Yen a tant que je sais pas ou commencer !

va voir ici , secuser propose un antivirus en ligne qui detecte mais nettoie egalement

http://www.secuser.com/outils/antivirus.htm

Bonjour madamcolomb,

Faites ceci :

TELECHARGE

1/

CleanUp! :
http://pageperso.aol.fr/Balltrap34/CleanUp40.exe
- Aide en image (merci à Balltrap34) :
http://pageperso.aol.fr/balltrap34/democleanup.htm

2/
Spybot S&D 1.4 <<nouvelle version.
http://www.safer-networking.org/fr/index.html

Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

3/

Ad-Aware SE 1.06 <<nouvelle version.
http://www.lavasoftusa.com/software/adaware/
-Une aide:
http://www.tutopat.com/viewtopic.php?t=1191
- installe le patch français, tu pourras le trouver ici:
http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
http://pageperso.aol.fr/balltrap34/adawrevid.asf

4/
http://www.hijackthis.de/downloads/hijackthis_199.zip

Le dézipper dans un dossier prévu à cet effet.
Par exemple C:\hijackthis < c : ! (Cela permet des back up en cas de mauvaises suppressions)
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/Hijenr.gif

L’exécuter puis sur "do a system scan and save logfile" (cf. démo)

faire un copier coller du log entier sur le forum VIRUS/SECURITE

Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm

un petit curetage
ewido (dowload)
http://www.ewido.net/fr/download/
COLLER le rapport

Bon courage
A+

voici ce que j'ai récupéré
si tu peux en faire bon usage !! merci
ah j'avais oublié, j'avais aussi ADAWARE dans mes logiciels de nettoyage !!

Logfile of HijackThis v1.99.1
Scan saved at 12:02:35, on 19/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
C:\windows\winsysban9.exe
C:\WINDOWS\System32\oleupdate.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\hal.exe
C:\WINDOWS\system32\inetdns.exe
C:\WINDOWS\system32\MDN.exe
C:\WINDOWS\netconf32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\zebulon\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {F27E6D61-84A7-FC27-869D-A30FD7E240C5} - C:\WINDOWS\System32\dmx.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RieMon Class - {70F6A776-579A-4C95-BA88-134253907752} - C:\WINDOWS\System32\irsmgeht.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ADOUsefulNet Object - {7CB093AC-11DF-46D5-9343-CE4BD90C159C} - C:\WINDOWS\System32\jkhhi.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {EA32FB3B-21C9-42cc-B8EF-01A9B28EDB0D} - C:\WINDOWS\system32\ddcca.dll
O2 - BHO: (no name) - {F27E6D61-84A7-FC27-869D-A30FD7E240C5} - C:\WINDOWS\System32\dmx.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O4 - HKLM\..\Run: [Microsoft Update] msconfg.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd9.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames9.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban9.exe
O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Win Update] C:\WINDOWS\System32\oleupdate.exe
O4 - HKLM\..\RunServices: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update] msconfg.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [wzom] C:\PROGRA~1\FICHIE~1\wzom\wzomm.exe
O4 - HKCU\..\Run: [Ilru] "C:\Program Files\srho\dset.exe" -vt yazb
O4 - HKCU\..\Run: [Hcatpn] C:\WINDOWS\System32\??rvices.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\System32\irssyncd.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\swinqsap.exe
O4 - Startup: Z_Start.lnk = C:\WINDOWS\ZIFI002.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab
O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.servicesalacarte.wanadoo.fr/activex/zylomgamesplayer.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://fr.errorsafe.com/pages/scanner_fr/ErrorSafeScannerInstallFR.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {2F6E85DC-8D2D-4896-8A4F-7DF8A7B1749D} - C:\PROGRA~1\Jalmp\jalmp.dll
O20 - Winlogon Notify: ddcca - C:\WINDOWS\SYSTEM32\ddcca.dll
O20 - Winlogon Notify: jkhhi - C:\WINDOWS\System32\jkhhi.dll
O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\vsscript.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: fwnet64 (fwnet) - Unknown owner - C:\WINDOWS\fwnet64.exe (file missing)
O23 - Service: mswmf32 - Unknown owner - C:\WINDOWS\mswmf32.exe (file missing)
O23 - Service: netconf32 - Unknown owner - C:\WINDOWS\netconf32.exe
O23 - Service: nvidGUIv (nvidGUIv2) - Unknown owner - C:\WINDOWS\nvidGUIv.exe (file missing)

ET LA SUITE SORT D'ADAWARE

Ad-Aware SE Build 1.06r1
Logfile Created on:dimanche 19 février 2006 11:55:09
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R92 14.02.2006
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Adware.Freeprod Toolbar(TAC index:3):5 total references
MRU List(TAC index:0):13 total references
UCmore(TAC index:3):4 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects

19-02-2006 11:55:09 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\zebulon\recent
Description : list of recently opened documents

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\google\navclient\1.1\history
Description : list of recently used search terms in the google toolbar

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X

MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\mediaplayer\preferences
Description : last playlist index loaded in microsoft windows media player

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

MRU List Object Recognized!
Location: : S-1-5-21-1957994488-562591055-682003330-1003\software\winrar\dialogedithistory\extrpath
Description : winrar "extract-to" history

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 432
ThreadCreationTime : 19-02-2006 07:41:22
BasePriority : Normal

#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 488
ThreadCreationTime : 19-02-2006 07:41:24
BasePriority : Normal

#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 512
ThreadCreationTime : 19-02-2006 07:41:25
BasePriority : High

#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 556
ThreadCreationTime : 19-02-2006 07:41:26
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Système d'exploitation Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Applications Services et Contrôleur
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Tous droits réservés.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 568
ThreadCreationTime : 19-02-2006 07:41:26
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 748
ThreadCreationTime : 19-02-2006 07:41:27
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 800
ThreadCreationTime : 19-02-2006 07:41:27
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 864
ThreadCreationTime : 19-02-2006 07:41:28
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 884
ThreadCreationTime : 19-02-2006 07:41:28
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1260
ThreadCreationTime : 19-02-2006 07:41:34
BasePriority : Normal
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:11 [ashdisp.exe]
FilePath : C:\PROGRA~1\ALWILS~1\Avast4\
ProcessID : 1472
ThreadCreationTime : 19-02-2006 07:41:39
BasePriority : Normal
FileVersion : 4, 6, 753, 0
ProductVersion : 4, 6, 0, 0
ProductName : avast! Antivirus
FileDescription : avast! service GUI component
InternalName : aswDisp
LegalCopyright : Copyright (c) 2006 ALWIL Software
OriginalFilename : aswDisp.exe

#:12 [jusched.exe]
FilePath : C:\Program Files\Java\jre1.5.0_06\bin\
ProcessID : 1480
ThreadCreationTime : 19-02-2006 07:41:39
BasePriority : Normal

#:13 [camtray.exe]
FilePath : C:\Program Files\Creative\Shared Files\
ProcessID : 1488
ThreadCreationTime : 19-02-2006 07:41:39
BasePriority : Normal
FileVersion : 3.50.08
ProductVersion : 3.50
ProductName : Creative Cam Detector
CompanyName : Creative Technology Ltd
FileDescription : Creative Camera Launcher Application
InternalName : Creative Camera Launcher Application
LegalCopyright : Copyright (c) Creative Technology Ltd., 2002-2004. All rights reserved.
OriginalFilename : CamTray.EXE

#:14 [winsysban9.exe]
FilePath : C:\windows\
ProcessID : 1512
ThreadCreationTime : 19-02-2006 07:41:39
BasePriority : Normal
FileVersion : 1.00
ProductVersion : 1.00
ProductName : Project1
CompanyName : ÄÂÃÌÀ
InternalName : test
OriginalFilename : test.exe

#:15 [oleupdate.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1528
ThreadCreationTime : 19-02-2006 07:41:40
BasePriority : Normal

#:16 [ctfmon.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1536
ThreadCreationTime : 19-02-2006 07:41:40
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:17 [msmsgs.exe]
FilePath : C:\Program Files\Messenger\
ProcessID : 1544
ThreadCreationTime : 19-02-2006 07:41:40
BasePriority : Normal
FileVersion : 4.0.0155
ProductVersion : Version 4.0
ProductName : Messenger
CompanyName : Microsoft Corporation
FileDescription : Messenger Client
InternalName : msmsgs
LegalCopyright : Copyright (c) Microsoft Corporation 1997-2001
LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msmsgs.exe

#:18 [msnmsgr.exe]
FilePath : C:\Program Files\MSN Messenger\
ProcessID : 1556
ThreadCreationTime : 19-02-2006 07:41:40
BasePriority : Normal
FileVersion : 7.5.0311
ProductVersion : 7.5.0311
ProductName : MSN Messenger
CompanyName : Microsoft Corporation
FileDescription : MSN Messenger
InternalName : msnmsgr
LegalCopyright : Copyright (c) Microsoft Corporation 1997-2004
LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msnmsgr.exe

#:19 [skype.exe]
FilePath : C:\Program Files\Skype\Phone\
ProcessID : 1564
ThreadCreationTime : 19-02-2006 07:41:40
BasePriority : Normal

#:20 [wzqkpick.exe]
FilePath : C:\Program Files\WinZip\
ProcessID : 1584
ThreadCreationTime : 19-02-2006 07:41:41
BasePriority : Normal
FileVersion : 1.0 (32-bit)
ProductVersion : 9.0 (6224f)
ProductName : WinZip
CompanyName : WinZip Computing, Inc.
FileDescription : WinZip Executable
InternalName : WZQKPICK.EXE
LegalCopyright : Copyright (c) WinZip Computing, Inc. 1991-2004 - All Rights Reserved
LegalTrademarks : WinZip is a registered trademark of WinZip Computing, Inc
OriginalFilename : WZQKPICK.EXE
Comments : StringFileInfo: French

#:21 [aswupdsv.exe]
FilePath : C:\Program Files\Alwil Software\Avast4\
ProcessID : 1736
ThreadCreationTime : 19-02-2006 07:41:48
BasePriority : Normal

#:22 [ashserv.exe]
FilePath : C:\Program Files\Alwil Software\Avast4\
ProcessID : 1768
ThreadCreationTime : 19-02-2006 07:41:49
BasePriority : High
FileVersion : 4, 6, 753, 0
ProductVersion : 4, 6, 0, 0
ProductName : avast! Antivirus
FileDescription : avast! antivirus service
InternalName : aswServ
LegalCopyright : Copyright (c) 2006 ALWIL Software
OriginalFilename : aswServ.exe

#:23 [ewidoctrl.exe]
FilePath : C:\Program Files\ewido anti-malware\
ProcessID : 1804
ThreadCreationTime : 19-02-2006 07:41:50
BasePriority : Normal
FileVersion : 3, 0, 0, 1
ProductVersion : 3, 0, 0, 1
ProductName : ewido control
CompanyName : ewido networks
FileDescription : ewido control
InternalName : ewido control
LegalCopyright : Copyright © 2004
OriginalFilename : ewidoctrl.exe

#:24 [hal.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1836
ThreadCreationTime : 19-02-2006 07:41:50
BasePriority : Normal
FileVersion : 5, 1 2600, 0 (windows client)
ProductVersion : 5, 1, 2600, 0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
InternalName : hal
LegalCopyright : Copyright © 2005
OriginalFilename : hal.exe

#:25 [inetdns.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1932
ThreadCreationTime : 19-02-2006 07:41:53
BasePriority : Normal
FileVersion : 5, 1 2600, 0 (windows client)
ProductVersion : 5, 1, 2600, 0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
InternalName : inetdns
LegalCopyright : Copyright © 2005
OriginalFilename : inetdns.exe

#:26 [mdn.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 2008
ThreadCreationTime : 19-02-2006 07:41:55
BasePriority : Normal
FileVersion : 6.0.0.1.2
ProductVersion : 6.0.0.1.2
ProductName : Microsoft Windows Operating System
CompanyName : Microsoft Corporation
InternalName : Microsoft Dynamic Network
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : MDN.exe

#:27 [netconf32.exe]
FilePath : C:\WINDOWS\
ProcessID : 400
ThreadCreationTime : 19-02-2006 07:41:59
BasePriority : Normal

#:28 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 968
ThreadCreationTime : 19-02-2006 07:42:00
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:29 [ashwebsv.exe]
FilePath : C:\Program Files\Alwil Software\Avast4\
ProcessID : 3948
ThreadCreationTime : 19-02-2006 07:42:12
BasePriority : Normal

#:30 [ashmaisv.exe]
FilePath : C:\Program Files\Alwil Software\Avast4\
ProcessID : 4264
ThreadCreationTime : 19-02-2006 07:42:30
BasePriority : Normal

#:31 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 5120
ThreadCreationTime : 19-02-2006 07:42:45
BasePriority : Normal
FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
ProductVersion : 6.00.2600.0000
ProductName : Système d'exploitation Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Explorateur Windows
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Tous droits réservés.
OriginalFilename : EXPLORER.EXE

#:32 [cmd.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 5884
ThreadCreationTime : 19-02-2006 07:44:13
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Système d'exploitation Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Interpréteur de commandes Windows
InternalName : cmd
LegalCopyright : © Microsoft Corporation. Tous droits réservés.
OriginalFilename : Cmd.Exe

#:33 [iexplore.exe]
FilePath : C:\Program Files\Internet Explorer\
ProcessID : 1368
ThreadCreationTime : 19-02-2006 10:36:27
BasePriority : Normal
FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
ProductVersion : 6.00.2600.0000
ProductName : Système d'exploitation Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
LegalCopyright : © Microsoft Corporation. Tous droits réservés.
OriginalFilename : IEXPLORE.EXE

#:34 [spybotsd.exe]
FilePath : C:\Program Files\Spybot - Search & Destroy\
ProcessID : 5724
ThreadCreationTime : 19-02-2006 10:47:11
BasePriority : Normal
FileVersion : 1.4.0.3
ProductVersion : 1, 4, 0, 3
ProductName : SpyBot-S&D
CompanyName : Safer Networking Limited
FileDescription : Spybot - Search & Destroy
InternalName : SpybotSD
LegalCopyright : © 2000-2005 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten.
LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.
OriginalFilename : SpyBotSD.exe
Comments : Software zum Entfernen von Spyware und ähnlichen Bedrohungen.

#:35 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 2292
ThreadCreationTime : 19-02-2006 10:53:12
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 13

Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

UCmore Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{44be0690-5429-47f0-85bb-3ffd8020233e}

UCmore Object Recognized!
Type : Regkey
Data :
TAC Rating : 3
Category : Data Miner
Comment :
Rootkey : HKEY_USERS
Object : S-1-5-21-1957994488-562591055-682003330-1003\software\maxthon\plugin\toolbar\{44be0690-5429-47f0-85bb-3ffd8020233e}

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment : "{44BE0690-5429-47F0-85BB-3FFD8020233E}"
Rootkey : HKEY_USERS
Object : S-1-5-21-1957994488-562591055-682003330-1003\software\microsoft\internet explorer\toolbar\webbrowser
Value : {44BE0690-5429-47F0-85BB-3FFD8020233E}

UCmore Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Data Miner
Comment : "{44BE0690-5429-47f0-85BB-3FFD8020233E}"
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\toolbar
Value : {44BE0690-5429-47f0-85BB-3FFD8020233E}

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 4
Objects found so far: 17

Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 17

Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 17

Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Adware.Freeprod Toolbar Object Recognized!
Type : File
Data : mc-110-12-0000228.exe
TAC Rating : 3
Category : Adware
Comment :
Object : C:\

Adware.Freeprod Toolbar Object Recognized!
Type : File
Data : mc-110-12-0000228.exe
TAC Rating : 3
Category : Adware
Comment :
Object : C:\Program Files\Fichiers communs\Download\

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 19

Deep scanning and examining files (D:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 19

Deep scanning and examining files (G:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for G:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 19

Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 19

Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Adware.Freeprod Toolbar Object Recognized!
Type : RegValue
Data :
TAC Rating : 3
Category : Adware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\windows\currentversion\internet settings
Value : GlobalUserOffline

Adware.Freeprod Toolbar Object Recognized!
Type : Folder
TAC Rating : 3
Category : Adware
Comment : Adware.Freeprod Toolbar
Object : C:\Program Files\Fichiers communs\InetGet

Adware.Freeprod Toolbar Object Recognized!
Type : Folder
TAC Rating : 3
Category : Adware
Comment : Adware.Freeprod Toolbar
Object : C:\Program Files\Fichiers communs\Download

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 3
Objects found so far: 22

12:43:11 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:48:01.563
Objects scanned:97857
Objects identified:9
Objects ignored:0
New critical objects:9

Bonjour madamecolombo2006,

Faites ceci à présent :

- Télécharge et scanne ton PC avec Ewido Security Suite : http://www.01net.com/telecharger/windows/Utilitaire/antivirus/fiches/31851.html
Copie/colle le rapport sur le forum.
--

"I don't mean to be mean but that's all I can be is just me" (Eminem)

bonjour tout le monde :)

salut Marie, Kristopher ...

-------------------------------
... WinErr 01B : Erreur illégale - Windows ne vous a pas autorisé à avoir cette erreur

-voici maintenant le rapport d'ewido !
merci de m'aider, j'en ai marre
--------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 16:14:16, 19/02/2006
+ Somme de contrôle: 97AAFCF

+ Résultats du scan:

HKLM\SOFTWARE\Classes\CLSID\{EA32FB3B-21C9-42cc-B8EF-01A9B28EDB0D} -> Adware.Virtumonde : Nettoyer et sauvegarder
HKLM\SOFTWARE\Effective-i -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA32FB3B-21C9-42cc-B8EF-01A9B28EDB0D} -> Adware.Virtumonde : Nettoyer et sauvegarder
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UCmore - The Search Accelerator -> Adware.UCmore : Nettoyer et sauvegarder
HKU\S-1-5-21-1957994488-562591055-682003330-1003\Software\Effective-i -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKU\S-1-5-21-1957994488-562591055-682003330-1003\Software\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKU\S-1-5-21-1957994488-562591055-682003330-1003\Software\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
[1536] C:\WINDOWS\System32\oleupdate.exe -> Proxy.Agent.hd : Nettoyer et sauvegarder
[208] C:\WINDOWS\system32\inetdns.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
[1432] C:\WINDOWS\netconf32.exe -> Backdoor.SdBot.xd : Nettoyer et sauvegarder
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\XGHIJ2LV\update181[1].exe -> Proxy.Agent.hd : Nettoyer et sauvegarder
C:\Documents and Settings\zebulon\Cookies\zebulon@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder
C:\Documents and Settings\zebulon\Cookies\zebulon@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
C:\Documents and Settings\zebulon\Cookies\zebulon@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyer et sauvegarder
C:\Documents and Settings\zebulon\Cookies\zebulon@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
C:\Documents and Settings\zebulon\Local Settings\Temp\ICD1.tmp\UERSV_0001_N68M0602NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
C:\iexplorer.exe -> Proxy.Agent.hd : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\INSTALL.LOG -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\IUCmore.dll -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\logo.ico -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\toolbar.cfg -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\UNWISE.EXE -> Adware.UCmore : Nettoyer et sauvegarder
C:\ucmoreiex.exe/UCMTSAIE.DLL -> Adware.Ucmore : Nettoyer et sauvegarder
C:\ucmoreiex.exe/IUCMORE.DLL -> Adware.Ucmore : Nettoyer et sauvegarder
C:\WINDOWS\Downloaded Program Files\UERSV_0001_N68M0602NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
C:\WINDOWS\netconf32.exe -> Backdoor.SdBot.xd : Nettoyer et sauvegarder
C:\WINDOWS\system32\awvvt.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\ddccc.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\geedd.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\MDN.exe -> Backdoor.SdBot.alv : Nettoyer et sauvegarder
C:\WINDOWS\system32\mdn_140.exe -> Backdoor.SdBot.alv : Nettoyer et sauvegarder
C:\WINDOWS\system32\mljgg.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\oleupdate.exe -> Proxy.Agent.hd : Nettoyer et sauvegarder
C:\WINDOWS\system32\pmkhg.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\pmkjh.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\pmnlm.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\pmnnl.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\system32\spxp.exe -> Backdoor.Rbot : Nettoyer et sauvegarder
C:\WINDOWS\system32\vtsqn.dll -> Adware.Virtumonde : Nettoyer et sauvegarder
C:\WINDOWS\Temp\adv.exe -> Downloader.Agent.aer : Nettoyer et sauvegarder

::Fin du rapport