[Virus j'imagine...] pop-ups sans raison!

NAVILOG (2) (clean):::::::

Clean Navipromo version 2.0.5 commencé le 2007-07-27 à 19:46:01,32

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO

Mode suppression automatique avec prise en charge résultats Blacklight



*** fsbl1.txt non trouvé ***
(Assurez-vous que Blacklight n'avait rien trouvé lors de la recherche)


*** Suppression dossiers dans C:\WINDOWS ***


*** Suppression dossiers dans C:\Program Files ***


*** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***


*** Suppression dossiers dans C:\Documents and Settings\Jacinthe\Application Data ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Jacinthe\Local Settings\Temp effectué !


*** Sauvegarde du registre vers dossier Backupnavi***


sauvegarde du registre réalise avec succes !


*** Nettoyage registre ***


Nettoyage registre Ok

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

C:\WINDOWS\system32\knnmp.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\qstwa.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\ycbeg.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\knnmp.bak1 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\knnmp.bak2 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche et Suppression Heuristique :

*
**
***
****
*****
******
*******
********
C:\WINDOWS\System32\dckrehvb.exe trouvé !
Copie C:\WINDOWS\system32\dckrehvb.exe réalise avec succes !
C:\WINDOWS\system32\dckrehvb.exe supprimé !

C:\WINDOWS\System32\dvtshnvo.exe trouvé !
Copie C:\WINDOWS\system32\dvtshnvo.exe réalise avec succes !
C:\WINDOWS\system32\dvtshnvo.exe supprimé !

C:\WINDOWS\System32\dwcxlblh.exe trouvé !
Copie C:\WINDOWS\system32\dwcxlblh.exe réalise avec succes !
C:\WINDOWS\system32\dwcxlblh.exe supprimé !

C:\WINDOWS\System32\ertjxjmb.exe trouvé !
Copie C:\WINDOWS\system32\ertjxjmb.exe réalise avec succes !
C:\WINDOWS\system32\ertjxjmb.exe supprimé !

C:\WINDOWS\System32\ihjtgmxa.exe trouvé !
Copie C:\WINDOWS\system32\ihjtgmxa.exe réalise avec succes !
C:\WINDOWS\system32\ihjtgmxa.exe supprimé !

C:\WINDOWS\System32\mkfwllyy.exe trouvé !
Copie C:\WINDOWS\system32\mkfwllyy.exe réalise avec succes !
C:\WINDOWS\system32\mkfwllyy.exe supprimé !

C:\WINDOWS\System32\nrkfhofx.exe trouvé !
Copie C:\WINDOWS\system32\nrkfhofx.exe réalise avec succes !
C:\WINDOWS\system32\nrkfhofx.exe supprimé !

C:\WINDOWS\System32\omywtvjy.exe trouvé !
Copie C:\WINDOWS\system32\omywtvjy.exe réalise avec succes !
C:\WINDOWS\system32\omywtvjy.exe supprimé !

C:\WINDOWS\System32\uceegjam.exe trouvé !
Copie C:\WINDOWS\system32\uceegjam.exe réalise avec succes !
C:\WINDOWS\system32\uceegjam.exe supprimé !

C:\WINDOWS\System32\vculkwch.exe trouvé !
Copie C:\WINDOWS\system32\vculkwch.exe réalise avec succes !
C:\WINDOWS\system32\vculkwch.exe supprimé !


3)Contrôle présence clés Rootkit dans le registre :

Aucune autre clés présente dans le registre !

4)Certificats :


*** Nettoyage termine le 2007-07-27 à 19:49:43,76 ***

_____________________________________________________________________________

VUNDOFIX::::::


VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 19:51:29 2007-07-27

Listing files found while scanning....

C:\windows\system32\abxcvnyo.dll
C:\windows\system32\alpheogd.exe
C:\windows\system32\daxrovum.dll
C:\windows\system32\eqqxkqku.exe
C:\windows\system32\hxxxdjca.exe
C:\windows\system32\icmcejix.exe
C:\windows\system32\kabhiaru.exe
C:\WINDOWS\system32\knnmp.bak1
C:\WINDOWS\system32\knnmp.bak2
C:\WINDOWS\system32\knnmp.ini
C:\WINDOWS\system32\knnmp.ini2
C:\windows\system32\kxmdbwuv.dll
C:\WINDOWS\system32\pmnnk.dll
C:\windows\system32\qsyjwpvu.exe
C:\windows\system32\qtimubhw.exe
C:\windows\system32\rjkeudgf.exe
C:\windows\system32\rkhhbewn.exe
C:\windows\system32\rsggbkyw.exe
C:\WINDOWS\system32\smexojbv.dll
C:\windows\system32\smrvislw.exe
C:\windows\system32\vuwbdmxk.ini

Beginning removal...

Attempting to delete C:\windows\system32\abxcvnyo.dll
C:\windows\system32\abxcvnyo.dll Has been deleted!

Attempting to delete C:\windows\system32\alpheogd.exe
C:\windows\system32\alpheogd.exe Has been deleted!

Attempting to delete C:\windows\system32\daxrovum.dll
C:\windows\system32\daxrovum.dll Has been deleted!

Attempting to delete C:\windows\system32\eqqxkqku.exe
C:\windows\system32\eqqxkqku.exe Has been deleted!

Attempting to delete C:\windows\system32\hxxxdjca.exe
C:\windows\system32\hxxxdjca.exe Has been deleted!

Attempting to delete C:\windows\system32\icmcejix.exe
C:\windows\system32\icmcejix.exe Has been deleted!

Attempting to delete C:\windows\system32\kabhiaru.exe
C:\windows\system32\kabhiaru.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\knnmp.bak1
C:\WINDOWS\system32\knnmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\knnmp.bak2
C:\WINDOWS\system32\knnmp.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\knnmp.ini
C:\WINDOWS\system32\knnmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\knnmp.ini2
C:\WINDOWS\system32\knnmp.ini2 Has been deleted!

Attempting to delete C:\windows\system32\kxmdbwuv.dll
C:\windows\system32\kxmdbwuv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnnk.dll
C:\WINDOWS\system32\pmnnk.dll Has been deleted!

Attempting to delete C:\windows\system32\qsyjwpvu.exe
C:\windows\system32\qsyjwpvu.exe Has been deleted!

Attempting to delete C:\windows\system32\qtimubhw.exe
C:\windows\system32\qtimubhw.exe Has been deleted!

Attempting to delete C:\windows\system32\rjkeudgf.exe
C:\windows\system32\rjkeudgf.exe Has been deleted!

Attempting to delete C:\windows\system32\rkhhbewn.exe
C:\windows\system32\rkhhbewn.exe Has been deleted!

Attempting to delete C:\windows\system32\rsggbkyw.exe
C:\windows\system32\rsggbkyw.exe Has been deleted!

Attempting to delete C:\windows\system32\smrvislw.exe
C:\windows\system32\smrvislw.exe Has been deleted!

Attempting to delete C:\windows\system32\vuwbdmxk.ini
C:\windows\system32\vuwbdmxk.ini Has been deleted!

Performing Repairs to the registry.
Done!

__________________________________________________________________

VBG:::::


[07/27/2007, 19:57:56] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Jacinthe\Bureau\VirtumundoBeGone.exe" )
[07/27/2007, 19:57:58] - Detected System Information:
[07/27/2007, 19:57:58] - Windows Version: 5.1.2600, Service Pack 2
[07/27/2007, 19:57:58] - Current Username: Jacinthe (Admin)
[07/27/2007, 19:57:58] - Windows is in NORMAL mode.
[07/27/2007, 19:57:58] - Searching for Browser Helper Objects:
[07/27/2007, 19:57:58] - BHO 1: {0652FA6B-AF19-4357-9CA9-04E16EB1FCDD} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:58] - Checking for HKLM\...\Winlogon\Notify\gebcy
[07/27/2007, 19:57:58] - Key not found: HKLM\...\Winlogon\Notify\gebcy, continuing.
[07/27/2007, 19:57:58] - BHO 2: {1B52B048-DDB7-4C81-B573-D543BEB7BB94} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:58] - Checking for HKLM\...\Winlogon\Notify\awtsq
[07/27/2007, 19:57:58] - Key not found: HKLM\...\Winlogon\Notify\awtsq, continuing.
[07/27/2007, 19:57:58] - BHO 3: {259F616C-A300-44F5-B04A-ED001A26C85C} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:58] - No filename found. Continuing.
[07/27/2007, 19:57:58] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:58] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/27/2007, 19:57:58] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/27/2007, 19:57:58] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/27/2007, 19:57:58] - BHO 6: {7CF5F5F2-4974-41F0-BD84-854D099B5D2F} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:58] - Checking for HKLM\...\Winlogon\Notify\pmnnk
[07/27/2007, 19:57:58] - Key not found: HKLM\...\Winlogon\Notify\pmnnk, continuing.
[07/27/2007, 19:57:58] - BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:58] - No filename found. Continuing.
[07/27/2007, 19:57:58] - BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[07/27/2007, 19:57:58] - BHO 9: {941508F8-CCD9-44E0-AC29-4F1E141373F7} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:58] - Checking for HKLM\...\Winlogon\Notify\khfgdcb
[07/27/2007, 19:57:58] - Found: HKLM\...\Winlogon\Notify\khfgdcb - This is probably Virtumundo.
[07/27/2007, 19:57:58] - Assigning {941508F8-CCD9-44E0-AC29-4F1E141373F7} MSEvents Object
[07/27/2007, 19:57:58] - BHO list has been changed! Starting over...
[07/27/2007, 19:57:58] - BHO 1: {0652FA6B-AF19-4357-9CA9-04E16EB1FCDD} ()
[07/27/2007, 19:57:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:59] - Checking for HKLM\...\Winlogon\Notify\gebcy
[07/27/2007, 19:57:59] - Key not found: HKLM\...\Winlogon\Notify\gebcy, continuing.
[07/27/2007, 19:57:59] - BHO 2: {1B52B048-DDB7-4C81-B573-D543BEB7BB94} ()
[07/27/2007, 19:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:59] - Checking for HKLM\...\Winlogon\Notify\awtsq
[07/27/2007, 19:57:59] - Key not found: HKLM\...\Winlogon\Notify\awtsq, continuing.
[07/27/2007, 19:57:59] - BHO 3: {259F616C-A300-44F5-B04A-ED001A26C85C} ()
[07/27/2007, 19:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:59] - No filename found. Continuing.
[07/27/2007, 19:57:59] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/27/2007, 19:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:59] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/27/2007, 19:57:59] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/27/2007, 19:57:59] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/27/2007, 19:57:59] - BHO 6: {7CF5F5F2-4974-41F0-BD84-854D099B5D2F} ()
[07/27/2007, 19:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:59] - Checking for HKLM\...\Winlogon\Notify\pmnnk
[07/27/2007, 19:57:59] - Key not found: HKLM\...\Winlogon\Notify\pmnnk, continuing.
[07/27/2007, 19:57:59] - BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[07/27/2007, 19:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:59] - No filename found. Continuing.
[07/27/2007, 19:57:59] - BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[07/27/2007, 19:57:59] - BHO 9: {941508F8-CCD9-44E0-AC29-4F1E141373F7} (MSEvents Object)
[07/27/2007, 19:57:59] - ALERT: Found MSEvents Object!
[07/27/2007, 19:57:59] - BHO 10: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[07/27/2007, 19:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:57:59] - Checking for HKLM\...\Winlogon\Notify\dmiuargg
[07/27/2007, 19:57:59] - Key not found: HKLM\...\Winlogon\Notify\dmiuargg, continuing.
[07/27/2007, 19:57:59] - Finished Searching Browser Helper Objects
[07/27/2007, 19:57:59] - *** Detected MSEvents Object
[07/27/2007, 19:57:59] - Trying to remove MSEvents Object...
[07/27/2007, 19:58:00] - Terminating Process: IEXPLORE.EXE
[07/27/2007, 19:58:01] - Terminating Process: RUNDLL32.EXE
[07/27/2007, 19:58:01] - Disabling Automatic Shell Restart
[07/27/2007, 19:58:01] - Terminating Process: EXPLORER.EXE
[07/27/2007, 19:58:01] - Suspending the NT Session Manager System Service
[07/27/2007, 19:58:01] - Terminating Windows NT Logon/Logoff Manager
[07/27/2007, 19:58:01] - Re-enabling Automatic Shell Restart
[07/27/2007, 19:58:01] - File to disable: C:\WINDOWS\system32\khfgdcb.dll
[07/27/2007, 19:58:01] - Renaming C:\WINDOWS\system32\khfgdcb.dll -> C:\WINDOWS\system32\khfgdcb.dll.vir
[07/27/2007, 19:58:01] - File successfully renamed!
[07/27/2007, 19:58:01] - Removing HKLM\...\Browser Helper Objects\{941508F8-CCD9-44E0-AC29-4F1E141373F7}
[07/27/2007, 19:58:01] - Removing HKCR\CLSID\{941508F8-CCD9-44E0-AC29-4F1E141373F7}
[07/27/2007, 19:58:01] - Adding Kill Bit for ActiveX for GUID: {941508F8-CCD9-44E0-AC29-4F1E141373F7}
[07/27/2007, 19:58:02] - Deleting ATLEvents/MSEvents Registry entries
[07/27/2007, 19:58:02] - Removing HKLM\...\Winlogon\Notify\khfgdcb
[07/27/2007, 19:58:02] - Searching for Browser Helper Objects:
[07/27/2007, 19:58:02] - BHO 1: {0652FA6B-AF19-4357-9CA9-04E16EB1FCDD} ()
[07/27/2007, 19:58:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:58:02] - Checking for HKLM\...\Winlogon\Notify\gebcy
[07/27/2007, 19:58:02] - Key not found: HKLM\...\Winlogon\Notify\gebcy, continuing.
[07/27/2007, 19:58:02] - BHO 2: {1B52B048-DDB7-4C81-B573-D543BEB7BB94} ()
[07/27/2007, 19:58:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:58:02] - Checking for HKLM\...\Winlogon\Notify\awtsq
[07/27/2007, 19:58:02] - Key not found: HKLM\...\Winlogon\Notify\awtsq, continuing.
[07/27/2007, 19:58:02] - BHO 3: {259F616C-A300-44F5-B04A-ED001A26C85C} ()
[07/27/2007, 19:58:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:58:02] - No filename found. Continuing.
[07/27/2007, 19:58:02] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[07/27/2007, 19:58:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:58:02] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[07/27/2007, 19:58:02] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[07/27/2007, 19:58:02] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/27/2007, 19:58:02] - BHO 6: {7CF5F5F2-4974-41F0-BD84-854D099B5D2F} ()
[07/27/2007, 19:58:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:58:02] - Checking for HKLM\...\Winlogon\Notify\pmnnk
[07/27/2007, 19:58:02] - Key not found: HKLM\...\Winlogon\Notify\pmnnk, continuing.
[07/27/2007, 19:58:02] - BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[07/27/2007, 19:58:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:58:02] - No filename found. Continuing.
[07/27/2007, 19:58:02] - BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[07/27/2007, 19:58:02] - BHO 9: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[07/27/2007, 19:58:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/27/2007, 19:58:02] - Checking for HKLM\...\Winlogon\Notify\dmiuargg
[07/27/2007, 19:58:02] - Key not found: HKLM\...\Winlogon\Notify\dmiuargg, continuing.
[07/27/2007, 19:58:02] - Finished Searching Browser Helper Objects
[07/27/2007, 19:58:02] - Finishing up...
[07/27/2007, 19:58:02] - A restart is needed.
[07/27/2007, 19:58:15] - Attempting to Restart via STOP error (Blue Screen!)


____________________________________________________________________________

HIJACKTHIS:::::::::


Logfile of HijackThis v1.99.1
Scan saved at 20:02:36, on 2007-07-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
C:\WINDOWS\system32\ezSP_Px.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/spresults.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0652FA6B-AF19-4357-9CA9-04E16EB1FCDD} - C:\WINDOWS\system32\gebcy.dll (file missing)
O2 - BHO: (no name) - {1B52B048-DDB7-4C81-B573-D543BEB7BB94} - C:\WINDOWS\system32\awtsq.dll (file missing)
O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7CF5F5F2-4974-41F0-BD84-854D099B5D2F} - C:\WINDOWS\system32\pmnnk.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\dmiuargg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O28 "\\AMDMSI\EPSON Stylus CX3200" /M "Stylus CX3200"
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\system32\tfvmmhuw.dll",sitypnow
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tunebite.exe] C:\Program Files\tunebite\tunebite.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: .protected
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: .protected
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://arribaarriba.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe

Re,

On a dejat bien commencer a nettoyer,

On continue,

Sur HijackThis, refais un scan et coches les lignes suivantes :

O2 - BHO: (no name) - {0652FA6B-AF19-4357-9CA9-04E16EB1FCDD} - C:\WINDOWS\system32\gebcy.dll (file missing)
O2 - BHO: (no name) - {1B52B048-DDB7-4C81-B573-D543BEB7BB94} - C:\WINDOWS\system32\awtsq.dll (file missing)
O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
O2 - BHO: (no name) - {7CF5F5F2-4974-41F0-BD84-854D099B5D2F} - C:\WINDOWS\system32\pmnnk.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - Startup: .protected
O4 - Global Startup: .protected
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O11 - Options group: [INTERNATIONAL] International*

---> Ferme touts les programme en cours meme internet explorer ( sauf hijackthis ) puis clic sur le bouton "Fixer Objet"

Apres,

Tu peut me dire si tu connais ce programme : C:\Program Files\tunebite\tunebite.exe

Enfin,

Procedure de recherche Smitfraudfix :

Télécharge Smitfraudfix(de S!ri).: http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Enregistre-le sur ton bureau.
Lance SmitfraudFix.exe (le .exe peut ne pas apparaitre).
Choisis l'Option 1 (Recherche)
Poste le premier rapport ici.

Poste moi le rapport Smitfraudfix

@+

OUI je connais Tunebite, mais je l'ai désinstallé. C'est un programme pour convertir des aac en mp3 ou autres formats, etc.

Voici mon rapport:

SmitFraudFix v2.207

Rapport fait à 20:53:23,40, 2007-07-27
Executé à partir de C:\Documents and Settings\Jacinthe\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
C:\WINDOWS\system32\ezSP_Px.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\.protected PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\1024\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jacinthe


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jacinthe\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\Jacinthe\MENUDM~1\PROGRA~1\DMARRA~1\.protected PRESENT !
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\.protected PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jacinthe\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: 10/100 PCI Ethernet Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1A2E17DF-FF4F-495C-9AC3-30C10AB659F9}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1A2E17DF-FF4F-495C-9AC3-30C10AB659F9}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1A2E17DF-FF4F-495C-9AC3-30C10AB659F9}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1A2E17DF-FF4F-495C-9AC3-30C10AB659F9}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

je comprend pas la????

elle a ouvert plusieurs poste??

si tu eté avec avant je te laisse ton affaire je ne pensait pas m incruster!

a+

Salut,

Y pas de probleme, ont a poster notre reponse en meme temps,
Je t'ais laisser le poste, mais comme tu ne repondais pas, je l'ai continuer.

Il n'y a aucun probleme, bonne continuation,

Amitier, poussin59

@+