Infection win32.adware.fen

bonjour
voila,je viens de faire ce qui est indiqué dans le lien ci dessus
1)Etat néant avec AVG Antivirus(pas de rapport)
2) et 3) rapports respectifs BitDefender et Hijacthis sui vants(dans cet ordre)

BitDefender Online Scanner
Scan report generated at: Mon, Feb 19, 2007 - 16:36:25

Scan path: A:\;C:\;D:\;E:\;F:\;G:\;H:\;

Statistics
Time 01:22:38
Files 771042
Folders 5691
Boot Sectors 2
Archives 17111
Packed Files 102808

Results
Identified Viruses 4
Infected Files 9
Suspect Files 0
Warnings 0
Disinfected 0
Deleted Files 9

Engines Info
Virus Definitions 388780
Engine build AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)
Scan plugins 14
Archive plugins 38
Unpack plugins 6
E-mail plugins 6
System plugins 1

Scan Settings
First Action Disinfect
Second Action Delete
Heuristics Yes
Enable Warnings Yes
Scanned Extensions *;
Exclude Extensions
Scan Emails Yes
Scan Archives Yes
Scan Packed Yes
Scan Files Yes
Scan Boot Yes


Scanned File Status
C:\Documents and Settings\Pierre\Mes documents\blagues2\Troudebal.exe Infected with: Joke.Winshoot.A
C:\Documents and Settings\Pierre\Mes documents\blagues2\Troudebal.exe Disinfection failed
C:\Documents and Settings\Pierre\Mes documents\blagues2\Troudebal.exe Deleted
C:\Documents and Settings\Pierre\Mes documents\blagues4\Troudebal.exe Infected with: Joke.Winshoot.A
C:\Documents and Settings\Pierre\Mes documents\blagues4\Troudebal.exe Disinfection failed
C:\Documents and Settings\Pierre\Mes documents\blagues4\Troudebal.exe Deleted
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0017 Infected with: Trojan.Downloader.Adload.A
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0017 Disinfection failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0017 Deleted
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe Update failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>NHInstall.exe Infected with: Trojan.Dloader.L
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>NHInstall.exe Disinfection failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>NHInstall.exe Deleted
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o) Updated
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll Detected with: Adware.Navexcel.A
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll Disinfection failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll Deleted
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab Update failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe Detected with: Adware.Navexcel.A
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe Disinfection failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe Deleted
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab Update failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe Detected with: Adware.Navexcel.A
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe Disinfection failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe Deleted
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018=>(ZIP Sfx o)=>v2.0.4a.cab Update failed
C:\Documents and Settings\Pierre\Mes documents\MES LOGICIELS\encoder en mp3.exe=>wise0018 Update failed
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP27\A0006344.exe Infected with: Joke.Winshoot.A
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP27\A0006344.exe Disinfection failed
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP27\A0006344.exe Deleted
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP27\A0006345.exe Infected with: Joke.Winshoot.A
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP27\A0006345.exe Disinfection failed
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP27\A0006345.exe Deleted




Logfile of HijackThis v1.99.1
Scan saved at 16:57:26, on 19/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ui.skype.com/ui/0/1.0.2.55/en/download
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" -host -clearDebug
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)

merci beaucoup pour le travail que tu fais pour moi
voici dans l'ordre les 3 rapports demandés
1)blacklight

02/20/07 08:09:04 [Info]: BlackLight Engine 1.0.55 initialized
02/20/07 08:09:04 [Info]: OS: 5.1 build 2600 (Service Pack 2)
02/20/07 08:09:04 [Note]: 7019 4
02/20/07 08:09:04 [Note]: 7005 0
02/20/07 08:09:13 [Note]: 7006 0
02/20/07 08:09:13 [Note]: 7011 1248
02/20/07 08:09:13 [Note]: 7026 0
02/20/07 08:09:13 [Note]: 7026 0
02/20/07 08:09:19 [Note]: FSRAW library version 1.7.1021
02/20/07 08:24:57 [Note]: 7007 0

2) Clean 1

Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le 20/02/2007 a 8:26:50,67

*** Recherche de fichiers sur C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

"C:\Program Files\Dynamic Toolbar\" FOUND
"C:\Program Files\Viewpoint\" FOUND
*** Fin du rapport !
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le 20/02/2007 a 8:27:22,98

*** Recherche de fichiers sur C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

"C:\Program Files\Dynamic Toolbar\" FOUND
"C:\Program Files\Viewpoint\" FOUND
*** Fin du rapport !

3)clean 2

Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Option 2, executee le 20/02/2007 a 8:58:09,45

Microsoft Windows XP [version 5.1.2600]

*** Suppression de fichiers sur C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

tentative de suppression de "C:\Program Files\Dynamic Toolbar\"
tentative de suppression de "C:\Program Files\Viewpoint\"

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !

Quelle aventure!!