Bonjour, pourriez vous lire mon resumé suite à un scan avec hijackthis et me dire s'il y a reparation a faire, je pense que oui, parce que j'ai tjrs le meme probleme a savoir site Chinois en page d'accueil au lancement de internet explorer... suivi par d'autres sans les avoir ouvert... j'ai l'impression qu'il prend possession de mon pc et je ne peux rie n faire j'ai beau instalé des anti virus, anti spam, rien a faire... merci d'avance Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:39:13, on 20/02/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system\rund1132.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system\rund1132.exe C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\common32.exe C:\WINDOWS\WinShell.\daemon.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Creative\Shared Files\CAMTRAY.EXE C:\PROGRA~1\Wanadoo\TaskBarIcon.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Fichiers communs\Goto Software\Vaderetro_Mgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Skype\Phone\Skype.exe C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\PROGRA~1\Wanadoo\ComComp.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\Microsoft Money\System\mnyexpr.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\PROGRA~1\Wanadoo\Toaster.exe C:\PROGRA~1\Wanadoo\Inactivity.exe C:\PROGRA~1\Wanadoo\PollingModule.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Media Player\WMPNetwk.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\Wanadoo\Watch.exe C:\DOCUME~1\CKSAND~1\LOCALS~1\Temp\sys1E.tmp C:\WINDOWS\Fonts\TIMPIatform.exe C:\WINDOWS\system32\wauafe.exe C:\WINDOWS\system32\wauafe.exe C:\WINDOWS\system32\wauafe.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wauafe.exe C:\Documents and Settings\CKS Andre SNEYAERT\Local Settings\Temporary Internet Files\Content.IE5\3J3A4KDM\HiJackThis[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://luck114.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - _{08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL F3 - REG:win.ini: load=C:\WINDOWS\system\rund1132.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system\rund1132.exe, O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Fichiers communs\PushWare\cpush0.dll O2 - BHO: Info cache - {296AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\WINDOWS\Intel\baiduc.dll O2 - BHO: IETimber - {489873CE-F3E1-44A3-8E89-04BE26BE4446} - C:\Program Files\Internet Explorer\IETimber\IETimber.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [fenaffiche] C:\Program Files\FenAffiche\FenUnika.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [OaZeC] C:\WINDOWS\hxyjlul.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [Á³# L"h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\hxyjlul.exe O4 - HKLM\..\Run: [Yhyjczvn] C:\Program Files\Xkljec\Bsnub.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [VadeRetro Outlook] C:\Program Files\Goto Software\Vade Retro\VrMoRegister.exe -s O4 - HKLM\..\Run: [VRManager] C:\Program Files\Fichiers communs\Goto Software\Vaderetro_Mgr.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM= O4 - HKCU\..\Run: [Livecom] "C:\PROGRA~1\Livecom\APPLIC~1\CommunicationAgent\CommunicationAgent.exe" -ICom_StartNoSplashScreen O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe" O4 - HKCU\..\Run: [cmdhlpadm] C:\WINDOWS\system32\vkvadezy.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S O4 - HKLM\..\Policies\Explorer\Run: [mysys] C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\common32.exe O4 - HKLM\..\Policies\Explorer\Run: [user] C:\WINDOWS\WinShell..\daemon.exe O4 - HKLM\..\Policies\Explorer\Run: [360safe] C:\WINDOWS\Fonts\wuauclt.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user') O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: karna.dat O20 - Winlogon Notify: xrkfgusi - xrkfgusi32.dll (file missing) O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE

Bonjour, il faut tout nettoyer d'un coup sinon l'infection se relance. Mais d'abord installe un antivirus : http://www.commentcamarche.net/telecharger/telecharger 55 antivir et un parefeu : http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm Booddha te donnera les tutoriels. ============================ Copie ou imprime les instructions avant Déconnecte toi d'internet et ferme toutes tes applications. Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware) Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes : KillAll:: Rootkit:: c:\program files\MediaChannel\Navvy 5.2\NavvyUp.exe c:\windows\system32\msexe.exe c:\windows\system32\zxexe.exe c:\windows\system32\kdexe.exe c:\windows\Fonts\wuauclt.exe c:\docume~1\CKSAND~1\LOCALS~1\Temp\502514 c:\program files\Internet Explorer\PowerJo.ase c:\program files\Internet Explorer\PowerJv.ask c:\windows\system32\odgildpe.dll c:\windows\system32\ebhpliad.dll c:\windows\system32\homegdpk.dll c:\windows\system32\cockgddc.dll c:\windows\system32\ojdnnlnf.dll c:\windows\system32\aldoiilk.dll c:\windows\system32\heifeado.dll c:\windows\system32\ambiojfn.dll c:\windows\system32\kdkdfeln.dll c:\windows\system32\ooaddion.dll c:\windows\system32\ndaelgfl.dll c:\windows\system32\ccbficfi.dll c:\windows\system32\gajdpnec.dll c:\windows\system32\ikdapmcm.dll c:\windows\system32\dbfkipbd.dll c:\windows\system32\ogcmfdaf.dll c:\windows\system32\lkknkgnk.dll c:\windows\system32\kffoogac.dll c:\windows\system32\akolkhck.dll c:\windows\system32\oojlpcib.dll c:\windows\system32\eojpchpn.dll c:\windows\system\rund1132.exe c:\windows\system32\drivers\pnpmem.sys c:\windows\winsscoo.exe c:\windows\system32\drivers\winyyy.sys c:\windows\system32\drivers\ati4twxx.sys c:\windows\system32\drivers\ati8quxx.sys c:\windows\system32\drivers\ethcjxre.sys c:\windows\fonts\alsk.sys c:\windows\fonts\naks.sys c:\windows\system32\dllcache\spoolsv.exe c:\windows\system32\WanPacket.dll c:\windows\WinShell.\daemon.exe c:\windows\smss.exe c:\windows\Fonts\TIMPIatform.exe c:\windows\system32\waubfe.exe c:\program files\bccd.pif C:\WINDOWSupdate.dll c:\windows\system32\kdexe.exe c:\windows\system32\waubfe.exe c:\windows\winsscoo.exe c:\windows\system32\drivers\winyyy.sys c:\windows\system32\1957817A.dll c:\windows\system32\1957817A.cfg c:\windows\system32\zxexe.exe c:\windows\system32\198FF3D8.dll c:\windows\system32\198FF3D8.cfg c:\windows\system32\msexe.exe c:\windows\system32\asdfasdf c:\windows\system32\registryboosterppcg15.exe c:\windows\system32\wauafe.exe c:\windows\system32\dfln.dll c:\windows\sysinfo.tmp c:\windows\system32\waunafe.exe c:\windows\system32\dafln.dll c:\windows\system32\MSPolicyAgent.dll c:\windows\system32\types.tmp c:\windows\system32\waumafe.exe c:\windows\system32\waulafe.exe c:\windows\system32\fasadf.dll c:\windows\system32\somspring.dat c:\windows\system32\romarshal.dat c:\windows\system32\drivers\pnpmem.sys c:\windows\system32\ormsgse.axz c:\windows\system32\waukafe.exe c:\windows\system32\flzaitian.dll c:\windows\system32\exlds.ini C:\FINE CRUSH LTD.doc c:\windows\system32\drivers\52438666.txt c:\program files\cacmchc c:\program files\Fichiers communs\qybabiqylo.dl c:\program files\Fichiers communs\vexomigaga._sy c:\program files\Fichiers communs\vodeqet.ban c:\documents and settings\All Users\Application Data\288537758 c:\windows\system32\alimoto32.exe c:\windows\system32\RamrtwC.dll C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\At10.job C:\WINDOWS\Tasks\At11.job C:\WINDOWS\Tasks\At12.job C:\WINDOWS\Tasks\At13.job C:\WINDOWS\Tasks\At14.job C:\WINDOWS\Tasks\At15.job C:\WINDOWS\Tasks\At16.job C:\WINDOWS\Tasks\At17.job C:\WINDOWS\Tasks\At18.job C:\WINDOWS\Tasks\At19.job C:\WINDOWS\Tasks\At2.job C:\WINDOWS\Tasks\At20.job C:\WINDOWS\Tasks\At21.job C:\WINDOWS\Tasks\At22.job C:\WINDOWS\Tasks\At23.job C:\WINDOWS\Tasks\At24.job C:\WINDOWS\Tasks\At25.job C:\WINDOWS\Tasks\At26.job C:\WINDOWS\Tasks\At27.job C:\WINDOWS\Tasks\At28.job C:\WINDOWS\Tasks\At29.job C:\WINDOWS\Tasks\At3.job C:\WINDOWS\Tasks\At30.job C:\WINDOWS\Tasks\At31.job C:\WINDOWS\Tasks\At32.job C:\WINDOWS\Tasks\At33.job C:\WINDOWS\Tasks\At34.job C:\WINDOWS\Tasks\At35.job C:\WINDOWS\Tasks\At36.job C:\WINDOWS\Tasks\At37.job C:\WINDOWS\Tasks\At38.job C:\WINDOWS\Tasks\At39.job C:\WINDOWS\Tasks\At4.job C:\WINDOWS\Tasks\At40.job C:\WINDOWS\Tasks\At41.job C:\WINDOWS\Tasks\At42.job C:\WINDOWS\Tasks\At43.job C:\WINDOWS\Tasks\At44.job C:\WINDOWS\Tasks\At45.job C:\WINDOWS\Tasks\At46.job C:\WINDOWS\Tasks\At47.job C:\WINDOWS\Tasks\At48.job C:\WINDOWS\Tasks\At49.job C:\WINDOWS\Tasks\At5.job C:\WINDOWS\Tasks\At50.job C:\WINDOWS\Tasks\At51.job C:\WINDOWS\Tasks\At52.job C:\WINDOWS\Tasks\At53.job C:\WINDOWS\Tasks\At54.job C:\WINDOWS\Tasks\At55.job C:\WINDOWS\Tasks\At56.job C:\WINDOWS\Tasks\At57.job C:\WINDOWS\Tasks\At58.job C:\WINDOWS\Tasks\At59.job C:\WINDOWS\Tasks\At6.job C:\WINDOWS\Tasks\At60.job C:\WINDOWS\Tasks\At61.job C:\WINDOWS\Tasks\At62.job C:\WINDOWS\Tasks\At63.job C:\WINDOWS\Tasks\At64.job C:\WINDOWS\Tasks\At65.job C:\WINDOWS\Tasks\At66.job C:\WINDOWS\Tasks\At67.job C:\WINDOWS\Tasks\At68.job C:\WINDOWS\Tasks\At69.job C:\WINDOWS\Tasks\At7.job C:\WINDOWS\Tasks\At70.job C:\WINDOWS\Tasks\At71.job C:\WINDOWS\Tasks\At72.job C:\WINDOWS\Tasks\At8.job C:\WINDOWS\Tasks\At9.job c:\windows\system32\704C3595.dll c:\windows\system32\704C3595.cfg c:\windows\system32\16BC0F81.dll c:\windows\system32\16BC0F81.cfg c:\windows\tmp.dat c:\windows\sys.ini c:\program files\internet explorer\plugins\icwres.dll c:\windows\system32\aoalmieo.dll c:\windows\system32\cbndboek.dll c:\windows\system32\cciieood.dll c:\windows\system32\cdcgebkf.dll c:\windows\system32\cpnbliif.dll c:\windows\system32\dpbfhnfj.dll c:\windows\system32\feeckhoj.dll c:\windows\system32\gjdochbi.dll c:\windows\system32\ipppkhkc.dll c:\windows\system32\mppblchp.dll c:\windows\system32\nfbdadcc.dll c:\windows\system32\npptools.dll c:\windows\system32\npptools.dll c:\windows\system32\pahklhok.dll c:\windows\system32\pfpjhepc.dll c:\windows\system32\piakdpih.dll c:\windows\Temp\Perflib_Perfdata_b4.dat c:\program files\Fichiers communs\PushWare\cpush.dll c:\windows\Intel\baiduc.dll c:\program files\Internet Explorer\IETimber\IETimber.dll c:\windows\system32\dllcache\spoolsv.exe c:\progra~1\SECURI~1\174112\Program\SERVIC~1.EXE c:\windows\system32\7f7lMNDh.exe c:\windows\system32\exlds.ini c:\docume~1\CKSAND~1\LOCALS~1\temp\sys2A.tmp c:\windows\Fonts\TIMPIatform.exe c:\windows\system32\waubfe.exe c:\windows\system32\waubfe.exe folder:: C:\DOCUME~1\CKSAND~1\MENUDM~1\PROGRA~1\XP_Antispyware c:\program files\Fichiers communs\PushWare c:\program files\cacmchc Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{296AB8C6-FB22-4D17-8834-064E2BA0A6F0}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{489873CE-F3E1-44A3-8E89-04BE26BE4446}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5419706F-9AD1-49BB-A91F-EE6B62E2881E}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{912F6837-CCB6-424B-BC9C-8BB5541AFB54}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34A12A06-48C0-420D-8F11-73552EE9631A}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE9EB54-A08E-4570-B748-13F5DDB5781C}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AD3AB16-6D0E-4F04-8660-FB1F36BC2DC0}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F685B36-C53A-4653-9231-1DAE5736DE45}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50C4CDD9-22D7-49FF-AC6D-7D4D528A3AB2}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE2267BD-B163-407F-9E8D-6ADEC771E7AB}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MewBohoMediaPop.PopBoho] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MezzAdPopup.BXLogc] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MezzAdPopup.BXLogc.1] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\NewAdPopup.ToolbarDetector.1] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NavvyUp"=- "msexe.exe"=- "zxexe.exe"=- "kdexe.exe"=- "Á³# L\"h'þ9Óœð3rÅWc:\\Program Files\\ISTsvc\\istsvc.exe"="=- [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "svchstt"=- "360safe"=- [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5419706F-9AD1-49BB-A91F-EE6B62E2881E}"=- "{912F6837-CCB6-424B-BC9C-8BB5541AFB54}"=- "8D025D9E"=- "EB1952AD"=- "186E0D94"=- "C8C40DDC"=- "83D7757F"=- "A5D82254"=- "1E2FEAD8"=- "A6B283F7"=- "4D4DFE57"=- "88ADD287"=- "7DAE50F5"=- "CCBF2CF2"=- "0A3D97EC"=- "24DA96C6"=- "DBF429BD"=- "80C6FDAF"=- "54474074"=- "4FF880AC"=- "A48541C4"=- "88359C2B"=- "{198FF3D8-56F1-466B-A36F-F9C28B43E440}"=- "{1957817A-94B2-4CAC-B113-A331809B5730}"=- "{CC22E88D-6A04-4A65-A4B9-0CC0D3AE3014}"=- "{03D8C1B2-5C21-4784-96C1-00228A85A357}"=- "{CDC0EB4F-C90A-47A7-B43F-47AC7FFBC413}"=- "{D9BF17F3-F42E-48E2-B098-A0E2C9013FB3}"=- "{CB7DB8E4-2C26-4A99-89E8-9339AC260CA4}"=- "{C97B522F-A373-4954-A638-FC5F755A6161}"=- "{2999414C-E194-4B03-8486-EEEE03F40EE9}"=- "{FEEC4183-4715-4F28-891C-077F07231A6B}"=- "{9F931E9C-F6FB-4918-844E-A6CE25B24792}"=- "{9A145184-6AA3-43CD-958D-D22A1D9D9333}"=- "{699B5C19-E0A2-4121-A989-D7A8A1B6B104}"=- "{A8A562E8-97BC-4E82-BAA2-0F361A9F9EF5}"=- "{92A4D921-7454-4A8B-A510-93E9AFB53821}"=- "{7FBDADCC-FC94-46BB-BA54-84BE7CBC5D92}"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "8D025D9E"=- "EB1952AD"=- "186E0D94"=- "C8C40DDC"=- "83D7757F"=- "A5D82254"=- "1E2FEAD8"=- "A6B283F7"=- "4D4DFE57"=- "88ADD287"=- "7DAE50F5"=- "CCBF2CF2"=- "0A3D97EC"=- "24DA96C6"=- "DBF429BD"=- "80C6FDAF"=- "54474074"=- "4FF880AC"=- "A48541C4"=- "88359C2B"=- "CC22E88D"=- "03D8C1B2"=- "CDC0EB4F"=- "D9BF17F3"=- "CB7DB8E4"= - "C97B522F"= - "2999414C"=- "FEEC4183"=- "9F931E9C"=- "9A145184"=- "699B5C19"=- "A8A562E8"=- "92A4D921"=- "7FBDADCC"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="c:\windows\system32\userinit.exe," [HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows] "load"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360rpt.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360safe.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360safebox.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360tray.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ANTIARP.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ArSwp.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Ast.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AutoRun.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AutoRunKiller.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AvMonitor.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AVP.COM] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AVP.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\CCenter.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Frameworkservice.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\GFUpd.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\GuardField.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IceSword.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Iparmor.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASARP.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kav32.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KAVPFW.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kavstart.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kissvc.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kmailmon.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KPfwSvc.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRegEx.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonxp.KXP] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVSrvXP.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVWSC.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\kwatch.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Mmsk.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapsvc.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\nod32krn.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Nod32kui.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PFW.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQDoctor.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RAV.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMon.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavMonD.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Ravservice.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavStub.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RavTask.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RAVTRAY.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Regedit.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwmain.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwProxy.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rfwsrv.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rfwstub.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RsAgent.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Rsaupd.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RsMain.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rsnetsvr.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\RSTray.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Runiep.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\safeboxTray.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ScanFrm.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\SREngLdr.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojanDetector.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Trojanwall.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TrojDie.KXP] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\VPC32.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\VPTRAY.EXE] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\WOPTILITIES.EXE] driver:: pnpmem WinSSCOM MyProt ati4twxx ati8quxx ethcjxre alsk naks BackWeb Client lpdx Enregistre ce fichier sous le nom CFscript Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer. Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! Ne touche à rien tant que le scan n'est pas terminé. Réactive ton parefeu, ton antivirus, la garde de ton antispyware Une fois le scan achevé, un rapport va s'afficher: poste son contenu. Remets aussi un rapport Hijackthis Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

Lecture résumé HIJACKTHIS - Page 7

Réponse 121 / 123

Utilisateur anonyme

Salut vous deux.

Ca m'a l'air d'une belle sal....rie ?! Je suis de près. Bon courage.

Réponse 122 / 123

Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537

Bonjour,

oui,une belle glue

Rosally, un souci avec The Avenger ?

Réponse 123 / 123

ROSALLY Messages postés 80 Statut Membre

bonjour Lyonnais & Booddha

mes sincères excuses pour le retard
non pas encore entamé la procedure, Un peu occupée c tjrs le cas en fin de semaine.
je reprends de suite
a toute

Discussions similaires

Erreur de lecture sur iptv smarters

Erreur de lecture des tv film et series sur mon appli iptv smarters pro

Message "Un bloqueur de publicité empêche la lecture..."

Discussions similaires

Newsletters