[virus] IE s'ouvre quand j'écris

Question

Bonjour, Je pense avoir contracté un virus. Dès que j'écris (mail, MSN, ce message), IE se lance, ceci au bout de 3-4 lettres...J'ai scanné le dur (ad-aware, antivir), rien n'y fait.Voici le compte rendu HighjackThis:Logfile of HijackThis v1.99.1Scan saved at 18:46:54, on 07/03/2006Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS.0\System32\smss.exeC:\WINDOWS.0\system32\winlogon.exeC:\WINDOWS.0\system32\services.exeC:\WINDOWS.0\system32\lsass.exeC:\WINDOWS.0\system32\svchost.exeC:\WINDOWS.0\System32\svchost.exeC:\WINDOWS.0\system32\spoolsv.exeC:\Program Files\AVPersonal\AVGUARD.EXEC:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEC:\WINDOWS.0\System32
vsvc32.exeC:\WINDOWS.0\system32\slserv.exeC:\WINDOWS.0\wanmpsvc.exeC:\WINDOWS.0\SOUNDMAN.EXEC:\Program Files\ahead\InCD\InCD.exeC:\Program Files\Canon\MultiPASS4\monitr32.exeC:\PROGRA~1\Canon\MULTIP~1\MPTBox.exeC:\WINDOWS.0\System32undll32.exeC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exeC:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeC:\Program Files\AOL 8.0\waol.exeC:\Program Files\AOL 8.0\shellmon.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS.0\System32\wuauclt.exeC:\WINDOWS.0\explorer.exeC:\Program Files\AVPersonal\AVWIN.EXEC:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Local Settings\Temporary Internet Files\Content.IE5\WLGF4ZGR\HijackThis[1].exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.altnet.com/pm/installR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLLO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.0\System32\msdxm.ocxO3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS.0\system32\NeroCheck.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exeO4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exeO4 - HKLM\..\Run: [MPTBox] C:\PROGRA~1\Canon\MULTIP~1\MPTBox.exeO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /minO4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSCHED32.EXE /minO4 - HKLM\..\Run: [JVM0.14] C:\WINDOWS.0\System32\gazyl.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS.0\System32\P2P Networking\P2P Networking.exe /AUTOSTARTO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exeO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: AOL 8.0 Icône AOL.lnk = C:\Program Files\AOL 8.0\aoltray.exeO4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exeO4 - Global Startup: Picture Package Menu.lnk = ?O4 - Global Startup: Picture Package VCD Maker.lnk = ?O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS.0\System32\Shdocvw.dllO12 - Plugin for .PDF: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exeO16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://geo.sapo.pt/imp_cgi/mgaxctrl.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106493846369O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://jogos.sapo.pt/CLASSES/ExentCtl.ocxO16 - DPF: {82CF9738-0BDA-4AAF-AB08-5AC5875FF3BB} (YMultiRecord Class) - http://cms.escolavirtual.pt/data/pages/flash/recording/yrecording.cabO16 - DPF: {A5173EA8-1337-4BAB-A67E-198C9919D9CC} (Loader Class) - http://213.11.100.127/websetup/websetup2.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{6B8D4EC1-53B4-42ED-B33B-6C6003355371}: NameServer = 205.188.146.145O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXEO23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exeO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\System32
vsvc32.exeO23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS.0\SYSTEM32\slserv.exeO23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS.0\wanmpsvc.exePlease HELP!!Merci d'avance.

boulepate · Answer

Salut,
Relance HijackThis, choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked"

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O4 - HKLM\..\Run: [JVM0.14] C:\WINDOWS.0\System32\gazyl.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS.0\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exe
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://geo.sapo.pt/imp_cgi/mgaxctrl.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://jogos.sapo.pt/CLASSES/ExentCtl.ocx
O16 - DPF: {82CF9738-0BDA-4AAF-AB08-5AC5875FF3BB} (YMultiRecord Class) - http://cms.escolavirtual.pt/data/pages/flash/recording/yrecording.cab
O16 - DPF: {A5173EA8-1337-4BAB-A67E-198C9919D9CC} (Loader Class) - http://213.11.100.127/websetup/websetup2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab

Cliques sur demarrer, rechercher, cherches et supprimes ces fichiers:

gazyl.exe
Networking.exe

CLiques sur demarrer, poste de travail,C:, program files, cherches et supprimes ce dossier:

MyWay

Telecharge, installe puis mets à jour ce logiciel, une fois que c'est fait, fais un scan complet de ton systeme et colle le rapport ici avec un nouveau rapport hijackthis
Ewido:
http://www.01net.com/telecharger/windows/Utilitaire/antivirus/fiches/31851.html

A++

caracala · Answer

Hello,J'ai fait ce que tu m'as dit. Le problème persiste.Rapport Ewido :--------------------------------------------------------- ewido anti-malware - Rapport de scan--------------------------------------------------------- + Créé le:		06:52:25, 08/03/2006 + Somme de contrôle:	C1228487 + Résultats du scan:	C:\Documents and Settings\A\Cookies\a@112.2o7[2].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\A\Cookies\a@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder	C:\Documents and Settings\A\Cookies\a@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder	C:\Documents and Settings\A\Cookies\a@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\A\Cookies\a@opodo.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\A\Cookies\a@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\A\Cookies\a@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Nettoyer et sauvegarder	C:\Documents and Settings\A\Cookies\a@www.web-stat[1].txt -> TrackingCookie.Web-stat : Nettoyer et sauvegarder	C:\Documents and Settings\A\Local Settings\Temporary Internet Files\Content.IE5\1K8B15WL\entrar[1].html -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\A\Local Settings\Temporary Internet Files\Content.IE5\2WK5YO9V\003-sexo-mulheres-nuas.ck7[1] -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\A\Local Settings\Temporary Internet Files\Content.IE5\FPERCDMV\downloads_manager[1] -> Downloader.IstBar.j : Nettoyer et sauvegarder	C:\Documents and Settings\A\Local Settings\Temporary Internet Files\Content.IE5\WLQBC5QB\google[1].htm -> Downloader.IstBar.z : Nettoyer et sauvegarder	C:\Documents and Settings\A\Local Settings\Temporary Internet Files\Content.IE5\WNNVYKHL\sexo-mulheres-nuas.sexow[1] -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\A\Local Settings\Temporary Internet Files\Content.IE5\ZZTF3DSW\google[1].htm -> Downloader.IstBar.z : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\APZW9GNE\003-sexo-mulheres-nuas.ck7[2] -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\APZW9GNE\entrar[2].html -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\BBLFN1CW\003-sexo-mulheres-nuas.ck7[2] -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\BBLFN1CW\b[1].exe -> Downloader.Agent.jc : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\F75BZ1OW\b[1].14,2,0 -> Downloader.Agent.jc : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\G3BNIGDX\a[1].exe -> Downloader.Small.aaq : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\H0KBLDS5\003-sexo-mulheres-nuas.ck7[2] -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\H0KBLDS5\entrar[2].html -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\H0KBLDS5\entrar[3].html -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\WPIB0LQZ\003-sexo-mulheres-nuas.ck7[2] -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Anne Marie\Local Settings\Temporary Internet Files\Content.IE5\WPIB0LQZ\entrar[2].html -> Not-A-Virus.Exploit.HTML.Mht : Nettoyer et sauvegarder	C:\Documents and Settings\Correia\Cookies\correia@112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\Correia\Cookies\correia@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder	C:\Documents and Settings\Correia\Cookies\correia@aolfr.122.2o7[2].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\Correia\Cookies\correia@burstnet[2].txt -> TrackingCookie.Burstnet : Nettoyer et sauvegarder	C:\Documents and Settings\Correia\Cookies\correia@paypopup[1].txt -> TrackingCookie.Paypopup : Nettoyer et sauvegarder	C:\Documents and Settings\Correia\Cookies\correia@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Bureau\backups\backup-20060307-201053-934.dll -> Downloader.Agent.md : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@as1.falkag[2].txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@estat[1].txt -> TrackingCookie.Estat : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@wreport.weborama[1].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Cookiesafael@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder	C:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Local Settings\Temp	emp.fr17CC -> Adware.404Search : Nettoyer et sauvegarder	C:\Program Files\Windows Media Player\wmplayer.exe.tmp -> Downloader.Small.aaq : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP189\A0151355.exe -> Worm.Delf.i : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP191\A0151519.exe -> Adware.WebRebates : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP191\A0151520.exe -> Adware.WebRebates : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP191\A0151624.exe -> Worm.Delf.i : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP192\A0153495.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP192\A0153517.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP192\A0153538.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP193\A0153623.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP193\A0153665.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP193\A0153675.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP193\A0153763.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP193\A0153784.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP193\A0153858.exe -> Worm.Delf.i : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0153939.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0153973.exe -> Hijacker.Small.cx : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0153974.exe -> Hijacker.Small.cx : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0153975.exe -> Hijacker.Small.cx : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0153983.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0154004.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0155004.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP194\A0155025.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP195\A0155083.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP195\A0155111.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP195\A0155147.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP196\A0155177.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP196\A0155198.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP196\A0155219.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP196\A0156219.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP196\A0156242.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP197\A0156269.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\System Volume Information\_restore{81FA5C7A-E834-43A1-9A67-A9268E59CEE2}\RP197\A0156294.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	C:\WINDOWS.0\system32\P2P Networking -> Adware.P2PNetworking : Nettoyer et sauvegarder	C:\WINDOWS.0\system32\P2P Networking\Cache -> Adware.P2PNetworking : Nettoyer et sauvegarder	C:\WINDOWS.0\system32\P2P Networking\Cache\Database -> Adware.P2PNetworking : Nettoyer et sauvegarder	C:\WINDOWS.0\system32\P2P Networking\MARSHAL2.DLL -> Adware.P2PNetworking : Nettoyer et sauvegarder	C:\WINDOWS.0\system32\P2P Networking\P2P Networking.ENG -> Adware.P2PNetworking : Nettoyer et sauvegarder::Fin du rapportRapport HighjackThis :Logfile of HijackThis v1.99.1Scan saved at 14:23:20, on 08/03/2006Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS.0\System32\smss.exeC:\WINDOWS.0\system32\winlogon.exeC:\WINDOWS.0\system32\services.exeC:\WINDOWS.0\system32\lsass.exeC:\WINDOWS.0\system32\svchost.exeC:\WINDOWS.0\System32\svchost.exeC:\WINDOWS.0\system32\spoolsv.exeC:\Program Files\AVPersonal\AVGUARD.EXEC:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEC:\WINDOWS.0\System32
vsvc32.exeC:\WINDOWS.0\system32\slserv.exeC:\WINDOWS.0\wanmpsvc.exeC:\WINDOWS.0\Explorer.EXEC:\WINDOWS.0\SOUNDMAN.EXEC:\Program Files\ahead\InCD\InCD.exeC:\Program Files\Canon\MultiPASS4\monitr32.exeC:\PROGRA~1\Canon\MULTIP~1\MPTBox.exeC:\WINDOWS.0\System32undll32.exeC:\Program Files\AVPersonal\AVGNT.EXEC:\Program Files\AVPersonal\AVSCHED32.EXEC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeC:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exeC:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exeC:\Program Files\AOL 8.0\waol.exeC:\Program Files\AOL 8.0\shellmon.exeC:\WINDOWS.0\System32\wuauclt.exeC:\WINDOWS.0\system32\NOTEPAD.EXEC:\Documents and Settings\Rafael.GJ7NTSCCYUJIP7A\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.0\System32\msdxm.ocxO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS.0\system32\NeroCheck.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exeO4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exeO4 - HKLM\..\Run: [MPTBox] C:\PROGRA~1\Canon\MULTIP~1\MPTBox.exeO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /minO4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSCHED32.EXE /minO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: AOL 8.0 Icône AOL.lnk = C:\Program Files\AOL 8.0\aoltray.exeO4 - Global Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exeO4 - Global Startup: Picture Package Menu.lnk = ?O4 - Global Startup: Picture Package VCD Maker.lnk = ?O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS.0\System32\Shdocvw.dllO12 - Plugin for .PDF: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106493846369O17 - HKLM\System\CCS\Services\Tcpip\..\{6B8D4EC1-53B4-42ED-B33B-6C6003355371}: NameServer = 205.188.146.145O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXEO23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exeO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\System32
vsvc32.exeO23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS.0\SYSTEM32\slserv.exeO23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS.0\wanmpsvc.exeQue faire? Merci d'avance.

[virus] IE s'ouvre quand j'écris

2 réponses

Votre réponse

Discussions similaires

Newsletters