J'ai plein de trojans et de virus

bonjour,

télécharge ewido :

https://www.avg.com/en-ww/free-antivirus-download

installes le, met le à jour et scan
(Important: pendant l'installation, sur la page "Additional Options" décoche les deux options "Install background guard" et "Install scan via context menu").

télécharge HijackThis, clique sur do a system scan and save a log file:
http://www.merijn.org/files/hijackthis.zip

Poste le rapport ewido et hijackthis.

a+

salut merci d'avoir repondu aussi vite !

alors j'ai fait ce que tu m'as dit ewido m'a supprimé deux virus mais j'ai pas trouvé comment faire un rapport (je suis nul désolé)

voila ce que me dit hijack :

Logfile of HijackThis v1.99.1
Scan saved at 19:34:41, on 16/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\a-squared\a2guard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\TEMP\ddl321F.tmp.exe
C:\WINDOWS\TEMP\ddl3223.tmp.exe
C:\WINDOWS\TEMP\ddl327D.tmp.exe
C:\WINDOWS\TEMP\ddl3281.tmp.exe
C:\WINDOWS\TEMP\ddl3287.tmp.exe
C:\WINDOWS\TEMP\ddl3300.tmp.exe
C:\WINDOWS\TEMP\ddl3326.tmp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Compaq_Propriétaire\Bureau\ewido-setup.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\Documents and Settings\Compaq_Propriétaire\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr7/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: winetn32 - C:\WINDOWS\SYSTEM32\winetn32.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

voila j'espere que j'ai bien fait

argh non en fait desolé j'ai été trop vite ewido a pas fini le scan :(

heu ben merci pour "bourricot" ca fait plaisir :(

voila le rapport que m'a fait ewido :

---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 21:56:47, 16/05/2006
+ Somme de contrôle: C559447E

+ Résultats du scan:

C:\Documents and Settings\Compaq_Propriétaire\Bureau\Temporary Internet Files\Content.IE5\PBBECVAQ\srvtmj[1].exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder
C:\Documents and Settings\Compaq_Propriétaire\Cookies\compaq_propriétaire@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win3230.tmp.exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win3231.tmp.exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win3237.tmp.exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win3360.tmp.exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win3363.tmp.exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win3370.tmp.exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder
C:\WINDOWS\Temp\win3378.tmp.exe -> Dropper.Agent.ajc : Nettoyer et sauvegarder

::Fin du rapport

voila il m'a donc effacé neuf fichiers malsains je vais faire un autre scan sur secuser pour etre sur qu' il reste plus rien

merci pour tout (en esperant que tout soit parti)

re,

je conseille plutôt kaspersky :

https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

poste le rapport kaspersky et un nouveau hijackthis

a+

oui
kasper
ou

bitdef qui corrige
http://www.bitdefender.fr/scan8/ie.html

resalut je met le rapport de kaspersky :

Wednesday, May 17, 2006 7:33:55 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 16/05/2006
Kaspersky Anti-Virus database records: 182614

Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\
M:\
N:\
O:\
P:\
Q:\
R:\
S:\

Scan Statistics
Total number of scanned objects 151071
Number of viruses found 5
Number of infected objects 8
Number of suspicious objects 0
Duration of the scan process 02:38:56

Infected Object Name Virus Name Last Action
C:\Documents and Settings\Compaq_Propriétaire\Bureau\Temporary Internet Files\Content.IE5\0ES7Y8FX\srvewf[1].exe Infected: Trojan-Dropper.Win32.Small.aoi skipped

C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Temp\win8C.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped

C:\WINDOWS\system32\ldAEBE.tmp Infected: Trojan-Downloader.Win32.Zlob.ni skipped

C:\WINDOWS\system32\regperf.exe Infected: Trojan-Downloader.Win32.Zlob.ni skipped

C:\WINDOWS\system32\winetn32.dll Infected: Trojan.Win32.Agent.qt skipped

C:\WINDOWS\Temp\win33B7.tmp.exe Infected: Trojan-Dropper.Win32.Small.aoi skipped

C:\WINDOWS\Temp\win3515.tmp.exe Infected: Trojan-Dropper.Win32.Agent.ajc skipped

C:\WINDOWS\Temp\win3516.tmp.exe Infected: Trojan-Dropper.Win32.Small.aoi skipped

Scan process completed.

le dernier hijack :

Logfile of HijackThis v1.99.1
Scan saved at 07:43:45, on 17/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\TEMP\ddl321F.tmp.exe
C:\WINDOWS\TEMP\ddl3223.tmp.exe
C:\WINDOWS\TEMP\ddl327D.tmp.exe
C:\WINDOWS\TEMP\ddl3281.tmp.exe
C:\WINDOWS\TEMP\ddl3287.tmp.exe
C:\WINDOWS\TEMP\ddl3300.tmp.exe
C:\WINDOWS\TEMP\ddl3326.tmp.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\TEMP\ddl431E.tmp.exe
C:\WINDOWS\TEMP\ddlA6D2.tmp.exe
C:\WINDOWS\TEMP\ddlA6DA.tmp.exe
C:\WINDOWS\TEMP\ddlA6E0.tmp.exe
C:\WINDOWS\TEMP\ddlA6E5.tmp.exe
C:\WINDOWS\TEMP\ddlA6EA.tmp.exe
C:\WINDOWS\TEMP\ddlA6F0.tmp.exe
C:\Documents and Settings\Compaq_Propriétaire\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr7/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: winetn32 - C:\WINDOWS\SYSTEM32\winetn32.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

je lance le scan de bitdefender et je vais au taf a plus

ca fait peur quand meme tout ca de trojans et depuis peu j'ai des boites de dialogue qui apparaissent n'importe quand des "dialers" avec des messages en italien...

qu'est qui se passe qqun essaye de prendre le controle de mon pc?
qu'est ce que je risque réelemment ?
j'ai une derniere question a quoi ca sert en fait hijack? (désolé de ma noobitude)

hello
on tente de réparer d abord
===========
hijack est un outil de détection et de réparation
qques fois insuffisant, ce qui oblige à utiliser d autres techniques
=========
pour le détail on verra qd tu seras guéri
lis cependant cet abécédaire :
https://sebsauvage.net/safehex.html
=======
pour revenir à ton blem
commence par faire ceci
qui dégotera ss doute qques merdes

Télécharger ceci (merci a S!RI pour ce petit programme) :
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
L'exécuter, puis double-cliquer sur Smitfraudfix.cmd
Choisir l’option 1, il va générer un rapport
Copier-coller ce dernier dans un message sur le forum.
En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

salut salut merci pour la liste que tu as postée c'est tres interressant je crois que pour commencer je vais arreter d'utiliser internet explorer !

voila le rapport smitfraud:

SmitFraudFix v2.44

Rapport fait à 17:09:19,11, 17/05/2006
Executé à partir de C:\Documents and Settings\Compaq_Propri‚taire\Bureau\smitfraud
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ld????.tmp PRESENT !
C:\WINDOWS\system32\ncompat.tlb PRESENT !
C:\WINDOWS\system32\regperf.exe PRESENT !
C:\WINDOWS\system32\stdole3.tlb PRESENT !
C:\WINDOWS\system32\1024\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Propri‚taire\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\COMPAQ~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

et voila le rapport bitdefender:

BitDefender Online Scanner

Scan report generated at: Wed, May 17, 2006 - 10:42:33

Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;O:\;P:\;Q:\;R:\;S:\;

Statistics

Time
02:51:29

Files
571522

Folders
9186

Boot Sectors
3

Archives
15521

Packed Files
45381

Results

Identified Viruses
5

Infected Files
43

Suspect Files
46

Warnings
0

Disinfected
0

Deleted Files
70

Engines Info

Virus Definitions
375259

Engine build
AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

Scan plugins
13

Archive plugins
40

Unpack plugins
4

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\Documents and Settings\Compaq_Propriétaire\Bureau\Temporary Internet Files\Content.IE5\PBBECVAQ\srvcjd[1].exe
Infected with: Dropped:Trojan.Downloader.Small.CML

C:\Documents and Settings\Compaq_Propriétaire\Bureau\Temporary Internet Files\Content.IE5\PBBECVAQ\srvcjd[1].exe
Disinfection failed

C:\Documents and Settings\Compaq_Propriétaire\Bureau\Temporary Internet Files\Content.IE5\PBBECVAQ\srvcjd[1].exe
Deleted

C:\WINDOWS\system32\regperf.exe
Infected with: Trojan.Downloader.Zlob.NI

C:\WINDOWS\system32\regperf.exe
Disinfection failed

C:\WINDOWS\system32\regperf.exe
Delete failed

C:\WINDOWS\system32\winetn32.dll
Infected with: Backdoor.Sualimpo.B

C:\WINDOWS\system32\winetn32.dll
Disinfection failed

C:\WINDOWS\system32\winetn32.dll
Delete failed

C:\WINDOWS\Temp\cli3217.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3217.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3217.tmp
Deleted

C:\WINDOWS\Temp\cli322C.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli322C.tmp
Disinfection failed

C:\WINDOWS\Temp\cli322C.tmp
Deleted

C:\WINDOWS\Temp\cli3234.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3234.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3234.tmp
Deleted

C:\WINDOWS\Temp\cli3239.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3239.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3239.tmp
Deleted

C:\WINDOWS\Temp\cli323F.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli323F.tmp
Disinfection failed

C:\WINDOWS\Temp\cli323F.tmp
Deleted

C:\WINDOWS\Temp\cli3243.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3243.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3243.tmp
Deleted

C:\WINDOWS\Temp\cli3252.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3252.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3252.tmp
Deleted

C:\WINDOWS\Temp\cli325A.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli325A.tmp
Disinfection failed

C:\WINDOWS\Temp\cli325A.tmp
Deleted

C:\WINDOWS\Temp\cli325E.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli325E.tmp
Disinfection failed

C:\WINDOWS\Temp\cli325E.tmp
Deleted

C:\WINDOWS\Temp\cli3263.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3263.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3263.tmp
Deleted

C:\WINDOWS\Temp\cli3268.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3268.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3268.tmp
Deleted

C:\WINDOWS\Temp\cli3270.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3270.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3270.tmp
Deleted

C:\WINDOWS\Temp\cli3274.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3274.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3274.tmp
Deleted

C:\WINDOWS\Temp\cli327A.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli327A.tmp
Disinfection failed

C:\WINDOWS\Temp\cli327A.tmp
Deleted

C:\WINDOWS\Temp\cli327E.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli327E.tmp
Disinfection failed

C:\WINDOWS\Temp\cli327E.tmp
Deleted

C:\WINDOWS\Temp\cli3284.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3284.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3284.tmp
Deleted

C:\WINDOWS\Temp\cli3288.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3288.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3288.tmp
Deleted

C:\WINDOWS\Temp\cli3290.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3290.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3290.tmp
Deleted

C:\WINDOWS\Temp\cli3366.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3366.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3366.tmp
Deleted

C:\WINDOWS\Temp\cli3376.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3376.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3376.tmp
Deleted

C:\WINDOWS\Temp\cli337B.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli337B.tmp
Disinfection failed

C:\WINDOWS\Temp\cli337B.tmp
Deleted

C:\WINDOWS\Temp\cli337F.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli337F.tmp
Disinfection failed

C:\WINDOWS\Temp\cli337F.tmp
Deleted

C:\WINDOWS\Temp\cli3383.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3383.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3383.tmp
Deleted

C:\WINDOWS\Temp\cli3511.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3511.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3511.tmp
Deleted

C:\WINDOWS\Temp\cli3519.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3519.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3519.tmp
Deleted

C:\WINDOWS\Temp\cli352B.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli352B.tmp
Disinfection failed

C:\WINDOWS\Temp\cli352B.tmp
Deleted

C:\WINDOWS\Temp\cli3A38.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3A38.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3A38.tmp
Deleted

C:\WINDOWS\Temp\cli3D11.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli3D11.tmp
Disinfection failed

C:\WINDOWS\Temp\cli3D11.tmp
Deleted

C:\WINDOWS\Temp\cli72C2.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cli72C2.tmp
Disinfection failed

C:\WINDOWS\Temp\cli72C2.tmp
Deleted

C:\WINDOWS\Temp\cliA6CF.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6CF.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6CF.tmp
Deleted

C:\WINDOWS\Temp\cliA6D7.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6D7.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6D7.tmp
Deleted

C:\WINDOWS\Temp\cliA6DC.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6DC.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6DC.tmp
Deleted

C:\WINDOWS\Temp\cliA6E2.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6E2.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6E2.tmp
Deleted

C:\WINDOWS\Temp\cliA6E7.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6E7.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6E7.tmp
Deleted

C:\WINDOWS\Temp\cliA6ED.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6ED.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6ED.tmp
Deleted

C:\WINDOWS\Temp\cliA6F5.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6F5.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6F5.tmp
Deleted

C:\WINDOWS\Temp\cliA6FA.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA6FA.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA6FA.tmp
Deleted

C:\WINDOWS\Temp\cliA700.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA700.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA700.tmp
Deleted

C:\WINDOWS\Temp\cliA708.tmp
Infected with: Trojan.Downloader.Small.CML

C:\WINDOWS\Temp\cliA708.tmp
Disinfection failed

C:\WINDOWS\Temp\cliA708.tmp
Deleted

C:\WINDOWS\Temp\ddl3219.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3219.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3219.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl321F.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl321F.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl321F.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddl3223.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3223.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3223.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddl322B.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl322B.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl322B.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3232.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3232.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3232.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3238.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3238.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3238.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl323C.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl323C.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl323C.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3242.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3242.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3242.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3249.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3249.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3249.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3257.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3257.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3257.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3261.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3261.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3261.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3267.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3267.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3267.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl326B.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl326B.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl326B.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3273.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3273.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3273.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3278.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3278.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3278.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl327D.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl327D.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl327D.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddl3281.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3281.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3281.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddl3287.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3287.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3287.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddl328E.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl328E.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl328E.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl32B7.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl32B7.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl32B7.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl32DD.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl32DD.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl32DD.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3300.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3300.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3300.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddl3326.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3326.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3326.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddl3349.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3349.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3349.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3371.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3371.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3371.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3379.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3379.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3379.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl337E.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl337E.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl337E.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl33B8.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl33B8.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl33B8.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3517.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3517.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3517.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl351F.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl351F.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl351F.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl39C6.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl39C6.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl39C6.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl3C19.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl3C19.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl3C19.tmp.exe
Deleted

C:\WINDOWS\Temp\ddl431E.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddl431E.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddl431E.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA6C2.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6C2.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6C2.tmp.exe
Deleted

C:\WINDOWS\Temp\ddlA6D2.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6D2.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6D2.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA6DA.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6DA.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6DA.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA6E0.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6E0.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6E0.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA6E5.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6E5.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6E5.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA6EA.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6EA.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6EA.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA6F0.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6F0.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6F0.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA6F8.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6F8.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6F8.tmp.exe
Deleted

C:\WINDOWS\Temp\ddlA6FD.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA6FD.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA6FD.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA703.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA703.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA703.tmp.exe
Delete failed

C:\WINDOWS\Temp\ddlA707.tmp.exe
Suspected of: Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\ddlA707.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\ddlA707.tmp.exe
Delete failed

C:\WINDOWS\Temp\win33B7.tmp.exe
Suspected of: Dropped:Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\win33B7.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\win33B7.tmp.exe
Deleted

C:\WINDOWS\Temp\win3515.tmp.exe
Infected with: Trojan.Dropper.Agent.AJC

C:\WINDOWS\Temp\win3515.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\win3515.tmp.exe
Deleted

C:\WINDOWS\Temp\win3516.tmp.exe
Suspected of: Dropped:Generic.Malware.Sdld.84E18185

C:\WINDOWS\Temp\win3516.tmp.exe
Disinfection failed

C:\WINDOWS\Temp\win3516.tmp.exe
Deleted

voilou tout ce qu'il m'a trouvé ca fait beaucoup non?

re
en effet, tu ne fais pas souvent ta toilette
ya du boulot encore
========
2em phase de smitfraudfix

Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du PC sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, redémarre en mode normal, copie-colle le rapport sauvegardé sur le forum.

et ce n est pas fini

je reviens en cours de nuit pour te guider

hello j'avais pas vu ton message je regardais le match :)

en fait aujourd'hui j'ai telechargé avast home edition je l'ai installé et il m'a planifié un scan au demarrage alors il m'a eliminé pas mal de virus mais comme j'avais pas desctivé la restauration systeme ils sont tout betement revenus 5 min plus tard (je sais je sais je merite pas d'avoir un pc) donc la j'ai desactivé les restaurations systeme refais un scan au demarrage ils m'a donc enlevé les memes virus qu'avant (mais cette fois pour de bon j'espere)

et la depuis le debut de la soiree je lui fait faire un nouveau scan de tout le systeme pour voir si il ya plus rien (yen a encore pour un moment)
vu qu'il m'a encore rien trouvé je me dis qu'il a du bien travailler

donc pour ce que m'as dit pour la deuxieme phase de smitfraud je ferais ca demain parceque la je vais me pieuter

en tout cas merci a toi de te soucier de mon cas ca fait plaisir de voir qu'il ya encore de la solidarité en ce triste monde...

a plus et merci encore je te tiens au courant

re
======
au redémarrage tapotef8 après écran du bios
pour te mettre en ss échec

ouvre ton hijack
coche et fixe lignes suivantes :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
+
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE <== Spyware !!!

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
+
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/...
=====
tjrs en sans échec :
dema+'rechercher' 1 par 1 tout ce qui suit , et supprime :
- ALCXMNTR.EXE
-
=====
tjrs en sans échec
fais passer ce log ( boutons 1 & 2 du volet gauche en haut : nettoyeur+erreurs)
4/ - Ccleaner : ( nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc..)
Télécharge ici :
https://www.ccleaner.com/ccleaner/download
Tutorial ici:
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
=======
après ce qui précède
et
avoir collé le rapport 2em phase de smitfraud

tu remets un hijack pour faire le point

salut j'ai suivi tes instructions voila ce ca donne

le rapport smitfraud:

SmitFraudFix v2.4
Rapport fait à 17:02:26,34, 18/05/2006
Executé à partir de C:\Documents and Settings\Compaq_Propri‚taire\Bureau\smitfraud
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\dcomcfg.exe supprimé
C:\WINDOWS\system32\ncompat.tlb supprimé
C:\WINDOWS\system32\ot.ico supprimé
C:\WINDOWS\system32\simpole.tlb supprimé
C:\WINDOWS\system32\stdole3.tlb supprimé
C:\WINDOWS\system32\ts.ico supprimé
C:\WINDOWS\system32\1024\ supprimé
C:\DOCUME~1\COMPAQ~1\Favoris\Antivirus Test Online.url supprimé

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Fin

le dernier hijack :

Logfile of HijackThis v1.99.1
Scan saved at 16:30:41, on 18/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Compaq_Propriétaire\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presari...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr7/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presari...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Nothing - {f79fd28e-36ee-4989-aa61-9dd8e30a82fa} - C:\WINDOWS\system32\hpDB73.tmp (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: winetn32 - winetn32.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

voila pour info ce matin j'avais lancé un scan bitdefender voila le rapport:

BitDefender Online Scanner
Scan report generated at: Thu, May 18, 2006 - 10:22:10
Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;

Statistics

Time

02:45:48

Files

574990

Folders

9217

Boot Sectors

3

Archives

15593

Packed Files

45500

Results

Identified Viruses

1

Infected Files

1

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

0

Engines Info

Virus Definitions

375427

Engine build

AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

Scan plugins

13

Archive plugins

40

Unpack plugins

4

E-mail plugins

6

System plugins

1

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

C:\WINDOWS\system32\regperf.exe

Infected with: Trojan.Downloader.Zlob.NI

C:\WINDOWS\system32\regperf.exe

Disinfection failed

C:\WINDOWS\system32\regperf.exe

Delete failed

si je comprend bien il me reste encore un trojan a eradiquer mais en tout cas c'est bien moins pire qu'avant ca fait plaisir

voila a plus

ce qu'il ya de bizarre c'est que j'ai supprimé le fichier ALCXMNTR.EXE mais qu'il apparait toujours :(

re salut dis moi tu pense que mon pc est guéri ?
je dois faire quoi pour en etre sur?

re
tjrs infecté en 1 ou 2 endroits

le blem est que tu ne fais pas exactement les fixages ddés
et cela m oblige à reprendre tout en détail

pour
ALCXMNTR.EXE
je reviens ds la nuit avec un tueur
patience donc

salut ben excuse moi j'ai essayé de faire ce que tu m'as demandé pourtant mais ya peut etre qqchose que j'ai pas compris...

re

1/concernant:
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
http://castlecops.com/StartupList.html

A/ Télécharger : Pocket Killbox ici :
http://www.downloads.subratam.org/KillBox.exe
:: Démo d utilisation (merci à Balltrap34 pour cette réalisation) ::
http://pageperso.aol.fr/balltrap34/killbox.htm

B/ Si vous avez le Tea Timer de Spybot :
Désactive le temps de la manip, le Tea timer de Spybot
lance Spybot >mode avancé> outils >> résident
Décoche la case résident "tea timer"
referme Spybot

C/ Déconnecte toi du net.
Ferme tous les programmes en cours (média player, internet explorer, ...etc)

D/ &#9658; S'assurer de ceci :
Affiche tous les fichiers et dossiers :
Cliquer sur Démarrer/Panneau de Configuration/Options des dossiers/Affichage :
Cocher Afficher les dossiers cachés
Décocher la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décocher Masquer les extensions dont le type est connu
Puis fais «OK» pour valider les changements.
Et appliquer

E/Puis lancer HijackThis:
clique sur "do a system scan only"
* Cocher la case au début de ces lignes:

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
+
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
+
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE <== Spyware !!!

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

* Valider avec [fix checked]

F/ Double clic sur killbox.exe (Pocket Killbox)
- coche : Delete on reboot
- Dans "Full Path of File to Delete"
copie et colle :

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Insérer le chemin complet de l’infection

- clique sur la croix rouge
- une fenêtre va apparaître pour confirmation clique sur YES
- une seconde fenêtre te demande si tu veux redémarrer, clique sur YES
Laisse le PC redémarrer.
Si tu as un message: "pending file rename operations registry data has been removed by external process.", ignorez-le, et redémarrez votre PC manuellement.
http://tinypic.com/images/goodbye.jpg

G/ déma>poste de travail>HDD
va dans :
C:\WINDOWS\system32\
recherche et vire 'regperf.exe ' si présent

H/ Recocher éventuellement la case pour réactiver le Tea Timer de Spybot.

I/ Ne PAS Oublier : faire D/ en sens inverse
Et après vérifier dans un log HijackThis que tout a disparu.

J/ remettre un hijack

hello copain
il me semble que je l avais ddé à notre ami ainsi
peut-être qu il a sauté la ligne qui en parlait