w32.myzor.fk@yf Résolu/Fermé

Question

Bonjour à tous,En particulier à incognito02, dont j'ai suivi sa procédure pour le problème de MI91.Je vous donne la procédure que j'ai effectué, comme lui j'étais infecté par w32.myzor.fk@yf Merci de me dire si tout est correct :1 scan avec hijackthisLogfile of HijackThis v1.99.1Scan saved at 01:03:24, on 03/06/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exeC:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\dcomcfg.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\ATI-CPanel\atiptaxx.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\Wanadoo\TaskBarIcon.exeC:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeC:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Smart Link\IMTrans\IMTrans.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\PROGRA~1\Wanadoo\Toaster.exeC:\PROGRA~1\Wanadoo\Inactivity.exeC:\PROGRA~1\Wanadoo\PollingModule.exeC:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXEC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\QuickZip\QuickZip.exeC:\DOCUME~1\STEPHA~1.STE\LOCALS~1\Temp\QZTEMP\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*https://fr.yahoo.com/?p=usR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*https://fr.yahoo.com/?p=usR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmpO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exeO4 - HKLM\..\Run: [xor] C:\WINDOWS\System32\x0r\svshost.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [afit] C:\WINDOWS\afit.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [mtqvmj] C:\WINDOWS\mtqvmj.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Startup: IMTranslator.lnk = C:\Program Files\Smart Link\IMTrans\IMTrans.exeO4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htmO8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZBxdm045YYFRO9 - Extra button: Platinum Play Online Casino - {150035AF-0AA9-4b61-B83A-D07E13429017} - C:\Program Files\platinumplay\casinogame.exeO9 - Extra button: MrB Poker - {1DAA624F-A7AB-4b31-97A4-67205FF6963C} - C:\Program Files\mrbookmakerfrMPP\MPPoker.exeO9 - Extra button: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra 'Tools' menuitem: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra button: Poker 333 - {9A315457-791D-4dec-AFB0-9E7ACFF4B506} - C:\Program Files\piggspeakMPP\MPPoker.exeO9 - Extra button: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra 'Tools' menuitem: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra button: Riverbelle MPC - {F5B5A190-EADF-49d9-A90D-52B236C05E63} - C:\Program Files\riverbelleMPC\MPC.exe (file missing)O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)O15 - Trusted Zone: https://secure.bellerockgaming.com/O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: Interface Chat Wanadoo - http://chat14.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.htmlO16 - DPF: {7565A160-5C60-4866-A120-F4D5B2BA3AAE} (FSLoaderCtrl Class) - http://www.clickedyclick.com/Download_Helper/fsloader_v3.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://jeux.wanadoo.fr/online2/astropop/zylomgamesplayer.cabO16 - DPF: {C2E4B57D-DF10-4B1C-8FD7-7A308B67C3EC} (GvDload2 Class) - http://www.everestpoker.com/dload/gvdload2.cabO16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register6.valueactive.com/537/webolr/OCX/FlashAX.cabO16 - DPF: {E795CA75-530A-4981-80F2-0C9EF7CF0F58} (vcload) - http://secure.goodthinxx.com/select/SelectGoodthinxx/vcloadgt.cabO16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.98.176.62/EPlugin.cabO16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{481B787C-1A83-47A9-887D-54B6D2606130}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O18 - Protocol: stibo - {FFAD3420-6D61-44F6-BA25-293F17152D79} - C:\Program Files\Fichiers communs\Stibo\RS_ProtocolHandler.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO21 - SSODL: System - {A17FA1D0-FD8F-445A-83A9-3C9E1BE4DEA3} - C:\WINDOWS\system32\system32.dll (file missing)O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe______________________________________________________-2 scan avec smitfraud :SmitFraudFix v2.53Rapport fait à  2:05:00,28, 03/06/2006Executé à partir de C:\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode normal»»»»»»»»»»»»»»»»»»»»»»»» C:\»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32C:\WINDOWS\system32\dcomcfg.exe PRESENT !C:\WINDOWS\system32\hp???.tmp PRESENT !C:\WINDOWS\system32\hp????.tmp PRESENT !C:\WINDOWS\system32\ld????.tmp PRESENT !C:\WINDOWS\system32\ot.ico PRESENT !C:\WINDOWS\system32\simpole.tlb PRESENT !C:\WINDOWS\system32\stdole3.tlb PRESENT !C:\WINDOWS\system32\1024\ PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\stephane.STEPHANE-SB7LHI\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Menu DémarrerC:\DOCUME~1\STEPHA~1.STE\MENUDM~1\PROGRA~1\MalwareWipe PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\STEPHA~1.STE\Favoris»»»»»»»»»»»»»»»»»»»»»»»» Bureau»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="http://jsc.dr.ag/so93.js""SubscribedURL"="http://jsc.dr.ag/so93.js""FriendlyName"="" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="Ma page d'accueil"»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{0c7416f0-dd23-420f-97f5-aae352ea2bf1}"="glochid"[HKEY_CLASSES_ROOT\CLSID\{0c7416f0-dd23-420f-97f5-aae352ea2bf1}\InProcServer32]@="C:\WINDOWS\system32\wfkduei.dll"[HKEY_CURRENT_USER\Software\Classes\CLSID\{0c7416f0-dd23-420f-97f5-aae352ea2bf1}\InProcServer32]@="C:\WINDOWS\system32\wfkduei.dll"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{e5b1e382-817e-4b74-8a96-ec78751e6acf}"="incatenate"[HKEY_CLASSES_ROOT\CLSID\{e5b1e382-817e-4b74-8a96-ec78751e6acf}\InProcServer32]@="C:\WINDOWS\system32\imfdfcj.dll"[HKEY_CURRENT_USER\Software\Classes\CLSID\{e5b1e382-817e-4b74-8a96-ec78751e6acf}\InProcServer32]@="C:\WINDOWS\system32\imfdfcj.dll"»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» Fin_____________________________________________________-3 idem en mode sans echec select2 :SmitFraudFix v2.53Rapport fait à  2:27:59,73, 03/06/2006Executé à partir de C:\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode sans echec»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{0c7416f0-dd23-420f-97f5-aae352ea2bf1}"="glochid"[HKEY_CLASSES_ROOT\CLSID\{0c7416f0-dd23-420f-97f5-aae352ea2bf1}\InProcServer32]@="C:\WINDOWS\system32\wfkduei.dll"[HKEY_CURRENT_USER\Software\Classes\CLSID\{0c7416f0-dd23-420f-97f5-aae352ea2bf1}\InProcServer32]@="C:\WINDOWS\system32\wfkduei.dll"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{e5b1e382-817e-4b74-8a96-ec78751e6acf}"="incatenate"[HKEY_CLASSES_ROOT\CLSID\{e5b1e382-817e-4b74-8a96-ec78751e6acf}\InProcServer32]@="C:\WINDOWS\system32\imfdfcj.dll"[HKEY_CURRENT_USER\Software\Classes\CLSID\{e5b1e382-817e-4b74-8a96-ec78751e6acf}\InProcServer32]@="C:\WINDOWS\system32\imfdfcj.dll"»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\WINDOWS\system32\dcomcfg.exe suppriméC:\WINDOWS\system32\hp???.tmp suppriméC:\WINDOWS\system32\ld????.tmp suppriméC:\WINDOWS\system32\ot.ico suppriméC:\WINDOWS\system32\simpole.tlb suppriméC:\WINDOWS\system32\stdole3.tlb suppriméC:\WINDOWS\system32\1024\ suppriméC:\DOCUME~1\STEPHA~1.STE\MENUDM~1\PROGRA~1\MalwareWipe supprimé»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos FixGenericRenosFix by S!RiC:\WINDOWS\system32\wfkduei.dll -> Missing FileC:\WINDOWS\system32\imfdfcj.dll -> Missing File»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé.  »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Fin______________________________________________________-4 redémmarer+ scan avec hijackthis :Logfile of HijackThis v1.99.1Scan saved at 02:42:33, on 03/06/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\ATI-CPanel\atiptaxx.exeC:\PROGRA~1\Wanadoo\TaskBarIcon.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exeC:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\Program Files\Smart Link\IMTrans\IMTrans.exeC:\PROGRA~1\Wanadoo\Toaster.exeC:\PROGRA~1\Wanadoo\Inactivity.exeC:\PROGRA~1\Wanadoo\PollingModule.exeC:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\PROGRA~1\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\QuickZip\QuickZip.exeC:\DOCUME~1\STEPHA~1.STE\LOCALS~1\Temp\QZTEMP\hijackthis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp (file missing)O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exeO4 - HKLM\..\Run: [xor] C:\WINDOWS\System32\x0r\svshost.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [afit] C:\WINDOWS\afit.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [mtqvmj] C:\WINDOWS\mtqvmj.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Startup: IMTranslator.lnk = C:\Program Files\Smart Link\IMTrans\IMTrans.exeO4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htmO8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZBxdm045YYFRO9 - Extra button: Platinum Play Online Casino - {150035AF-0AA9-4b61-B83A-D07E13429017} - C:\Program Files\platinumplay\casinogame.exeO9 - Extra button: MrB Poker - {1DAA624F-A7AB-4b31-97A4-67205FF6963C} - C:\Program Files\mrbookmakerfrMPP\MPPoker.exeO9 - Extra button: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra 'Tools' menuitem: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra button: Poker 333 - {9A315457-791D-4dec-AFB0-9E7ACFF4B506} - C:\Program Files\piggspeakMPP\MPPoker.exeO9 - Extra button: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra 'Tools' menuitem: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra button: Riverbelle MPC - {F5B5A190-EADF-49d9-A90D-52B236C05E63} - C:\Program Files\riverbelleMPC\MPC.exe (file missing)O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)O15 - Trusted Zone: https://secure.bellerockgaming.com/O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: Interface Chat Wanadoo - http://chat14.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.htmlO16 - DPF: {7565A160-5C60-4866-A120-F4D5B2BA3AAE} (FSLoaderCtrl Class) - http://www.clickedyclick.com/Download_Helper/fsloader_v3.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://jeux.wanadoo.fr/online2/astropop/zylomgamesplayer.cabO16 - DPF: {C2E4B57D-DF10-4B1C-8FD7-7A308B67C3EC} (GvDload2 Class) - http://www.everestpoker.com/dload/gvdload2.cabO16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register6.valueactive.com/537/webolr/OCX/FlashAX.cabO16 - DPF: {E795CA75-530A-4981-80F2-0C9EF7CF0F58} (vcload) - http://secure.goodthinxx.com/select/SelectGoodthinxx/vcloadgt.cabO16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.98.176.62/EPlugin.cabO16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{481B787C-1A83-47A9-887D-54B6D2606130}: NameServer = 80.10.246.1 80.10.246.132O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O18 - Protocol: stibo - {FFAD3420-6D61-44F6-BA25-293F17152D79} - C:\Program Files\Fichiers communs\Stibo\RS_ProtocolHandler.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO21 - SSODL: System - {A17FA1D0-FD8F-445A-83A9-3C9E1BE4DEA3} - C:\WINDOWS\system32\system32.dll (file missing)O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe______________________________________________________Pouvez-vous me dire si tout vous parait  normal, car moi je n'y comprends absolument rien.D'avance merci à vous tous pour toutes vos connaissances.Et bon wekk-end!

incognito02 · Answer

Bonjour,Dans un premier temps, fait déja tout cela : telecharge et execute ces antispywares ( pense a les mettre a jour avant de les lancer) (1) ad-aware version 1.06 (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite voir demo http://pageperso.aol.fr/balltrap34/adwseflash.zip *** (2) spybot version 1.4 (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite voir demo d utilisation http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm *** et aussi ceci (3) Ccleaner :Télécharge Ccleaner ici : https://www.ccleaner.com/ccleaner/download Tutorial ici: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php (4) Ewido http://download.ewido.net/ewido-setup.exe Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour. Clique sur scanner puis sur scan complet du système. (5) Pour vérifier, scanne ton PC avec cet antivirus en ligne : https://www.bitdefender.com/toolbox/(6)Affiche tous les fichiers et dossiers : Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage Coche « afficher les fichiers et dossiers cachés » Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décoche « masquer les extensions dont le type est connu » Puis fais «Ok» pour valider les changements. Et appliquer ! (7) Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked : O2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp (file missing)O4 - HKLM\..\Run: [xor] C:\WINDOWS\System32\x0r\svshost.exeO4 - HKLM\..\Run: [afit] C:\WINDOWS\afit.exeO4 - HKLM\..\Run: [mtqvmj] C:\WINDOWS\mtqvmj.exe (8) Démarre en mode sans échec : Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! (Si F8 ne marche pas utilise la touche F5). ---------------------------------------------------------------------------- ¤Recherche et supprime ceci: attention seulement les fichiers (si présents). C:\WINDOWS\System32\x0r\svshost.exeC:\WINDOWS\afit.exeC:\WINDOWS\mtqvmj.exevide la corbeille, passe ewido.Redemarre en mode normal et refais un hijackthis.Bon courage.A+

enapets88 · Answer

Bonjour,D'abord merci pour la réponse.Je vais essayé de faire encore tout ça!Encore merci de ton aide!à+

enapets88 · Answer

Bonsoir incognito02,Je ne comprends le point 7 :(7) Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked : O2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp (file missing) O4 - HKLM\..\Run: [xor] C:\WINDOWS\System32\x0r\svshost.exe O4 - HKLM\..\Run: [afit] C:\WINDOWS\afit.exe O4 - HKLM\..\Run: [mtqvmj] C:\WINDOWS\mtqvmj.exe Quand je l'ouvre je n'ai pas de cases à cocher, ni fix checked!!!Peux-tu m'aider? merci!

Séb08 · Answer

Slt,Relance Hijack et cliques sur "do a scan only" et là tu dois avoir les cases à cocher indiquées par Incognito..A+

incognito02 · Answer

Bonsoir,tu lances Hijackthis, tu cliques sur "Do a scan only" et tu coches les lignes en question et à la fin tu cliques sur FIXED CHECK Bon courage.A+

enapets88 · Answer

reMerci à tous les 2!C'est long grrrrrrrrrrr!à+

enapets88 · Answer

reVoilà j'ai fini les 8 étapes! ouf!Je n'ai pas trouvé les 3 fichier à supprimer, donc j'ai rien fait.je vous juste le dernier rapport :Logfile of HijackThis v1.99.1Scan saved at 01:47:33, on 04/06/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exeC:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\ATI-CPanel\atiptaxx.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\Wanadoo\TaskBarIcon.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeC:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\Program Files\Smart Link\IMTrans\IMTrans.exeC:\PROGRA~1\Wanadoo\Toaster.exeC:\PROGRA~1\Wanadoo\Inactivity.exeC:\PROGRA~1\Wanadoo\PollingModule.exeC:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\PROGRA~1\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\QuickZip\QuickZip.exeC:\DOCUME~1\STEPHA~1.STE\LOCALS~1\Temp\QZTEMP\hijackthis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Startup: IMTranslator.lnk = C:\Program Files\Smart Link\IMTrans\IMTrans.exeO4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htmO8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZBxdm045YYFRO9 - Extra button: Platinum Play Online Casino - {150035AF-0AA9-4b61-B83A-D07E13429017} - C:\Program Files\platinumplay\casinogame.exeO9 - Extra button: MrB Poker - {1DAA624F-A7AB-4b31-97A4-67205FF6963C} - C:\Program Files\mrbookmakerfrMPP\MPPoker.exeO9 - Extra button: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra 'Tools' menuitem: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra button: Poker 333 - {9A315457-791D-4dec-AFB0-9E7ACFF4B506} - C:\Program Files\piggspeakMPP\MPPoker.exeO9 - Extra button: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra 'Tools' menuitem: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra button: Riverbelle MPC - {F5B5A190-EADF-49d9-A90D-52B236C05E63} - C:\Program Files\riverbelleMPC\MPC.exe (file missing)O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)O15 - Trusted Zone: https://secure.bellerockgaming.com/O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: Interface Chat Wanadoo - http://chat14.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.htmlO16 - DPF: {7565A160-5C60-4866-A120-F4D5B2BA3AAE} (FSLoaderCtrl Class) - http://www.clickedyclick.com/Download_Helper/fsloader_v3.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://jeux.wanadoo.fr/online2/astropop/zylomgamesplayer.cabO16 - DPF: {C2E4B57D-DF10-4B1C-8FD7-7A308B67C3EC} (GvDload2 Class) - http://www.everestpoker.com/dload/gvdload2.cabO16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register6.valueactive.com/537/webolr/OCX/FlashAX.cabO16 - DPF: {E795CA75-530A-4981-80F2-0C9EF7CF0F58} (vcload) - http://secure.goodthinxx.com/select/SelectGoodthinxx/vcloadgt.cabO16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.98.176.62/EPlugin.cabO16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{481B787C-1A83-47A9-887D-54B6D2606130}: NameServer = 80.10.246.1 80.10.246.132O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O18 - Protocol: stibo - {FFAD3420-6D61-44F6-BA25-293F17152D79} - C:\Program Files\Fichiers communs\Stibo\RS_ProtocolHandler.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO21 - SSODL: System - {A17FA1D0-FD8F-445A-83A9-3C9E1BE4DEA3} - C:\WINDOWS\system32\system32.dll (file missing)O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exeVoilà!J'attends vos commentaires, pour moi c'est du chinois!Si vous voulez autres choses demandez-moi.En tout cas encore un grand merci pour votre aide!bonne nuit.à+

Séb08 · Answer

Relance Hijack et fixe ces lignes:O4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O9 - Extra button: Riverbelle MPC - {F5B5A190-EADF-49d9-A90D-52B236C05E63} - C:\Program Files\riverbelleMPC\MPC.exe (file missing)O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: Interface Chat Wanadoo - http://chat14.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - https://www.afternic.com/domains/downloadv3.comO16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.htmlO16 - DPF: {7565A160-5C60-4866-A120-F4D5B2BA3AAE} (FSLoaderCtrl Class) - http://www.clickedyclick.com/Download_Helper/fsloader_v3.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://jeux.wanadoo.fr/online2/astropop/zylomgamesplayer.cabO16 - DPF: {C2E4B57D-DF10-4B1C-8FD7-7A308B67C3EC} (GvDload2 Class) - http://www.everestpoker.com/dload/gvdload2.cabO16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register6.valueactive.com/537/webolr/OCX/FlashAX.cabO16 - DPF: {E795CA75-530A-4981-80F2-0C9EF7CF0F58} (vcload) - http://secure.goodthinxx.com/select/SelectGoodthinxx/vcloadgt.cabO16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.98.176.62/EPlugin.cabO16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab O21 - SSODL: System - {A17FA1D0-FD8F-445A-83A9-3C9E1BE4DEA3} - C:\WINDOWS\system32\system32.dll (file missing)O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe Et fais ceci :Cliques sur démarrer=>executer=>tape "services.msc"Et mets ce service sur désactivé ou arrêté :France Telecom Routing Table ServiceEt dis nous ou en sont tes problèmes .A+

enapets88 · Answer

Bonsoir,Merci pour la réponse.voici le rapport après vos actions demandées :Logfile of HijackThis v1.99.1Scan saved at 21:59:32, on 04/06/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exeC:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\ATI-CPanel\atiptaxx.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\PROGRA~1\Wanadoo\TaskBarIcon.exeC:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exeC:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeC:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\Program Files\Smart Link\IMTrans\IMTrans.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\PROGRA~1\Wanadoo\Toaster.exeC:\PROGRA~1\Wanadoo\Inactivity.exeC:\PROGRA~1\Wanadoo\PollingModule.exeC:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXEC:\PROGRA~1\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\QuickZip\QuickZip.exeC:\DOCUME~1\STEPHA~1.STE\LOCALS~1\Temp\QZTEMP\hijackthis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Startup: IMTranslator.lnk = C:\Program Files\Smart Link\IMTrans\IMTrans.exeO4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htmO8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZBxdm045YYFRO9 - Extra button: Platinum Play Online Casino - {150035AF-0AA9-4b61-B83A-D07E13429017} - C:\Program Files\platinumplay\casinogame.exeO9 - Extra button: MrB Poker - {1DAA624F-A7AB-4b31-97A4-67205FF6963C} - C:\Program Files\mrbookmakerfrMPP\MPPoker.exeO9 - Extra button: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra 'Tools' menuitem: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra button: Poker 333 - {9A315457-791D-4dec-AFB0-9E7ACFF4B506} - C:\Program Files\piggspeakMPP\MPPoker.exeO9 - Extra button: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra 'Tools' menuitem: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO15 - Trusted Zone: https://secure.bellerockgaming.com/O17 - HKLM\System\CCS\Services\Tcpip\..\{481B787C-1A83-47A9-887D-54B6D2606130}: NameServer = 80.10.246.1 80.10.246.132O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O18 - Protocol: stibo - {FFAD3420-6D61-44F6-BA25-293F17152D79} - C:\Program Files\Fichiers communs\Stibo\RS_ProtocolHandler.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe______________________________________________________Je n'ai pas pu faire ceci : mettre ce service sur arrêtter: France Telecom Routing Table Service !Sinon plus de trace du virus et tout refonctionne comme avant.Suis-je sauvé?Encore un grand merci pour votre aide.à+

Séb08 · Answer

Apparemment c'est clean !Mais un conseil installes Hijack comme indiqué là :Dézippe le dans un dossier prévu à cet effet. Par exemple C:\hijackthis < Enregistre le bien dans c : ! Démo (merci à Balltrap) :instalation hijackthishttp://pageperso.aol.fr/balltrap34/Hijenr.gifCar chez toi il est mal installé :C:\DOCUME~1\STEPHA~1.STE\LOCALS~1\Temp\QZTEMP\hijackthis.exeCar installé comme ça il n'y aura pas de backup.************************************************************************Pour ce service :France Telecom Routing Table ServiceTu peux le mettre sur "désactivé".A+

enapets88 · Answer

Bonjour,Pour ceci c'est ok : France Telecom Routing Table Service Tu peux le mettre sur "désactivé". _____________________________________________________Par contre pour pour hijackthis je n'ai pas reussi à l'enregistrer dans C, malgré la démo!Je dois d'abord le supprimer de l'emplacement ou il est actuellement ou pas?Encore merci!

enapets88 · Answer

Re,J'oubliais ceci:Dès que je lance i explorer, j'ai un message de mon antivirus m'informant que la protéction d'internet explorer activée.question : dois-je la désactiver ou pas?à+

Séb08 · Answer

pour Hijack oui désinstalle le et réinstalle le comme indiqué.Pour IE je n'ai pas très bien compris ton message.A+

enapets88 · Answer

Bonjour Seb,OKpour hijak!Pour IE je n'ai plus le message...Apparement tout refonctionne normalement!Pensez-vous que tout soit clean?Merci.à+

enapets88 · Answer

reJe vous met tout de même le dernier log: Logfile of HijackThis v1.99.1Scan saved at 17:28:36, on 06/06/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exeC:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\ATI-CPanel\atiptaxx.exeC:\Program Files\Fichiers communs\Real\Update_OB\realsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\PROGRA~1\Wanadoo\TaskBarIcon.exeC:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exeC:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exeC:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\Program Files\Smart Link\IMTrans\IMTrans.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\PROGRA~1\Wanadoo\Toaster.exeC:\PROGRA~1\Wanadoo\Inactivity.exeC:\PROGRA~1\Wanadoo\PollingModule.exeC:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXEC:\PROGRA~1\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portailR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portailR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dllO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osbootO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Startup: IMTranslator.lnk = C:\Program Files\Smart Link\IMTrans\IMTrans.exeO4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htmO8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.htmlO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZBxdm045YYFRO9 - Extra button: Platinum Play Online Casino - {150035AF-0AA9-4b61-B83A-D07E13429017} - C:\Program Files\platinumplay\casinogame.exeO9 - Extra button: MrB Poker - {1DAA624F-A7AB-4b31-97A4-67205FF6963C} - C:\Program Files\mrbookmakerfrMPP\MPPoker.exeO9 - Extra button: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra 'Tools' menuitem: StarLuck.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\Starluck Casino\bin\IEExtension_SL.dllO9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dllO9 - Extra button: Poker 333 - {9A315457-791D-4dec-AFB0-9E7ACFF4B506} - C:\Program Files\piggspeakMPP\MPPoker.exeO9 - Extra button: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO9 - Extra 'Tools' menuitem: partybingo.com - {9CDE474A-A688-48f4-8B49-55CFB2356A6F} - C:\Program Files\PartyBingo\bin\IEExtension_PB.dllO15 - Trusted Zone: https://secure.bellerockgaming.com/O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{481B787C-1A83-47A9-887D-54B6D2606130}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O18 - Protocol: stibo - {FFAD3420-6D61-44F6-BA25-293F17152D79} - C:\Program Files\Fichiers communs\Stibo\RS_ProtocolHandler.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXEO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Séb08 · Answer

ok l'installation Hijack est bonne.Et le log est propre apparemment.Bon surf !A+

enapets88 · Answer

ReUn grand merci à toi Seb!Je suis soulagé!Je remercie aussi bien sur tout ceux qui ont collaboré à m'aider, en particulier incognito02, et le forum cyberbricoleur qui m'a conduit jusque vous!Vous êtes vraiment des pros, et me sent vraiment très nul par rapport à vos connaissances!Chapeau à tous!

enapets88 · Answer

reOk no problème Seb!Have a good daytyvm!bye!

enapets88 · Answer

reSorrytyvm: thank you very much! lol

W32.myzor.fk@yf

19 réponses

Discussions similaires