Malwares et/ou virus

pierreyann -  
Bonjour,
Bonjour,
depuis 2 jours j'ai une succession de mal wares + installation de internet security 2010 malgré mon antivir.

j'ai passé "malware malbytes" et j'en ai nzettoyé mais j'ai toujours des malwares détectés par antivir.

merci par avance pour vos éclaircissements
Configuration: Windows XP Internet Explorer 7.0

11 réponses

  1. tchaning
    telecharger hijackthis, faire un scan puis coller le rapport ici svp .

    Merci
    1. pierreyann Auteur
      merci,

      voici mon hijackthis

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 15:55:30, on 22/01/2010
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16981)
      Boot mode: Normal

      Running processes:
      C:\Windows\System32\smss.exe
      C:\Windows\system32\winlogon.exe
      C:\Windows\system32\services.exe
      C:\Windows\system32\lsass.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\System32\svchost.exe
      C:\Windows\system32\svchost.exe
      C:\Windows\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir Desktop\sched.exe
      C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      C:\Program Files\Application Updater\ApplicationUpdater.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\Windows\System32\NMSSvc.exe
      C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\Windows\System32\svchost.exe
      C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
      C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
      C:\Windows\Explorer.EXE
      C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
      C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
      C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
      C:\Windows\system32\PROMon.exe
      C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
      C:\Program Files\USB Disk Win98 Driver\Res.EXE
      C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\Windows\system32\ctfmon.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\Palm\HOTSYNC.EXE
      C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
      C:\Program Files\internet explorer\iexplore.exe
      C:\Program Files\internet explorer\iexplore.exe
      C:\Windows\odbn.exe
      C:\Windows\odbn.exe
      C:\Windows\odbn.exe
      C:\Documents and Settings\Administrateur\Mes documents\HiJackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
      O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
      O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
      O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
      O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
      O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
      O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
      O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
      O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
      O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      O4 - HKLM\..\Run: [odbny] C:\Windows\odbn.exe
      O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
      O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
      O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe"
      O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
      O4 - Startup: HotSync Manager.LNK = C:\Program Files\Palm\HOTSYNC.EXE
      O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
      O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
      O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
      O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMST.ORG
      O17 - HKLM\Software\..\Telephony: DomainName = SMST.ORG
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMST.ORG
      O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
      O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
      O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
      O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
      O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
      O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
      1. tchaning
        ce qui marrant , c'est que vous etes tous les meme a avoir ls meme virus ou malware lol
        bref coche et fix ces lignes à partir de hijackthis (après le scan fini)
        FERMER TOUTES LES APPLICATIONS Y COMPRIS INTERNET EXPLORER

        C:\Windows\odbn.exe
        C:\Windows\odbn.exe
        C:\Windows\odbn.exe
        R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
        O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
        O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
        O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
        O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
        O4 - HKLM\..\Run: [odbny] C:\Windows\odbn.exe
        O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
        O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMST.ORG
        O17 - HKLM\Software\..\Telephony: DomainName = SMST.ORG
        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMST.ORG
        O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe

        une fois fini, refait un scan et recolle le rapport
        1. pierreyann Auteur
          voici le hjt après fix:
          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 16:27:22, on 22/01/2010
          Platform: Windows XP SP3 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16981)
          Boot mode: Normal

          Running processes:
          C:\Windows\System32\smss.exe
          C:\Windows\system32\winlogon.exe
          C:\Windows\system32\services.exe
          C:\Windows\system32\lsass.exe
          C:\Windows\system32\svchost.exe
          C:\Windows\System32\svchost.exe
          C:\Windows\system32\svchost.exe
          C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
          C:\Windows\system32\spoolsv.exe
          C:\Program Files\Avira\AntiVir Desktop\sched.exe
          C:\Program Files\Avira\AntiVir Desktop\avguard.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\Windows\System32\NMSSvc.exe
          C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\Windows\System32\svchost.exe
          C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
          C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
          C:\Windows\Explorer.EXE
          C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
          C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
          C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
          C:\Windows\system32\PROMon.exe
          C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
          C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
          C:\Program Files\USB Disk Win98 Driver\Res.EXE
          C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
          C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
          C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
          C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
          C:\Compaq\EAKDRV\EAUSBKBD.EXE
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
          C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
          C:\Windows\system32\ctfmon.exe
          C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
          C:\Program Files\Palm\HOTSYNC.EXE
          C:\Documents and Settings\Administrateur\Mes documents\HiJackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
          O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
          O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
          O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
          O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
          O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
          O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
          O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
          O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
          O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
          O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
          O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
          O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
          O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
          O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
          O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe"
          O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
          O4 - Startup: HotSync Manager.LNK = C:\Program Files\Palm\HOTSYNC.EXE
          O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
          O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
          O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
          O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
          O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe
          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMST.ORG
          O17 - HKLM\Software\..\Telephony: DomainName = SMST.ORG
          O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMST.ORG
          O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
          O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
          O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
          O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
          O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
          2. tchaning
            fixe ces lignes

            R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
            O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
            O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMST.ORG
            O17 - HKLM\Software\..\Telephony: DomainName = SMST.ORG
            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMST.ORG

            Ensuite telecharger SDFIX : ==> http://sdfix.net/SDFix.exe)
            installer.

            Redemarrer le pc en mode sans echec ( Presser plusieur fois sur F8 au démarrage du pc )
            Choisir alors le mode sans echec .

            Une fois connecté dessus , tu vas dans : poste de travail : C:\SDFIX\ et tu lance "Run.This"

            Tu vaide par Y et tu suis ce qu'il te dis.

            Une fois fini, lance un scan Hijackthis et recolle de nouveau.
            1. pierreyann Auteur
              voici après sdfix :

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 19:08:24, on 22/01/2010
              Platform: Windows XP SP3 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16981)
              Boot mode: Normal

              Running processes:
              C:\Windows\System32\smss.exe
              C:\Windows\system32\winlogon.exe
              C:\Windows\system32\services.exe
              C:\Windows\system32\lsass.exe
              C:\Windows\system32\svchost.exe
              C:\Windows\System32\svchost.exe
              C:\Windows\system32\svchost.exe
              C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
              C:\Windows\system32\spoolsv.exe
              C:\Program Files\Avira\AntiVir Desktop\sched.exe
              C:\Program Files\Avira\AntiVir Desktop\avguard.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
              C:\Windows\System32\NMSSvc.exe
              C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
              C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              C:\Windows\System32\svchost.exe
              C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
              C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
              C:\Windows\Explorer.EXE
              C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
              C:\Windows\system32\notepad.exe
              C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
              C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
              C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
              C:\Windows\system32\PROMon.exe
              C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
              C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
              C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
              C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
              C:\Program Files\USB Disk Win98 Driver\Res.EXE
              C:\Compaq\EAKDRV\EAUSBKBD.EXE
              C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
              C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              C:\Windows\system32\ctfmon.exe
              C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
              C:\Program Files\Palm\HOTSYNC.EXE
              C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
              C:\Documents and Settings\Administrateur\Mes documents\HiJackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
              O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
              O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
              O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
              O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
              O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
              O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
              O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
              O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
              O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
              O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
              O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
              O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
              O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
              O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
              O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe"
              O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
              O4 - Startup: HotSync Manager.LNK = C:\Program Files\Palm\HOTSYNC.EXE
              O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
              O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
              O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
              O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
              O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe
              O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMST.ORG
              O17 - HKLM\Software\..\Telephony: DomainName = SMST.ORG
              O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMST.ORG
              O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
              O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
              O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
              O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
              O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
              O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
              O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
              1. tchaning
                regarde dans ajout suppression programme .
                desinstaller GoogleToolbarNotifier

                si ca ne marche pas, faire avec hijackthis le fixe
                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe­
                1. pierreyann Auteur
                  c'est fait ; par contre dans mon hijackthis, des lignes comprenant SMST.ORG sont réapparues alors que je les ai fixées hier.

                  voici mon hjt :

                  C:\Program Files\Avira\AntiVir Desktop\sched.exe
                  C:\Windows\Explorer.EXE
                  C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
                  C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
                  C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
                  C:\Windows\system32\PROMon.exe
                  C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
                  C:\Program Files\USB Disk Win98 Driver\Res.EXE
                  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
                  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  C:\Windows\system32\ctfmon.exe
                  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
                  C:\Program Files\Palm\HOTSYNC.EXE
                  C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
                  C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
                  C:\Compaq\EAKDRV\EAUSBKBD.EXE
                  C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                  C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
                  C:\Windows\System32\NMSSvc.exe
                  C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
                  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  C:\Windows\System32\svchost.exe
                  C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
                  C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
                  C:\Windows\system32\wuauclt.exe
                  C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
                  C:\Program Files\internet explorer\iexplore.exe
                  C:\Windows\system32\msiexec.exe
                  C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
                  C:\Documents and Settings\Administrateur\Mes documents\HiJackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
                  O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
                  O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
                  O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
                  O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
                  O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
                  O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
                  O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
                  O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                  O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
                  O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
                  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
                  O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
                  O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe"
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
                  O4 - Startup: HotSync Manager.LNK = C:\Program Files\Palm\HOTSYNC.EXE
                  O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                  O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
                  O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
                  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe
                  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMST.ORG
                  O17 - HKLM\Software\..\Telephony: DomainName = SMST.ORG
                  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMST.ORG
                  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
                  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
                  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
                  O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
                  O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
                  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
                  1. pierreyann Auteur
                    c'est fait ; par contre dans mon hijackthis, des lignes comprenant SMST.ORG sont réapparues alors que je les ai fixées hier.

                    voici mon hjt :

                    C:\Program Files\Avira\AntiVir Desktop\sched.exe
                    C:\Windows\Explorer.EXE
                    C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
                    C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
                    C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
                    C:\Windows\system32\PROMon.exe
                    C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
                    C:\Program Files\USB Disk Win98 Driver\Res.EXE
                    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
                    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
                    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    C:\Windows\system32\ctfmon.exe
                    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
                    C:\Program Files\Palm\HOTSYNC.EXE
                    C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
                    C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
                    C:\Compaq\EAKDRV\EAUSBKBD.EXE
                    C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                    C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
                    C:\Windows\System32\NMSSvc.exe
                    C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
                    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                    C:\Windows\System32\svchost.exe
                    C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
                    C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
                    C:\Windows\system32\wuauclt.exe
                    C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
                    C:\Program Files\internet explorer\iexplore.exe
                    C:\Windows\system32\msiexec.exe
                    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
                    C:\Documents and Settings\Administrateur\Mes documents\HiJackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
                    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
                    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
                    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
                    O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
                    O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
                    O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
                    O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
                    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                    O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                    O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
                    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
                    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
                    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
                    O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe"
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\Windows\System32\CTFMON.EXE (User 'Default user')
                    O4 - Startup: HotSync Manager.LNK = C:\Program Files\Palm\HOTSYNC.EXE
                    O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
                    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
                    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                    O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe
                    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMST.ORG
                    O17 - HKLM\Software\..\Telephony: DomainName = SMST.ORG
                    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMST.ORG
                    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
                    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
                    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
                    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
                    O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
                    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                    O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
                    2. tchaning
                      telecharger et lancer ceci:

                      http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                      http://www.genproc.com/GenProc.exe

                      refaire un scan hijackthis après ces deux processus.

                      (Donc poster le rapport Hijackthis et Genproc).

                      Merci :) :) :) :) :) :) :) :) :) :) :) :) :) :) :) :) :) :) :) :) :)

                      Discussions similaires

                      Softonic,est-ce un virus ?
                      techmel1

                      6 réponses
                      Chrome://newtab
                      Nova

                      14 réponses
                      Désinstaller Softonic
                      Diguimette

                      5 réponses
                      Supprimer New Tab
                      tysaozon

                      8 réponses
                      Bouton pause/break
                      frans003

                      3 réponses