(infecté) jump permanant depuis google

Question

Bonour à tous, j'ai un virus depuis peu, à chaque fois que je fais une recherche sur google à partir de internet explorer (7) il y a un "redirect" ou "jump" vers tout un tas de sites différents comme partnersmamma. Pouvez vous m'aider s'il vous plait.
Merci d'avance

jlpjlp · Answer

colle un rapport hijackthis 
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html 


manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

kabalaistique · Answer

Merci beaucoup de m'aider, voici le rapport


Logfile of HijackThis v1.99.1
Scan saved at 16:27:00, on 19/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files	hreedegrees	hreedegrees.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\BricoPacks\Longhorn Inspirat\ObjectDock\ObjectDock.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijackthis\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: SYSTRAN Toolbar - {95daa571-4def-4a6d-97d8-98a346672a24} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" 0 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
O4 - HKCU\..\Run: [3Degrees] C:\Program Files	hreedegrees	hreedegrees.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Longhorn Inspirat\ObjectDock\ObjectDock.exe
O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Consulter les dictionnaires (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\GUIres.dll/lookup.js
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Traduire (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\GUIres.dll/translate.js
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{161FD097-4634-474A-AD5E-337EFDBBB7C4}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{3022561D-E799-4F7E-BFD8-2D224CE68521}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{4584E360-303D-4669-914E-51DFBB4F4CE0}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{46F67172-A958-416D-8F36-5EE973B6BE2B}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{8E379743-59FE-40DB-AAEC-FD4E0BED1AE3}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5B2BDFD-3F6C-487F-9EA1-593F05D99703}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5F3D6F0-442D-4D4A-9254-E61D380879F6}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.67 85.255.112.90
O17 - HKLM\System\CS1\Services\Tcpip\..\{161FD097-4634-474A-AD5E-337EFDBBB7C4}: NameServer = 85.255.116.67,85.255.112.90
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.67 85.255.112.90
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~3\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~3\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

jlpjlp · Answer

* Télécharge FixWareout d'un de ces deux sites sur le bureau: 
http://downloads.subratam.org/Fixwareout.exe 
http://swandog46.geekstogo.com/Fixwareout.exe 

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish. 
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal. 

*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) avec un nouveau rapport HijackThis! dans ta prochaine réponse

kabalaistique · Answer

voivi les deux rapports



Username "alexandre" - 2007-07-19 16:32:21 [Fixwareout edited 2007/07/05]

»»»»»Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdyod.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.116.67 85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{161FD097-4634-474A-AD5E-337EFDBBB7C4} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{3022561D-E799-4F7E-BFD8-2D224CE68521} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{4584E360-303D-4669-914E-51DFBB4F4CE0} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{46F67172-A958-416D-8F36-5EE973B6BE2B} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{8E379743-59FE-40DB-AAEC-FD4E0BED1AE3} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{B5B2BDFD-3F6C-487F-9EA1-593F05D99703} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{C5F3D6F0-442D-4D4A-9254-E61D380879F6} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{161FD097-4634-474A-AD5E-337EFDBBB7C4}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{3022561D-E799-4F7E-BFD8-2D224CE68521}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{4584E360-303D-4669-914E-51DFBB4F4CE0}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{46F67172-A958-416D-8F36-5EE973B6BE2B}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{8E379743-59FE-40DB-AAEC-FD4E0BED1AE3}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{B5B2BDFD-3F6C-487F-9EA1-593F05D99703}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.

Cache de résolution DNS vidé.


System was rebooted successfully. 
 
»»»»» Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "system"="" 
....
....
»»»»» Misc files. 
....
»»»»» Checking for older varients.
....
»»»»» Other
C:\WINDOWS\Temp\kdyod.ren 65067 05/08/2004 

»»»»» Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup"
"TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe\"  -osboot"
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="\"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe\""
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe"
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"
"msnmsgr"="\"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe\" /background"
"Camfrog"="\"C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe\" 0 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe"
"3Degrees"="C:\Program Files\threedegrees\threedegrees.exe"
"MSMSGS"="\"C:\Program Files\Messenger\Msmsgs.exe\" /background"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AutorunsDisabled]
"msnmsgr"="\"C:\Program Files\MSN Messenger\msnmsgr.exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»
  

et le rapport hijackthis 



Logfile of HijackThis v1.99.1
Scan saved at 16:35:57, on 19/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32
otepad.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files	hreedegrees	hreedegrees.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\BricoPacks\Longhorn Inspirat\ObjectDock\ObjectDock.exe
C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
C:\hijackthis\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: SYSTRAN Toolbar - {95daa571-4def-4a6d-97d8-98a346672a24} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" 0 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
O4 - HKCU\..\Run: [3Degrees] C:\Program Files	hreedegrees	hreedegrees.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Longhorn Inspirat\ObjectDock\ObjectDock.exe
O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: Consulter les dictionnaires (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\GUIres.dll/lookup.js
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Traduire (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\GUIres.dll/translate.js
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~3\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~3\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

jlpjlp · Answer

vire ces lignes


R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) 

O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: SYSTRAN Toolbar - {95daa571-4def-4a6d-97d8-98a346672a24} - mscoree.dll (file missing) 



-------------

pour les redirections c'est bon : encore des pbs?  les lignes 17 ont ete virées

---------------
C:\WINDOWS\system32\wbem\wmiprvse.exe 
supercopier2

je me mets de coté pour voir


________________

 télécharger sur le bureau 
Navilog.zip 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

= Double-Clic navilog1.zip 
= Extraire tout sur le bureau 
= Double-Clic navilog1 qui est sur le bureau 
= Appuyer sur une touche jusqu' arriver aux options 
= Choisir option 1 

un rapport : fixnavi.txt dans C : va se creer 
le copier/coller dans ton prochain message. 

___________________


__________________________
AVG antispyxare 

https://www.01net.com/ 

Tuto : 
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html 

->Relance AVG AS -> "Analyse" ->"Paramètres" 

Sous la question "Comment réagir ?" : 

-> clique sur "Actions recommandées" et choisis "Quarantaines" 
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" 

Si un fichier est infecté en fin d'analyse 

->Clique sur "Appliquer toutes les actions " 

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous". 

->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici 
_______________




Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

·  Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean 
·  Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec 
·  Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.

http://kerio.probb.fr/tuto-Clean-h37.html


----------------------- 
utilise aussi pour supprimer tes traces 

CCLEANER: (lance un netoyage et repare les clés) sans la barre yahoo 
https://www.01net.com/ 

_________________

si tout c'est bien passé redémarre en mode normal et désactive la restauration système pour purger les virus qui seraient dedans puis réactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

_____________
colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr 


______________ recolle hijackthis
encore des pbs?

kabalaistique · Answer

Merci pout on aide, systram n'est pas un virus, c'est un logiciel de traduction instantanée qui a une tool barre dans ie. J'ai aussi des problèmes de lenteur de chargement des pages internet sur ie. Dois-je aussi faire les dernières instructions de ton message ?

jlpjlp · Answer

je sias  mais comme il y a ecrit missing tu peux virer 

 et fait le reste

kabalaistique · Answer

Username "alexandre" - 2007-07-19 16:32:21 [Fixwareout edited 2007/07/05]

»»»»»Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdyod.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.116.67 85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{161FD097-4634-474A-AD5E-337EFDBBB7C4} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{3022561D-E799-4F7E-BFD8-2D224CE68521} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{4584E360-303D-4669-914E-51DFBB4F4CE0} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{46F67172-A958-416D-8F36-5EE973B6BE2B} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{8E379743-59FE-40DB-AAEC-FD4E0BED1AE3} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{B5B2BDFD-3F6C-487F-9EA1-593F05D99703} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{C5F3D6F0-442D-4D4A-9254-E61D380879F6} 
"nameserver"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{161FD097-4634-474A-AD5E-337EFDBBB7C4}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{3022561D-E799-4F7E-BFD8-2D224CE68521}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{4584E360-303D-4669-914E-51DFBB4F4CE0}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{46F67172-A958-416D-8F36-5EE973B6BE2B}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{8E379743-59FE-40DB-AAEC-FD4E0BED1AE3}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{B5B2BDFD-3F6C-487F-9EA1-593F05D99703}
"DhcpNameServer"="85.255.116.67,85.255.112.90" <Value cleared.

Cache de résolution DNS vidé.


System was rebooted successfully. 
 
»»»»» Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "system"="" 
....
....
»»»»» Misc files. 
....
»»»»» Checking for older varients.
....
»»»»» Other
C:\WINDOWS\Temp\kdyod.ren 65067 05/08/2004 

»»»»» Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup"
"TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe\"  -osboot"
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="\"C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe\""
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe"
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"
"msnmsgr"="\"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe\" /background"
"Camfrog"="\"C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe\" 0 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe"
"3Degrees"="C:\Program Files\threedegrees\threedegrees.exe"
"MSMSGS"="\"C:\Program Files\Messenger\Msmsgs.exe\" /background"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AutorunsDisabled]
"msnmsgr"="\"C:\Program Files\MSN Messenger\msnmsgr.exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»

jlpjlp · Answer

ca tu l'as deja mis fait la suite..........

kabalaistique · Answer

Fix Navipromo version 2.0.5

Rapport réalisé le 19/07/2007 16:56:56,15

jlpjlp · Answer

le rapport est incomplet!!!!

kabalaistique · Answer

Désolé, le voici:

Search Navipromo version 2.0.5 commencé le 19/07/2007 à 17:25:14,42
 
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files
avilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes *** 

 


*** Recherche dossiers dans C:\WINDOWS ***




*** Recherche dossiers dans C:\Program Files ***




*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\alexandre\Application Data ***



*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en


F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.

[+] Started on 07/19/07 at 17:25:17.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ..............................................................................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 07/19/07 at 17:39:55 (return code = 0).


*** Recherche fichiers *** 




*** Recherche cles registre ***


Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs] 
 
 

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage] 
 
 

Recherche Clé Magic Control 
 
HKEY_CURRENT_USER\Software\mc trouvé !  
 
 
*** Module de Recherche complémentaire *** 
(Recherche fichiers spécifiques) 
 
1)Recherche fichiers connus:


2)Recherche Heuristique :
* 
** 
*** 
**** 
***** 
****** 
******* 
******** 

3)Recherche Certificats :


*** Analyse Terminé le 19/07/2007 à 17:40:34,21 ***

jlpjlp · Answer

ok fait la suite

kabalaistique · Answer

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	12:18:47 20/07/2007

 + Résultat de l'analyse:	



:mozilla.45:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.156:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.351:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.399:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.94:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.95:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.96:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.130:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.131:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@3.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.106:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.107:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.275:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.276:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.277:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.278:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.116:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.44:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.39:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.328:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Com : Nettoyé.
:mozilla.26:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.115:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.307:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.64:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.65:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.66:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.67:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.68:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.6:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.7:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.8:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.148:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.149:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.384:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Ivwbox : Nettoyé.
:mozilla.124:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
:mozilla.125:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
:mozilla.126:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Live : Nettoyé.
C:\Documents and Settings\Invité\Cookies\invité@search.live[1].txt -> TrackingCookie.Live : Nettoyé.
:mozilla.510:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Masterstats : Nettoyé.
:mozilla.128:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.521:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.522:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.136:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.429:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.187:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Paycounter : Nettoyé.
:mozilla.550:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Paypal : Nettoyé.
:mozilla.436:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.437:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.439:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Revenue : Nettoyé.
:mozilla.440:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.441:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.442:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.443:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.18:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.19:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.20:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.21:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.196:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
:mozilla.197:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
:mozilla.198:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
:mozilla.199:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@tacoda[2].txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.91:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Nettoyé.
:mozilla.15:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.16:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.17:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\alexandre\Cookies\alexandre@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.74:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\Invité\Cookies\invité@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
:mozilla.482:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Yadro : Nettoyé.
:mozilla.27:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.28:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.29:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.30:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.31:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.32:C:\Documents and Settings\alexandre\Application Data\Mozilla\Firefox\Profiles\fbxwa82t.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
D:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP303\A0091986.exe -> Trojan.LdPinch.ccx : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

serpi · Answer

Aie aie aie,  même problème, je recommence tout a zéro ?

serpi · Answer

Je prend le devant si jamais qqu'un venait me sauver la vie (et merci beaucoup d'avance), donc le rapport hijackthis : 



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 15:25:11, on 20/08/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\christianne jouanne\Mes documents\Mes fichiers reçus\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/...
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/2Q00CPT/040C/bF7.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: CATLEvents Object - {02F96FB7-8AF6-439B-B7BA-2F952F9E4800} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\smwmoc.dat (file missing)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CATLEvents Object - {2527BEEF-1B3C-4D3B-98F0-7F3C1EB910A0} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\ssvda.dat (file missing)
O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\ptfbil.dat
O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\ptfbil.dat
O2 - BHO: CATLEvents Object - {68132581-10F2-416E-B188-4E648075325A} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\golksid.dat
O2 - BHO: CATLEvents Object - {72AC6865-B1D3-4C32-A27B-4B3BF04DE655} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\ptfbil.dat
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: CATLEvents Object - {8109AF33-6949-4833-8881-43DCC232B7B2} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\ptfbil.dat
O2 - BHO: HttpGuard - {98B822AD-6BE7-49BC-B773-97240B774080} - C:\WINDOWS\system32\AClient.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O2 - BHO: CATLEvents Object - {D487068E-9B04-4FE5-8A83-08344F800BF5} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\cvspxe.dat (file missing)
O2 - BHO: CATLEvents Object - {F32F8ECD-6CF3-459D-82F2-9738392C85A8} - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\ptfbil.dat
O2 - BHO: (no name) - {FD854A40-AC74-0251-1C65-73E68B2944DF} - C:\WINDOWS\Jgzdnkkh.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Search - {E9FE534E-A7A8-AD13-4946-690BE3CB92E6} - C:\WINDOWS\Jgzdnkkh.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [libftp] C:\WINDOWS\Fonts\libftp.exe
O4 - HKLM\..\Run: [*libftp] C:\WINDOWS\Fonts\libftp.exe
O4 - HKLM\..\Run: [*mfcweb] C:\WINDOWS\Help\SBSI\mfcweb.exe
O4 - HKLM\..\Run: [*smsvc] C:\WINDOWS\Config\smsvc.exe
O4 - HKLM\..\Run: [*tapi] C:\WINDOWS\inf	api.exe
O4 - HKLM\..\Run: [*inetabr] C:\WINDOWS\Help\SBSI\inetabr.exe
O4 - HKLM\..\Run: [*avacc] C:\WINDOWS\system\avacc.exe
O4 - HKLM\..\Run: [*libac] C:\WINDOWS\inf\libac.exe
O4 - HKLM\..\Run: [*comwms] C:\WINDOWS\comwms.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files
euf telecom
euf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?e3a96a5e4e1f419a8e45b2671d25f0e3
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?e3a96a5e4e1f419a8e45b2671d25f0e3
O9 - Extra button: Sites Perso - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)
O9 - Extra 'Tools' menuitem: Compaq France - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O20 - Winlogon Notify: expsvc - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\cvspxe.dat (file missing)
O20 - Winlogon Notify: utilsvc - C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\cvslitu.dat
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Prise en charge des cartes à puces (SCardDrv) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

jlpjlp · Answer

slt

utilise aussi pour supprimer tes traces 

CCLEANER: (lance un nettoyage et répare erreurs) sans la barre yahoo 

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

_______________


scan avec vundo

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.


puis :




virtumondebegone

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe


puis Symantec Vundo Remove Tool

https://www.broadcom.com/support/security-center


et 


https://www.broadcom.com/support/security-center

desactiver la restauration systeme le temps du redemarrage dans DEMARRER puis TOUS LES PROG puis ACCESOIRE puis OUTILS SYSTEME puis DANS RESTAURATION SYSTEME aller dans parametre et desactiver la restauration


__________________

combofix (colle le rapport)

http://mickael.barroux.free.fr/securite/combofix.php




____________________


Cleanzip


Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

•  Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean 
•  Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec 
•  Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.

http://kerio.probb.fr/tuto-Clean-h37.html

______________

recolle hijackthis et dis tes pbs

bbbbbbb · Answer

bmn

bx · Answer

bv

(infecté) jump permanant depuis google

19 réponses

Votre réponse

Newsletters