[Trojan] pub antivirus 2006 + xxx - Page 4

ah ok, oui c'est vrai jsuis bete car c pas dangereux, c'est juste "chiant" les fenetre ki souvre l'antivirus ki sonne toute les 15mn...

Re,

Fixe avec hijackthis ces lignes :

O4 - HKLM\..\Run: [nebaieh.dll] C:\windows\system32\rundll32.exe "C:\Documents and Settings\Xoy\Local Settings\Application Data\nebaieh.dll",vqpbsc

O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\windows\system32\eohvpuqi.dll",setvm

Puis repost un log et si ils sont partis on passera a la maniere forte

Je pense qu'ils sont suprimé :
Donc on passe a la maniere forte ? :P

_______________________________________

Logfile of HijackThis v1.99.1
Scan saved at 15:19:25, on 09/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\windows\Logi_MwX.Exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\program files\powerstrip\pstrip.exe
C:\windows\hffext\hffsrv.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Steam\steam.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [hffsrv] c:\windows\hffext\hffsrv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TrayServer] C:\MAGIX\Video_deluxe_2007_PLUS\TrayServer.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\windows\system32\PSDrvCheck.exe -CheckReg
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\windows\system32\shdocvw.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Re,

Tu as encore des symptômes ?? des pubs qui s'affichent ???

Heu pas pour le moment, mais comme elles viennes asser aleatoirement peut etre que dans 10mn j'en aurai... ?
ya pas un moyen de le verifier autre que kapersky online ? lol xD

Re,

Si donc tu telecharge virtumondobegone : http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

et sa : https://www.broadcom.com/support/security-center

ensuite tu redemarre en mode sans échec puis execute les 2 ensuites post leur rapport

Merci

maintenant merci de laisser mon ami tranquille nous somme sur la creation d'un site donc merci de le laisser tranquilllllllllllleeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

Hey,

Tu peux quand meme m'envoyer tes rapports.
Je les analyserais

Re, bon voila je t'envois les 2 rapports mais il faut savoir que pendant le premier scan Symantec, par 2 fois j'ai rereçut a nouveau "WARNING" "Instant accés" et la page qui s'ouvre.

______________________________________________________________

Symantec Trojan.Vundo Removal Tool 1.5.0

C:\Documents and Settings\Administrateur: (not scanned)
C:\Hentai: (not scanned)
C:\System Volume Information: (not scanned)

Trojan.Vundo has not been found on your computer.

______________________________________________________________

[03/09/2007, 16:19:06] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Xoy\Bureau\VirtumundoBeGone.exe" )
[03/09/2007, 16:19:13] - Detected System Information:
[03/09/2007, 16:19:13] - Windows Version: 5.1.2600, Service Pack 2
[03/09/2007, 16:19:13] - Current Username: Xoy (Admin)
[03/09/2007, 16:19:13] - Windows is in SAFE mode with Networking.
[03/09/2007, 16:19:13] - Searching for Browser Helper Objects:
[03/09/2007, 16:19:13] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[03/09/2007, 16:19:13] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[03/09/2007, 16:19:13] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/09/2007, 16:19:13] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[03/09/2007, 16:19:13] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[03/09/2007, 16:19:13] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[03/09/2007, 16:19:13] - BHO 4: {E5A1691B-D188-4419-AD02-90002030B8EE} (FlashFXP Helper for Internet Explorer)
[03/09/2007, 16:19:13] - Finished Searching Browser Helper Objects
[03/09/2007, 16:19:13] - Finishing up...
[03/09/2007, 16:19:13] - Nothing found! Exiting...

Re,

Fait un rapport AVG anti-spyware et tu les supprime tous
Tu m'envoye le post
J'ai trouvé ton problème

PS : désolé pour ton ami, c'est vrai qu'il passe beaucoup de temps sur mon cas...

Le meme qu'hier ? Analyse complete du systeme ou Analyse rapide du systeme ?

Re,

Desinstalle ton jeu de poker stp(il est fournisseur de spywares :s ) Puis Poste de travail > ( ta marque c: ) Programmes files > et tu cherche powerstrip et tu supprime ce dossier

Heu mais powerstrip j'en ai besoin je pourrai qd meme le reinstaller par la suite ? si je suprime le dossier sans le desinstallé sa posera un probleme non ?

Re,

Tu fait une analyse complète du systeme avec AVG as.
Pour powerstrip si tu le desinstalle et que il n'y a pas de changement ce n'est pas sa mais si il y a du changement sa veut dire que ton infection vennait de la.

Suprime egalement powerstrip dans program files

N'oublie le log avg as + un log hijahck

A noté aussi que la ligne 020 est revenu...
Voila l analyse AVG puis derriere le hjt :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 17:35:24 09/03/2007

+ Résultat de l'analyse:

C:\System Volume Information\_restore{E1972979-35AB-447F-8DDF-139C685285BE}\RP428\A0169679.exe -> Adware.SaveNow : Nettoyé.
C:\System Volume Information\_restore{E1972979-35AB-447F-8DDF-139C685285BE}\RP428\A0169678.dll -> Adware.Softomate : Nettoyé.
C:\WINDOWS\Temp\win39.tmp.exe -> Heuristic.Win32.Dialer : Nettoyé.
:mozilla.7:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.41:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.42:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.50:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.51:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.52:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@bfast[1].txt -> TrackingCookie.Bfast : Nettoyé.
:mozilla.17:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.29:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@findwhat[1].txt -> TrackingCookie.Findwhat : Nettoyé.
:mozilla.40:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@pro-market[2].txt -> TrackingCookie.Pro-market : Nettoyé.
:mozilla.79:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.80:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.81:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.83:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.14:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.15:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.16:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Xoy\Cookies\xoy@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.25:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.26:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.27:C:\Documents and Settings\Xoy\Application Data\Mozilla\Firefox\Profiles\pfy3uqt7.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
D:\System Volume Information\_restore{E1972979-35AB-447F-8DDF-139C685285BE}\RP428\A0169677.exe -> Trojan.Proxcrak.A : Nettoyé.

Fin du rapport

__________________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 17:35:58, on 09/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\windows\Logi_MwX.Exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\windows\hffext\hffsrv.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [hffsrv] c:\windows\hffext\hffsrv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC210NC Webcam
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TrayServer] C:\MAGIX\Video_deluxe_2007_PLUS\TrayServer.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\windows\system32\PSDrvCheck.exe -CheckReg
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\windows\system32\shdocvw.dll (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: winjvd32 - C:\windows\SYSTEM32\winjvd32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Re,

Bon on va deja enlever Adware.SaveNow et Adware.Softomate tout simplement en désactivant et réactivant la restauration du système

Aide : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924

Voila c'est fait.

Re,

J'ai oublier de préciser quand tu l'enleve et que tu la remets entre il faut redemarrer l'ordi

Puis tu me dit si tu recois encore des pubs etc...

Désolé

OK je recommence
jte tien au courrant, c'est possible que juste en faisant cette manip ça le suprime ?

Sinon tu as vu, la ligne 020 winlogin est revenu dans hjt..