Infection incessante

Thomas -  
bonjour à tous voila j'ai un gros prblèmes depuis de semaine environ j'ai recupere des trojan sur un site de crack (oui c très bete ) j'ai fais de nombreuse analyse de mon disque dur j'ai corriger les probleme que signal kapersky mais rien afaire mon pc ram des qu'il va sur le net et je recupere regulierement de nouveau trojan voila aider moi svp
voici l'etat de mon systeme :
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ASUS\Asus Probe\AsusProb.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe
D:\jeux\steam,\steam.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Admin\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT

cnx|PARAM


O4 - HKCU\..\Run: [Steam] "d:\jeux\steam,\steam.exe" -silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Ttaa] "C:\WINDOWS\PPPATC~1\iexplore.exe" -vt yazb
O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Antivirus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

13 réponses

  1. Utilisateur anonyme
    Salut,

    rien ne sera supprimé sauf si indiqué
    ___
    Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked"

    Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked"

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
    O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit "
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Ttaa] "C:\WINDOWS\PPPATC~1\iexplore.exe" -vt yazb
    O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Progra
    O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)

    Clic sur "demarrer", "executer", tape: services.msc ,cherche dans la liste cette ligne, fais un clic droit dessus choisis "propriétés" et régle la sur "désactivé"

    NVIDIA Display Driver Service

    Clic sur démarrer, poste de travail, C:, program files et supprime ces dossiers

    WinAntiVirus Pro 2006 < désinstalle en mode sans echec si possible avant
    PPPATC.. > commence par PPPATC
    VSToolbar

    **Si un fichier persiste lors de la suppression fais ceci:
    -Redemarres ton pc, dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaitre choisis "mode sans echec" attends un peu.. puis vas supprimer les fichiers/dossiers qui persistaient, vides ta corbeille et redemarres normalement

    Telecharge, installe puis mets à jour ce logiciel(Ewido), une fois que c'est fait, fais un scan complet de ton système, supprime (delete) tout ce qu'il te trouve puis colle le rapport ici avec un nouveau rapport hijackthis
    Ewido: (reste gratuit après la période d'essai)
    Ewido

    0
    1. thomas
      tous d'abord merci voici le rapport de ewido :

      ewido anti-spyware - Scan Report
      ---------------------------------------------------------

      + Created at: 17:19:03 20/10/2006

      + Scan result:

      C:\Program Files\Safety Bar -> Adware.Generic : Cleaned.
      C:\Program Files\Safety Bar\Uninstall.bat -> Adware.Generic : Cleaned.
      HKLM\SOFTWARE\Classes\CLSID\{052b12f7-86fa-4921-8482-26c42316b522} -> Adware.Generic : Cleaned.
      HKU\S-1-5-21-1454471165-1364589140-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{052B12F7-86FA-4921-8482-26C42316B522} -> Adware.Generic : Cleaned.
      HKLM\SOFTWARE\Classes\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca} -> Adware.Isearch : Cleaned.
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a43385f0-7113-496d-96d7-b9b550e3fcca} -> Adware.Isearch : Cleaned.
      HKU\S-1-5-21-1454471165-1364589140-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A43385F0-7113-496D-96D7-B9B550E3FCCA} -> Adware.Isearch : Cleaned.
      C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned.
      C:\WINDOWS\system32\SpOrder.dll -> Adware.WinAntiVirus : Cleaned.
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\WinAntiVirusPro2006 -> Adware.WinAntiVirus : Cleaned.
      HKLM\SYSTEM\CurrentControlSet\Services\vspf -> Adware.WinAntiVirus : Cleaned.
      HKLM\SYSTEM\CurrentControlSet\Services\vspf\Security -> Adware.WinAntiVirus : Cleaned.
      HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk -> Adware.WinAntiVirus : Cleaned.
      HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Security -> Adware.WinAntiVirus : Cleaned.
      HKU\S-1-5-21-1454471165-1364589140-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Cleaned.
      HKU\S-1-5-21-1454471165-1364589140-682003330-1003\SOFTWARE\WinAntiVirus Pro 2006 -> Adware.WinAntiVirus : Cleaned.
      HKU\S-1-5-21-1454471165-1364589140-682003330-1003\SOFTWARE\WinAntiVirus Pro 2006\Settings -> Adware.WinAntiVirus : Cleaned.
      HKU\S-1-5-21-1454471165-1364589140-682003330-1003\SOFTWARE\WinAntiVirus Pro 2006\Settings2 -> Adware.WinAntiVirus : Cleaned.
      C:\Program Files\Fichiers communs\Yazzle1122OinAdmin.exe -> Dropper.Small : Cleaned.
      :mozilla.11:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
      :mozilla.6:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
      :mozilla.7:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
      :mozilla.8:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
      :mozilla.90:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
      :mozilla.93:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
      :mozilla.180:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
      :mozilla.174:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
      :mozilla.12:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
      C:\Documents and Settings\Admin\Cookies\admin@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned.
      :mozilla.184:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Com : Cleaned.
      :mozilla.148:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.
      :mozilla.149:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.
      :mozilla.150:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Comclick : Cleaned.
      :mozilla.121:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
      :mozilla.122:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
      :mozilla.123:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
      :mozilla.124:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
      :mozilla.34:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
      :mozilla.46:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Estat : Cleaned.
      :mozilla.104:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
      :mozilla.155:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
      :mozilla.159:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
      :mozilla.160:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
      :mozilla.161:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
      :mozilla.177:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
      :mozilla.188:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned.
      :mozilla.44:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
      :mozilla.55:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.56:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.59:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.60:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.61:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.62:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.63:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.64:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.65:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.66:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.67:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.68:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.69:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.70:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
      C:\Documents and Settings\Admin\Cookies\admin@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned.
      :mozilla.94:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
      :mozilla.95:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
      :mozilla.96:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
      :mozilla.97:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
      :mozilla.98:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
      :mozilla.99:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
      :mozilla.40:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
      :mozilla.41:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
      :mozilla.42:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
      :mozilla.21:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
      :mozilla.22:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
      :mozilla.23:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
      :mozilla.83:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
      :mozilla.84:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
      :mozilla.85:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Weborama : Cleaned.
      :mozilla.198:C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\7966cfsz.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.

      ::Report end

      ainsi que le nouveau rapport hijackthis :

      Logfile of HijackThis v1.99.1
      Scan saved at 17:21:44, on 20/10/2006
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\ASUS\Asus Probe\AsusProb.exe
      C:\Program Files\Microsoft IntelliType Pro\type32.exe
      C:\WINDOWS\vsnpstd.exe
      C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
      D:\jeux\steam,\steam.exe
      C:\Program Files\Logitech\MouseWare\system\em_exec.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\ewido anti-spyware 4.0\guard.exe
      C:\Program Files\ewido anti-spyware 4.0\ewido.exe
      C:\Documents and Settings\Admin\Bureau\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\system32\uhtkovyc.dll (file missing)
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
      O2 - BHO: (no name) - {D80074EB-E268-417E-ACD8-25B3D249BA73} - C:\WINDOWS\system32\gebca.dll (file missing)
      O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
      O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe
      O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
      O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
      O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
      O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
      O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
      O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
      O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT

      cnx|PARAM


      O4 - HKCU\..\Run: [Steam] "d:\jeux\steam,\steam.exe" -silent
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
      O9 - Extra button: Antivirus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
      O20 - Winlogon Notify: gebca - C:\WINDOWS\system32\gebca.dll (file missing)
      O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
      O20 - Winlogon Notify: winzwr32 - winzwr32.dll (file missing)
      O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
      O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      0
      1. Utilisateur anonyme
        ok, merci, c'est mieux mais pas encore ça

        WinAntivirus, tu n'as pas sû le supprimer ?

        va falloir scanner avec differentes choses !

        Si tu n'as pas ces logiciels télécharge les, mets les à jour puis supprime tout ce qu'il te trouveront

        SpyBot-Search & Destroy: (gratuit)
        Spybot

        A² squared: (gratuit)
        A-squared

        Ad-Aware SE Personal: (en Anglais, gratuit)
        Ad-aware

        Ensuite;

        Fait ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X; la barre anti-popup du SP2 (en haut) va se mettre à clignoter, clic dessus et choisis "accepter l'active X" pour faire fonctionner le scan anti-virus.
        Une fois qu'il a terminé colle le rapport ici stp

        https://www.bitdefender.com/toolbox/
        0
        1. thomas
          Ba pourtant g supprime le fichier en mode sans echec comme tu me la dit c'est pas comme sa?
          0
          2. thomas
            voici le reppor de bitdefender :
            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP129\A0017312.exe

            Infected with: Trojan.Downloader.Winfixer.O

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP129\A0017312.exe

            Disinfection failed

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP129\A0017312.exe

            Deleted

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP135\A0021677.exe

            Infected with: Trojan.Dropper.AY

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP135\A0021677.exe

            Disinfection failed

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP135\A0021677.exe

            Deleted

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP135\A0021678.bat

            Infected with: Trojan.Zlob.AM

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP135\A0021678.bat

            Disinfection failed

            C:\System Volume Information\_restore{668000F2-6999-48FD-B1A8-6AF5353B2E0C}\RP135\A0021678.bat

            Deleted

            C:\WINDOWS\Temp\mst1FE9.tmp

            Infected with: Trojan.Agent.TEX

            C:\WINDOWS\Temp\mst1FE9.tmp

            Disinfection failed

            C:\WINDOWS\Temp\mst1FE9.tmp

            Deleted
            0
            1. Utilisateur anonyme
              Salut,

              fait ça

              Fait ce nettoyage: (à faire réguliérement)

              ¤Telecharges et installes ceci:
              CCleaner:
              Ccleaner

              dans la colonne de gauche clic sur "erreurs" coches toutes les cases, puis cliques en bas sur "chercher des erreurs" une fois finit, cliques sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs.
              Les sauvegardes que tu aura faites tu pourra les supprimer si ton ordinateur n'a plus de problémes

              ¤Relance Ccleaner, vas dans l'onglet "nettoyeur" present sur la gauche, decoches la derniere case (Avancé si elle est cochée) puis clic sur "lancer le nettoyage"

              Alors ceci; C:\System Volume Information\_restore(voir rapport Bitdefender) indique que ta restauration du systeme etait infecté ou est infecté, pour être sûr, nous allons créer un point propre.

              Clic sur "demarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du systeme"

              ¤ coches la case "desactiver la Restauration du systéme sur tous les lecteurs", puis clic ur "appliquer"
              ¤ decoches la case et clic sur "appliquer" puis "ok".

              Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre:

              Clic sur "demarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, cliques sur "créer" puis "ok".
              Voilà, maintenant le point de restauration est créer si un jour tu décides tu pourra revenir en arriere à la date que tu l'as créer donc à ce jour; en fesant la marche arriére tu pourra remettre ton ordinateur à la date ou l'on à créer ce point de restauration mais tu perdra les modifications que tu aura faites entre deux.

              Télécharge SmitfraudFix (enregistre le sur le "bureau")
              http://siri.urz.free.fr/Fix/SmitfraudFix.zip

              décompresse SmitfraudFix
              Lance le fichier SmitfraudFix ou SmitfraudFix.cmd et choisis l option 1 copie le rapport ici stp
              0
              1. thomas
                VOILA LE RAPPORT :

                SmitFraudFix v2.112

                Rapport fait à 13:48:47,62, 21/10/2006
                Executé à partir de C:\Documents and Settings\Admin\Bureau\SmitfraudFix
                OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                Fix executé en mode normal

                »»»»»»»»»»»»»»»»»»»»»»»» C:\

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                C:\WINDOWS\system32\ot.ico PRESENT !

                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin

                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin\Application Data

                »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url PRESENT !
                C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url PRESENT !

                »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Admin\Favoris

                C:\DOCUME~1\Admin\Favoris\Antivirus Test Online.url PRESENT !

                »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                "Source"="About:Home"
                "SubscribedURL"="About:Home"
                "FriendlyName"="Ma page d'accueil"

                »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                SrchSTS.exe by S!Ri
                Search SharedTaskScheduler's .dll

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                "incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"

                »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                "AppInit_DLLs"="C:\\PROGRA~1\\KASPER~1\\KASPER~1.0\\adialhk.dll"

                »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                »»»»»»»»»»»»»»»»»»»»»»»» Fin
                0
                1. Utilisateur anonyme
                  Redémarres le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou F5 ) et tu choisis le mode sans échec)

                  - Ouvre le dossier "SmitfraudFix" et double clic sur "Smitfraudfix.cmd", choisit l 'option 2 et tu réponds oui à tout.

                  Enregistre le rapport puis Copie/colle le rapport sur le forum avec un nouveau rapport hijackthis

                  0
                  1. thomas
                    voila le rapport smitfraudfix :

                    SmitFraudFix v2.112

                    Rapport fait à 16:07:52,89, 21/10/2006
                    Executé à partir de D:\SmitfraudFix
                    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                    Fix executé en mode sans echec

                    »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
                    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                    SrchSTS.exe by S!Ri
                    Search SharedTaskScheduler's .dll

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                    "incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"

                    »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                    GenericRenosFix by S!Ri

                    »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                    C:\WINDOWS\system32\ot.ico supprimé
                    C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url supprimé
                    C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url supprimé

                    »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

                    »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                    Nettoyage terminé.

                    »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
                    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                    SrchSTS.exe by S!Ri
                    Search SharedTaskScheduler's .dll

                    »»»»»»»»»»»»»»»»»»»»»»»» Fin

                    ainsi que le nouveau hijackthis :

                    Logfile of HijackThis v1.99.1
                    Scan saved at 16:11:11, on 21/10/2006
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\Program Files\ASUS\Asus Probe\AsusProb.exe
                    C:\Program Files\Microsoft IntelliType Pro\type32.exe
                    C:\WINDOWS\vsnpstd.exe
                    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
                    D:\jeux\steam,\steam.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
                    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
                    C:\Program Files\ewido anti-spyware 4.0\guard.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Documents and Settings\Admin\Bureau\HijackThis.exe

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                    O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - (no file)
                    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
                    O2 - BHO: (no name) - {D80074EB-E268-417E-ACD8-25B3D249BA73} - (no file)
                    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
                    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe
                    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
                    O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
                    O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
                    O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
                    O4 - HKCU\..\Run: [Steam] "d:\jeux\steam,\steam.exe" -silent
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
                    O9 - Extra button: Antivirus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
                    O20 - Winlogon Notify: gebca - C:\WINDOWS\system32\gebca.dll (file missing)
                    O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
                    O20 - Winlogon Notify: winzwr32 - winzwr32.dll (file missing)
                    O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
                    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                    0
                    1. Utilisateur anonyme
                      Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked"

                      O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - (no file)
                      O20 - Winlogon Notify: gebca - C:\WINDOWS\system32\gebca.dll (file missing)
                      O20 - Winlogon Notify: winzwr32 - winzwr32.dll (file missing)

                      Fais un clic droit sur Hijackthis, renomer, marque: ab puis ok
                      Refais un scan hijackthis et colle le rapport ici stp
                      0
                  2. Rémy de Ouaga
                    Salut Boulepate62, j'ai le meme pb que Thomas, et aussi la même origine.
                    Je ne comprends pas grand chose mais j'ai fait un log comme tu l'as indiqué.
                    Ma config, un portable Hp pavilion Dv1000, Service pack2, j'utilisais Zonalarm et Avg anti virus et j'ai autorisé Zon... momentanément.

                    Je te saurai gré de bien vouloir m'aider. Merci. Voilà le log.

                    Logfile of HijackThis v1.99.1
                    Scan saved at 14:49:03, on 21/10/2006
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                    C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
                    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\WINDOWS\system32\igfxpers.exe
                    C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
                    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                    C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                    C:\Program Files\HP\QuickPlay\QPService.exe
                    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
                    C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
                    C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
                    C:\WINDOWS\system32\hkcmd.exe
                    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
                    C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
                    C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
                    C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
                    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Internet Explorer\iexplore.exe
                    C:\Program Files\Windows Live Safety Center\wlscUploader.exe
                    C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com{SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
                    O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
                    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
                    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
                    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
                    O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
                    O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe -c
                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
                    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                    O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
                    O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
                    O4 - Global Startup: BTTray.lnk = ?
                    O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
                    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                    O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                    O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                    O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
                    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
                    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab
                    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
                    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                    O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
                    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
                    0
                    1. Rémy de Ouaga
                      Resalut Boulepate62
                      Voila donc les 2 rapports,

                      SmitFraudFix v2.112

                      Rapport fait à 15:46:08,17, 21/10/2006
                      Executé à partir de C:\Documents and Settings\Administrateur.REMY_BORNE.000\Bureau\SmitfraudFix
                      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                      Fix executé en mode sans echec

                      »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      SrchSTS.exe by S!Ri
                      Search SharedTaskScheduler's .dll

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                      "{A4F94C0C-54A7-4DB1-9AF3-B22E63D00401}"="z"

                      »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                      »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                      GenericRenosFix by S!Ri

                      »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                      »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

                      »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                      Nettoyage terminé.

                      »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                      SrchSTS.exe by S!Ri
                      Search SharedTaskScheduler's .dll

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                      "{A4F94C0C-54A7-4DB1-9AF3-B22E63D00401}"="z"

                      »»»»»»»»»»»»»»»»»»»»»»»» Fin

                      Logfile of HijackThis v1.99.1
                      Scan saved at 15:55:52, on 21/10/2006
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                      C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                      C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
                      C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\WINDOWS\system32\igfxpers.exe
                      C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
                      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                      C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                      C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                      C:\Program Files\HP\QuickPlay\QPService.exe
                      C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
                      C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
                      C:\WINDOWS\system32\hkcmd.exe
                      C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
                      C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
                      C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
                      C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
                      C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com{SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                      O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                      O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                      O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
                      O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
                      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                      O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                      O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
                      O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
                      O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
                      O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
                      O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe -c
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
                      O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                      O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
                      O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
                      O4 - Global Startup: BTTray.lnk = ?
                      O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
                      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                      O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                      O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                      O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
                      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
                      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                      O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab
                      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
                      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                      O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                      O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
                      O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe

                      Et encore merci
                      0
                      1. Rémy de Ouaga
                        Merci et voici donc le nouveau log :

                        Logfile of HijackThis v1.99.1
                        Scan saved at 11:05:45, on 23/10/2006
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                        C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                        C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe
                        C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\igfxpers.exe
                        C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
                        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                        C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                        C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                        C:\Program Files\HP\QuickPlay\QPService.exe
                        C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
                        C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                        C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
                        C:\WINDOWS\system32\hkcmd.exe
                        C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
                        C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
                        C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
                        C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
                        C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
                        C:\Program Files\Internet Explorer\iexplore.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
                        C:\WINDOWS\system32\rundll32.exe
                        C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
                        C:\Program Files\Hijackthis Version Française\ab.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/fr/fr/home.html
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com{SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                        O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                        O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                        O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
                        O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\DetectorApp.exe
                        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                        O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                        O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
                        O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
                        O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
                        O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
                        O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe -c
                        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                        O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
                        O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                        O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
                        O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
                        O4 - Global Startup: BTTray.lnk = ?
                        O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
                        O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                        O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                        O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                        O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                        O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
                        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
                        O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                        O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase969.cab
                        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                        O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
                        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
                        O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
                        O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
                        O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia Plus v7\MyDVD Plus\USBDeviceService.exe

                        A bientot Rémy
                        0
                        1. Utilisateur anonyme
                          Salut,

                          désinstalle AVG7 tu as déjà Avast ça ne sert à rien d'en avoir deux

                          Fait ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X; la barre anti-popup du SP2(en haut) va se mettre à clignoter, clic dessus et choisis "accepter l'active X" pour faire fonctionner le scan anti-virus.
                          Une fois qu'il a terminé colle le rapport ici stp

                          _Online Scanner
                          _Kaspersky Online Scanner
                          _My Computer

                          https://www.kaspersky.fr/downloads

                          A++
                          0

                          Discussions similaires

                          Pub incessantes sur mon téléphone
                          safiya.l

                          6 réponses
                          Infection
                          toast3r

                          44 réponses
                          infection
                          céline0034

                          12 réponses
                          problème infection ?
                          emma

                          76 réponses
                          Infection pc
                          Nanie24

                          22 réponses