihalystart\local settings\application data\csoie.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\1\FTCOMModule.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\eMule\eMule.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Crawler\CToolbar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\MihalyStart\Bureau\yyyyyyy\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
https://www.msn.com/fr-fr/?ocid=iehp
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [gtsrp] C:\Program Files\gtsrp\gtsrp.exe
O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6663] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Conditions générales.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8813] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Conditions générales.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6973] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Confidentialité.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4881] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Confidentialité.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8931] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Website.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9551] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Website.url"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7596] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Désinstaller.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5390] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Désinstaller.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4269] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Live-Player.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5820] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Live-Player.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9250] command.com /c del "C:\Program Files\Live-Player\live-player.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9282] cmd.exe /c del "C:\Program Files\Live-Player\live-player.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3833] command.com /c del "C:\Program Files\Live-Player\data\translation_file_live-player.xml"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6179] cmd.exe /c del "C:\Program Files\Live-Player\data\translation_file_live-player.xml"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4619] command.com /c del "C:\Program Files\Live-Player\skins\live-player.skf"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6308] cmd.exe /c del "C:\Program Files\Live-Player\skins\live-player.skf"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /M "Stylus DX3800" /EF "HKCU"
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKCU\..\Run: [SpriteService] "C:\Program Files\Sprite Software\Sprite Backup\SpriteService.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [csoie] "c:\documents and settings\mihalystart\local settings\application data\csoie.exe" csoie
O4 - HKCU\..\RunOnce: [SpybotDeletingB9869] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Conditions générales.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1363] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Conditions générales.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2138] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Confidentialité.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5898] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Confidentialité.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingB223] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Website.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4355] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Website.url"
O4 - HKCU\..\RunOnce: [SpybotDeletingB754] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Désinstaller.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2800] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Désinstaller.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4129] command.com /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Live-Player.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD194] cmd.exe /c del "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Live-Player\Live-Player.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB29] command.com /c del "C:\Program Files\Live-Player\live-player.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9737] cmd.exe /c del "C:\Program Files\Live-Player\live-player.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9053] command.com /c del "C:\Program Files\Live-Player\data\translation_file_live-player.xml"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4262] cmd.exe /c del "C:\Program Files\Live-Player\data\translation_file_live-player.xml"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2139] command.com /c del "C:\Program Files\Live-Player\skins\live-player.skf"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5559] cmd.exe /c del "C:\Program Files\Live-Player\skins\live-player.skf"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk
O4 - Startup: TransBar.lnk
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone:
https://www.orange.fr/portail
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
Afficher la suite
