virus Résolu

Question

bonjour à tous 
je reviens vers vous mon rodi est infecté 
je rencontre de soucis de sons sons distendus 
j ai du faire reformater mon ordi et augmenter ma ram 

il y a deux semaines donc j ai reinstallé mes logiciels telechargé certains ...  et depuis mon ordi est à nouveau lent beuggue 
 ja i avast spydocteor
adaware 2007 
merci de m 'aider

jlpjlp · Answer

utilise  pour supprimer tes traces 

CCLEANER: (lance un nettoyage et répare erreurs) sans installer la barre yahoo 

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html


______________


AVG antispyxare

https://www.01net.com/telecharger/
Tuto : 
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html

->Relance AVG AS -> "Analyse" ->"Paramètres" 

Sous la question "Comment réagir ?" : 

-> clique sur "Actions recommandées" et choisis "Quarantaines" 
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" 

Si un fichier est infecté en fin d'analyse 

->Clique sur "Appliquer toutes les actions " 

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous". 

->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici


_______________



 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

scan en ligne firefox

https://www.trendmicro.com/fr_fr/business.html

 Panda en ligne : 
http://pandasoftware.fr
______________


si ca persiste 

colle un rapport hijackthis 
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html 


manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

kinoucharlot · Answer

voici le rapport
: 
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 21:46:24, on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft Works\WkDStore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ordinateur\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips	bBes1.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {C1ADC5ED-FB26-4770-AFE5-BD3A7EB5C148} - (no file)
O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips	bBes1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips	bBes1.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Contrôleur d’état.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SmartUI.lnk = C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a0ed5e83e18841879e55f819b7a43c4f
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a0ed5e83e18841879e55f819b7a43c4f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

farid_le_tunisien · Answer

Bonjour, 

mon bureau ne fait que de disparetre
voici le resulyay de hijack this.  Aider moi s'il vous plait.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:02:47, on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32	askmgr.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Windows Explorer Key] C:\WINDOWS\system\explorer.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\RunServices: [q] C:\WINDOWS\system32\q.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?a4906e508a5f48b8b31dc0ae777912fd
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?a4906e508a5f48b8b31dc0ae777912fd
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

KINOUCHARLOT · Answer

Bonjour, 
VOICI LE COPIER COLLER DU RAPPORT / 
Search Navipromo version 3.2.1 commencé le 2007-10-07 à 15:27:47.89

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files
avilog1
Mise a jour le 03.10.2007 a 20h00 by IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 


*** Recherche Programmes installes ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\ordinateur\Application Data ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector by gmer ***
pour + d'infos : http://www.gmer.net

Aucun fichier trouvé dans :

- C:\WINDOWS\system32
- C:\DOCUME~1\ORDINA~1\LOCALS~1\APPLIC~1



*** Recherche avec GenericNaviSearch ***
!!! Tous Ces résultats peuvent révéler des fichiers légitimes !!!
!!! A verifier impérativement avant toute suppression manuelle !!!

* Scan C:\WINDOWS\system32 *

Fichiers suspects :


* Scan C:\DOCUME~1\ORDINA~1\LOCALS~1\APPLIC~1 *



*** Recherche fichiers *** 




*** Recherche cles registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\klkkj.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\klkkj.bak1 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\klkkj.bak2 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche Heuristique :



3)Recherche Certificats :

Certificat Egroup absent !


*** Analyse Terminé le 2007-10-07 à 15:29:11.26 ***
J ATTENDS TES INSTRUCTIONS POUR LE SUITE A  DONNER
JE TE REMERCIE DE TA BIENVEILLANCE  DONNER 
MES PBS / LENTEUR DU PC
SURTOUT UN PB DE SON LE SON EST DISTORDU? DISCONTINUE ,, ,,??
MERCI DE TES R2PONSE 
BON DIMANCHE

jlpjlp · Answer

scan avec vundo fix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.


puis :

______________


virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe


_____________



combofix (colle le rapport)

http://mickael.barroux.free.fr/securite/combofix.php

_______________

recolle hijackthis


_________________


= Lance navilog1 
= Cette fois-ci choisi l'option 2 
= Navilog va faire le nettoyage.. patient jusqu'à ce qui soit marqué *** Nettoyage Termine le ..... *** 
= Un rapport va être génrer sur ton C:\ qui sera en option 2 
Note: le bureau disparaît 

= colle le contenu du rapport de navilog (qui est en option2) 


PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches. 
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter" 
Tape explorer et valide. Celà te fera apparaitre ton bureau

kinoucharlot · Answer

Bonjour, 
VundoFix il indique que vondo n'apas été de"tecte 
virtumondebegone ( rapport 
[09/28/2007, 21:59:56] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ordinateur\Bureau\VirtumundoBeGone.exe" )
[09/28/2007, 22:00:04] - Detected System Information:
[09/28/2007, 22:00:04] -  Windows Version: 5.1.2600, Service Pack 2
[09/28/2007, 22:00:04] -  Current Username: ordinateur (Admin)
[09/28/2007, 22:00:04] -  Windows is in NORMAL mode.
[09/28/2007, 22:00:04] - Searching for Browser Helper Objects:
[09/28/2007, 22:00:04] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[09/28/2007, 22:00:04] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[09/28/2007, 22:00:04] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[09/28/2007, 22:00:04] -  BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[09/28/2007, 22:00:04] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/28/2007, 22:00:04] -  No filename found. Continuing.
[09/28/2007, 22:00:04] -  BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[09/28/2007, 22:00:04] -  BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[09/28/2007, 22:00:04] -  BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[09/28/2007, 22:00:04] -  BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper)
[09/28/2007, 22:00:04] -  BHO 9: {C1ADC5ED-FB26-4770-AFE5-BD3A7EB5C148} ()
[09/28/2007, 22:00:04] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/28/2007, 22:00:04] -  No filename found. Continuing.
[09/28/2007, 22:00:04] -  BHO 10: {da30eff8-ccc6-4162-a20d-67402a26a215} (Best Security Tips Toolbar)
[09/28/2007, 22:00:04] -  BHO 11: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} ()
[09/28/2007, 22:00:04] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/28/2007, 22:00:04] -  No filename found. Continuing.
[09/28/2007, 22:00:04] - Finished Searching Browser Helper Objects
[09/28/2007, 22:00:04] - Finishing up...
[09/28/2007, 22:00:04] - Nothing found! Exiting...

[09/28/2007, 22:04:02] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ordinateur\Bureau\VirtumundoBeGone(2).exe" )
[09/28/2007, 22:04:04] - Detected System Information:
[09/28/2007, 22:04:04] -  Windows Version: 5.1.2600, Service Pack 2
[09/28/2007, 22:04:04] -  Current Username: ordinateur (Admin)
[09/28/2007, 22:04:04] -  Windows is in NORMAL mode.
[09/28/2007, 22:04:04] - Searching for Browser Helper Objects:
[09/28/2007, 22:04:04] -  BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[09/28/2007, 22:04:04] -  BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[09/28/2007, 22:04:04] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[09/28/2007, 22:04:04] -  BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[09/28/2007, 22:04:04] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/28/2007, 22:04:04] -  No filename found. Continuing.
[09/28/2007, 22:04:04] -  BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[09/28/2007, 22:04:04] -  BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[09/28/2007, 22:04:04] -  BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[09/28/2007, 22:04:04] -  BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper)
[09/28/2007, 22:04:04] -  BHO 9: {da30eff8-ccc6-4162-a20d-67402a26a215} (Best Security Tips Toolbar)
[09/28/2007, 22:04:04] -  BHO 10: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} ()
[09/28/2007, 22:04:04] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/28/2007, 22:04:04] -  No filename found. Continuing.
[09/28/2007, 22:04:04] - Finished Searching Browser Helper Objects
[09/28/2007, 22:04:04] - Finishing up...
[09/28/2007, 22:04:04] - Nothing found! Exiting...

[10/07/2007, 19:58:45] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ordinateur\Bureau\VirtumundoBeGone(2).exe" )
[10/07/2007, 19:58:52] - Detected System Information:
[10/07/2007, 19:58:52] -  Windows Version: 5.1.2600, Service Pack 2
[10/07/2007, 19:58:52] -  Current Username: ordinateur (Admin)
[10/07/2007, 19:58:52] -  Windows is in NORMAL mode.
[10/07/2007, 19:58:52] - Searching for Browser Helper Objects:
[10/07/2007, 19:58:52] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/07/2007, 19:58:52] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/07/2007, 19:58:52] -  BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/07/2007, 19:58:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/07/2007, 19:58:52] -  No filename found. Continuing.
[10/07/2007, 19:58:52] -  BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/07/2007, 19:58:52] -  BHO 5: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/07/2007, 19:58:52] -  BHO 6: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} ()
[10/07/2007, 19:58:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/07/2007, 19:58:52] -  No filename found. Continuing.
[10/07/2007, 19:58:52] - Finished Searching Browser Helper Objects
[10/07/2007, 19:58:52] - Finishing up...
[10/07/2007, 19:58:52] - Nothing found! Exiting...

[10/08/2007, 19:59:04] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ordinateur\Local Settings\Temporary Internet Files\Content.IE5\1WFSJD49\VirtumundoBeGone[1].exe" )
[10/08/2007, 19:59:09] - Detected System Information:
[10/08/2007, 19:59:09] -  Windows Version: 5.1.2600, Service Pack 2
[10/08/2007, 19:59:09] -  Current Username: ordinateur (Admin)
[10/08/2007, 19:59:09] -  Windows is in NORMAL mode.
[10/08/2007, 19:59:09] - Searching for Browser Helper Objects:
[10/08/2007, 19:59:09] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/08/2007, 19:59:09] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/08/2007, 19:59:09] -  BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/08/2007, 19:59:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/08/2007, 19:59:09] -  No filename found. Continuing.
[10/08/2007, 19:59:09] -  BHO 4: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/08/2007, 19:59:09] -  BHO 5: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/08/2007, 19:59:09] -  BHO 6: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} ()
[10/08/2007, 19:59:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/08/2007, 19:59:10] -  No filename found. Continuing.
[10/08/2007, 19:59:10] - Finished Searching Browser Helper Objects
[10/08/2007, 19:59:10] - Finishing up...
[10/08/2007, 19:59:10] - Nothing found! Exiting...
je realise la troisième nanip je t'adresse le rapport plus tard 
merci

kinoucharlot · Answer

Bonjour, voici le rapport de combofix

ComboFix 07-10-08.3 - ordinateur 2007-10-08 20:14:47.1 - NTFSx86
Microsoft Windows XP dition familiale 5.1.2600.2.1252.1.1036.18.359 [GMT 2:00]
Running from: C:\Documents and Settings\ordinateur\Local Settings\Temporary Internet Files\Content.IE5\N7UVSYF0\ComboFix[1].exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\autorun.inf
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\djtpqncx.dll
C:\WINDOWS\system32\dnlobxcj.dll
C:\WINDOWS\system32\jcxbolnd.ini
C:\WINDOWS\system32\klkkj.bak1
C:\WINDOWS\system32\klkkj.bak2
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\klkkj.tmp
C:\WINDOWS\system32\xcnqptjd.ini
N:\Autorun.inf
N:\autorun.inf

.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-08 to 2007-10-08 ))))))))))))))))))))))))))))))))))))
.

2007-10-08 17:00 <REP> d-------- C:\Program Files\iPod
2007-10-08 16:59 <REP> d-------- C:\Program Files\iTunes
2007-10-08 16:58 <REP> d-------- C:\WINDOWS\SxsCaPendDel
2007-10-08 16:54 <REP> d-------- C:\Program Files\Apple Software Update
2007-10-07 15:26 <REP> d-------- C:\Program Files\Navilog1
2007-10-02 21:01 <REP> d-------- C:\Program Files\Real Alternative
2007-10-02 21:01 <REP> d-------- C:\Program Files\Media Player Classic
2007-10-02 21:01 <REP> d-------- C:\Documents and Settings\ordinateur\Application Data\Real
2007-10-02 21:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Real
2007-09-28 22:02 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-28 21:51 <REP> d-------- C:\Documents and Settings\ordinateur\.housecall6.6
2007-09-28 15:00 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
2007-09-27 19:09 <REP> d-------- C:\WINDOWS\system32\NtmsData
2007-09-23 20:15 <REP> d-------- C:\WINDOWS\system32\fr-fr
2007-09-22 19:56 <REP> d-------- C:\Program Files\Panda Security
2007-09-22 10:31 <REP> d-------- C:\b80f0a8190e6dc6532
2007-09-13 19:31 <REP> d-------- C:\Documents and Settings\ordinateur\Application Data\ScanSoft
2007-09-13 19:28 50 --a------ C:\WINDOWS\system32\bridf05a.dat
2007-09-13 19:27 121,856 --a------ C:\WINDOWS\system32\BrWia05a.dll
2007-09-13 19:27 55,296 --------- C:\WINDOWS\system32\brinsstr.dll
2007-09-13 19:27 37,888 --a------ C:\WINDOWS\system32\BrUSi05a.dll
2007-09-13 19:27 15,295 --a------ C:\WINDOWS\system32\drivers\BrScnUsb.sys
2007-09-13 19:26 <REP> d-------- C:\Program Files\Brother
2007-09-13 19:26 <REP> d-------- C:\Brother
2007-09-13 19:26 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL
2007-09-13 19:26 147,456 --------- C:\WINDOWS\brunin03.dll
2007-09-13 19:26 122,880 --------- C:\WINDOWS\system32\BrfxD05a.dll
2007-09-13 19:26 81,920 --------- C:\WINDOWS\system32\BrWebIns.dll
2007-09-13 19:26 65,536 --------- C:\WINDOWS\system32\BRWEBUP.EXE
2007-09-13 19:26 0 --a------ C:\WINDOWS\brdfxspd.dat
2007-09-13 19:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2007-09-13 16:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft
2007-09-12 08:12 <REP> d-------- C:\VundoFix Backups
2007-09-11 15:18 81,024 --a------ C:\WINDOWS\system32\drivers\msfwdrv.sys
2007-09-11 15:16 105,856 --a------ C:\WINDOWS\system32\drivers\msfwhlpr.sys
2007-09-11 14:58 67,784 --a------ C:\WINDOWS\system32\drivers\MpFilter.sys
2007-09-11 13:03 <REP> d-------- C:\Program Files\Microsoft Windows OneCare Live
2007-09-10 22:03 <REP> d-------- C:\Program Files\Windows Live Safety Center

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-07 20:12 --------- d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-10-07 15:47 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\LimeWire
2007-10-07 15:23 --------- d-------- C:\Program Files\Yahoo!
2007-10-07 15:21 --------- d-------- C:\Program Files\Windows Live Toolbar
2007-10-04 08:04 --------- d-------- C:\Program Files\Best_Security_Tips
2007-09-13 19:26 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-09-13 19:26 --------- d-------- C:\Program Files\Fichiers communs\InstallShield
2007-09-13 19:20 --------- d-------- C:\Program Files\Fichiers communs\scansoft shared
2007-09-10 17:29 --------- d-------- C:\Program Files\Spyware Doctor
2007-09-07 14:54 --------- d-------- C:\Program Files\CCleaner
2007-09-04 20:33 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\Apple Computer
2007-09-04 20:27 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-09-04 20:22 --------- d-------- C:\Program Files\QuickTime
2007-09-04 20:07 --------- d-------- C:\Program Files\Fichiers communs\Apple
2007-09-04 20:07 --------- d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-09-04 19:46 24864 --a------ C:\WINDOWS\system32\drivers\INFCACHE.1
2007-09-04 19:45 24884 --a------ C:\WINDOWS\system32\drivers\gnsmouse.PNF
2007-09-04 19:45 --------- d-------- C:\Program Files\TwinTouch LuxeMate
2007-09-04 13:40 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-09-04 13:40 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-09-04 13:31 --------- d-------- C:\Program Files\Lavasoft
2007-09-04 13:18 --------- d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-09-02 20:18 --------- d-------- C:\Program Files\Scansoft
2007-09-02 20:04 --------- d-------- C:\Program Files\Microsoft SQL Server
2007-09-01 18:51 --------- d-------- C:\Program Files\LimeWire Turbo Accelerator
2007-09-01 13:01 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\Talkback
2007-09-01 12:50 --------- d-------- C:\Program Files\Common Files
2007-08-29 07:47 --------- d-------- C:\Program Files\Picasa2
2007-08-28 08:16 --------- d-------- C:\Program Files\Microsoft ActiveSync
2007-08-26 20:43 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\vlc
2007-08-26 10:51 --------- d-------- C:\Program Files\Google
2007-08-26 10:51 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\PC Tools
2007-08-26 10:35 --------- d-------- C:\Program Files\VideoLAN
2007-08-26 10:06 --------- d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-08-26 09:48 --------- d-------- C:\Program Files\Windows Media Connect 2
2007-08-18 15:21 --------- d-------- C:\Program Files\Everest Poker
2007-08-15 15:13 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\Google
2007-08-15 13:56 --------- d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-08-15 13:55 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-08-15 13:55 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2007-08-15 13:50 --------- d-------- C:\Program Files\Motorola Phone Tools
2007-08-15 13:48 --------- d-------- C:\Program Files\Fichiers communs\Motorola Shared
2007-08-15 13:46 9232 --a------ C:\Documents and Settings\ordinateur\mqdmmdfl.sys
2007-08-15 13:46 92064 --a------ C:\Documents and Settings\ordinateur\mqdmmdm.sys
2007-08-15 13:46 79328 --a------ C:\Documents and Settings\ordinateur\mqdmserd.sys
2007-08-15 13:46 66656 --a------ C:\Documents and Settings\ordinateur\mqdmbus.sys
2007-08-15 13:46 6208 --a------ C:\Documents and Settings\ordinateur\mqdmcmnt.sys
2007-08-15 13:46 5936 --a------ C:\Documents and Settings\ordinateur\mqdmwhnt.sys
2007-08-15 13:46 4048 --a------ C:\Documents and Settings\ordinateur\mqdmcr.sys
2007-08-15 13:46 25600 --a------ C:\Documents and Settings\ordinateur\usbsermptxp.sys
2007-08-15 13:46 22768 --a------ C:\Documents and Settings\ordinateur\usbsermpt.sys
2007-08-14 17:02 82248 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-08-14 17:02 57672 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-08-14 17:02 40264 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-08-14 17:02 29000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-08-11 08:31 --------- d-------- C:\Documents and Settings\All Users\Application Data\Google
2007-08-09 07:30 --------- d-------- C:\Program Files\LiveUpdate
2007-08-09 07:30 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\InstallShield
2007-08-08 08:19 --------- d-------- C:\Program Files\Snapshot Viewer
2007-08-08 08:19 --------- d-------- C:\Documents and Settings\ordinateur\Application Data\Microsoft Web Folders
2007-08-08 08:19 --------- d-------- C:\Documents and Settings\All Users\Application Data\SBT
2007-08-08 08:18 --------- d-------- C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 07:15]
"SoundMan"="SOUNDMAN.EXE" [2004-05-15 00:47 C:\WINDOWS\SOUNDMAN.EXE]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-26 10:46]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"mouseElf"="C:\PROGRA~1\TWINTO~1\MouseElf.EXE" [2004-08-26 01:45]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2007-08-01 15:06]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22]
"PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [2005-03-17 19:17]
"IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [2005-03-17 19:30]
"SetDefPrt"="C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 18:02]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 17:42]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2003-04-23 01:09]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-16 19:47]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

R0 Si3112r;ATI-436E Serial ATA Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys
R1 MSFWHLPR;MSFWHLPR;C:\WINDOWS\system32\DRIVERS\msfwhlpr.sys
R2 MSFWDrv;MSFWDrv;C:\WINDOWS\system32\DRIVERS\msfwdrv.sys
R2 msfwsvc;OneCare Firewall;"C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe"
R2 OneCareMP;OneCare AntiSpyware and AntiVirus;"C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe"
R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys
R3 MpFilter;Microsoft Malware Protection Driver;C:\WINDOWS\system32\DRIVERS\MpFilter.sys
R3 ovt530;Webcam Deluxe;C:\WINDOWS\system32\Drivers\ov530vid.sys
S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-08 14:54:32 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-08 20:22:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-10-08 20:27:25 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-08 20:26
.
--- E O F ---
j ai un pb de son distordu toujours et encore
merci de ton aide

jlpjlp · Answer

Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

·  Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean 
·  Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec 
·  Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.

http://kerio.probb.fr/tuto-Clean-h37.html

kinoucharlot · Answer

Bonjour, 
Dès l'allumage de celui-ci tapotez la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisissez "mode sans échec" attendez un peu.. j 'ai tenté plusieurs fois cette manipulation sans aucin succes 
l'état de l'ordinateur s'est agravé depuis 
il m'informa que la mémoire virtuelle est insuffisante pourtant il est boosté j'ai une tres grosse capacité 
rintime error 216 at 771144 f 1 apparait 
et si je clique sur ok ---------------------------
SDTrayApp.exe - Erreur d'application
---------------------------
L'instruction à "0x771144f1" emploie l'adresse mémoire "0x010d6690". La mémoire ne peut pas être "read".


Cliquez sur OK pour terminer le programme.
---------------------------
OK   
---------------------------

merci de me donner vos lumiéres si precieuse bonne journée

jlpjlp · Answer

colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

scan en ligne firefox

https://www.trendmicro.com/fr_fr/business.html

Panda en ligne :
http://pandasoftware.fr
______________ 

et recolle un rapport hijackthis en le renommant

kinoucharlot · Answer

rapport pa
;***********************************************************************************************************************************************************************************
ANALYSIS: 2007-11-16 18:04:45
PROTECTIONS: 1
MALWARE: 40
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Windows Live OneCare                         1.0.0                         Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@doubleclick[2].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.doubleclick.net/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@atdmt[3].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.atdmt.com/]
00139535  Application/Processor              HackTools           No        0         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034969.exe[Â²Æ’Ã‡]
00139535  Application/Processor              HackTools           No        0         Yes            No           C:\Program Files\Navilog1\Process.exe
00139535  Application/Processor              HackTools           No        0         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034970.exe[Â²Æ’Ã‡]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@tradedoubler[1].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@tradedoubler[3].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@247realmedia[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@fastclick[1].txt
00145460  Cookie/2o7                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\LocalService\Cookies\system@2o7[1].txt
00145460  Cookie/2o7                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@2o7[2].txt
00145460  Cookie/2o7                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.2o7.net/]
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tribalfusion.com/]
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@mediaplex[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.mediaplex.com/]
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@mediaplex[3].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@com[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           D:\Documents and Settings\KINOU\Cookies\kinou@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.xiti.com/]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           D:\Documents and Settings\JEANNE\Cookies\jeanne@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@xiti[2].txt
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fe.lea.lycos.fr/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@ad.yieldmanager[2].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[ad.yieldmanager.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@apmebf[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@serving-sys[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bs.serving-sys[1].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bs.serving-sys[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@weborama[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@weborama[2].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.adtech.de/]
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@adtech[1].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@fl01.ct2.comclick[2].txt
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@advertising[1].txt
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@media.adrevolver[1].txt
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[statse.webtrendslive.com/]
00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@ads.pointroll[1].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@overture[1].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.overture.com/]
00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@questionmarket[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bluestreak[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bluestreak[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.bluestreak.com/]
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@adrevolver[1].txt
00238695  Application/Pskill.K               HackTools           No        0         Yes            No           C:\Documents and Settings\ordinateur\Bureau\clean\clean.zip[clean/pskill.exe]
00238695  Application/Pskill.K               HackTools           No        0         Yes            No           C:\Documents and Settings\ordinateur\Bureau\clean\clean\pskill.exe
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@smartadserver[1].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@smartadserver[3].txt
00372251  Application/Messengerskinner       HackTools           No        0         Yes            No           D:\Documents and Settings\KINOU\Application Data\MessengerSkinner\Userdata\Install_MessengerSkinner.zip[Msgskinner_setup.exe]
00519333  Application/Processor              HackTools           No        0         Yes            No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034970.exe
00519333  Application/Processor              HackTools           No        0         Yes            No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034969.exe
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP125\A0034927.exe
01262593  Application/NirCmd.A               HackTools           No        0         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034968.exe[nircmd.exe]
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\WINDOWS\NirCmd.exe
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP125\A0034941.exe



















02005846  Adware/AdRotator                   Adware              No        0         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034972.exe[Â²ÃœÃ‡\setup_rightonadz.exe][â– %%\gzmrotate.dll]
02005849  Adware/BHO                         Adware              No        0         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034972.exe[Â²ÃœÃ‡\setup_rightonadz.exe]
02164068  Trj/Downloader.MDW                 Virus/Trojan        No        1         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034972.exe[Â²ÃœÃ‡\ads_3.4.exe][Â²Ã¯Ã‡]
02197130  Trj/Rebooter.J                     Virus/Trojan        No        1         Yes            No           C:\Program Files\Navilog1eboot.exe
02203673  Adware/AdRotator                   Adware              No        0         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034972.exe[Â²ÃœÃ‡\ads_3.4.exe][Â²ÂªÃ‡]
02204807  Adware/BHO                         Adware              No        0         No             No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034972.exe[Â²ÃœÃ‡\ads_3.4.exe]
02571947  Adware/AdRotator                   Adware              No        0         Yes            No           C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP126\A0034972.exe
02634745  Application/Playmp3z               HackTools           No        0         Yes            No           C:\Documents and Settings\ordinateur\Bureau\archive\outlook french.zip[Setup.exe]
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================







raoort hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:11:39, on 16/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MI1933~1\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.discut.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Contrôleur d’état.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SmartUI.lnk = C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

jlpjlp · Answer

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.discut.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)


Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - Global Startup: Contrôleur d’état.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

________________________


utilise  pour supprimer tes traces  

CCLEANER: (lance un nettoyage et répare 3 fois les erreurs) sans installer la barre yahoo 

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

_______________________

si tout c'est bien passé désactive la restauration système pour purger les virus qui seraient dedans  (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

redemarre l'ordi

puis réactive là

__________________________

DIS TES PROBLEMES  et recolle un scan en ligne panda

kinoucharlot · Answer

Bonjour, 
j ai une prcision à vous demander relative à votre précedent message : 
les trois premières lignes n'étaient pas à " fixer" avec hisjacks ? 
je n'ai pris en compte  que la liste dessous votre instruction 
voici le rapport du total scann panda en ligne  : 
;***********************************************************************************************************************************************************************************
ANALYSIS: 2007-11-18 19:46:02
PROTECTIONS: 1
MALWARE: 33
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Windows Live OneCare                         1.0.0                         Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@doubleclick[2].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.doubleclick.net/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@atdmt[3].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.atdmt.com/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@atdmt[2].txt
00139535  Application/Processor              HackTools           No        0         Yes            No           C:\Program Files\Navilog1\Process.exe
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@tradedoubler[3].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@tradedoubler[1].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tradedoubler.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@247realmedia[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@fastclick[1].txt
00145460  Cookie/2o7                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.2o7.net/]
00145460  Cookie/2o7                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@2o7[2].txt
00145460  Cookie/2o7                         TrackingCookie      No        0         Yes            No           C:\Documents and Settings\LocalService\Cookies\system@2o7[1].txt
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.tribalfusion.com/]
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@tribalfusion[2].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@mediaplex[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.mediaplex.com/]
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@mediaplex[3].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@com[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@xiti[2].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           D:\Documents and Settings\JEANNE\Cookies\jeanne@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.xiti.com/]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           D:\Documents and Settings\KINOU\Cookies\kinou@xiti[1].txt
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fe.lea.lycos.fr/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@ad.yieldmanager[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@apmebf[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@serving-sys[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bs.serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.bs.serving-sys.com/]
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bs.serving-sys[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@weborama[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@weborama[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.weborama.fr/]
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.adtech.de/]
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@adtech[1].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@fl01.ct2.comclick[2].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[fl01.ct2.comclick.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@advertising[2].txt
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.advertising.com/]
00169287  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@media.adrevolver[1].txt
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[statse.webtrendslive.com/]
00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@ads.pointroll[1].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@overture[1].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.overture.com/]
00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.questionmarket.com/]
00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.questionmarket.com/]
00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@questionmarket[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bluestreak[3].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@bluestreak[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.bluestreak.com/]
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@adrevolver[1].txt
00238695  Application/Pskill.K               HackTools           No        0         Yes            No           C:\Documents and Settings\ordinateur\Bureau\clean\clean\pskill.exe
00238695  Application/Pskill.K               HackTools           No        0         Yes            No           C:\Documents and Settings\ordinateur\Bureau\clean\clean.zip[clean/pskill.exe]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@smartadserver[3].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Cookies\ordinateur@smartadserver[1].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Documents and Settings\ordinateur\Application Data\Mozilla\Firefox\Profiles	h6ysual.default\cookies.txt[.smartadserver.com/]
00372251  Application/Messengerskinner       HackTools           No        0         Yes            No           D:\Documents and Settings\KINOU\Application Data\MessengerSkinner\Userdata\Install_MessengerSkinner.zip[Msgskinner_setup.exe]
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\WINDOWS\NirCmd.exe
02197130  Trj/Rebooter.J                     Virus/Trojan        No        1         Yes            No           C:\Program Files\Navilog1eboot.exe
02634745  Application/Playmp3z               HackTools           No        0         Yes            No           C:\RECYCLER\S-1-5-21-220523388-1957994488-725345543-1004\Dc50.zip[Setup.exe]
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
les problémes de l'ordi : 
sa lenteur 
le bruit de la tour le ventilo tourne fort et vite et s'arrete que très rarement :
le son est distordu au demarrege et je ne peux pas lire de la musique le son est disgracieux cela vient il une infection , de ma certae son du périfique audio enceintes , 
j ai une question j'ai insta&ller un antivirus sous sa forme d'essai gratuit 
windows line one care 
je recherche un antivirus gratuit ? avez vous un à me conseiller 

merci de votre lecture
respectueuses salutations.

jlpjlp · Answer

slt,

vire ce fichier en allant dans poste de travail puis D .... car messenger skinner est un "virus":

D:\Documents and Settings\KINOU\Application Data\MessengerSkinner\Userdata\Install_MessengerSkinner.zip

_______________________

pour ça : vide tout simplement ta corbeille:

02634745 Application/Playmp3z HackTools No 0 Yes No C:\RECYCLER\S-1-5-21-220523388-1957994488-725345543-1004\Dc50.zip[Setup.exe] 

_______________________

nettoie les cookies avec ccleaner

_______________________

desinstalle windows liveonecare car peu efficace,
installe antivir comme antivirus (mets aussi spywareblaster car tu avais attrapé vundo comme inféction)

_______________________


recolle un rapport hijackthis, et antivir, dis tes problemes


a plus










pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français   ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
AD AWARE + SPYBOT +    si tea timer non active de spybot: WINDOWS DEFENDER 

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf

kinoucharlot · Answer

bonsoir
rapport antivir

AntiVir PersonalEdition Classic
Report file date: lundi 19 novembre 2007 12:10

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: PC-D1D66F86B10E

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 14:27:04
ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 14:27:13
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 17:43:56
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: P:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: lundi 19 novembre 2007 12:10

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'OUTLOOK.EXE' - '1' Module(s) have been scanned
Scan process 'SDTrayApp.exe' - '1' Module(s) have been scanned
Scan process 'msfwsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'SmartUI.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'WCESCOMM.EXE' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'brctrcen.exe' - '1' Module(s) have been scanned
Scan process 'pptd40nt.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'brss01a.exe' - '1' Module(s) have been scanned
Scan process 'brsvc01a.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
45 processes with 45 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!
Boot sector 'P:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '28' files ).

Starting the file scan:

Begin scan in 'C:\' <LEPETIT>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Program Files\Navilog1\navilog1.bat
[DETECTION] Contains suspicious code HEUR/Exploit.HTML
[INFO] The file was moved to '47b79c57.qua'!
C:\Program Files\Panda Security\TotalScan\pskavs.dll
[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738
[INFO] The file was moved to '47ac9c78.qua'!
C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP7\A0000368.bat
[DETECTION] Contains suspicious code HEUR/Exploit.HTML
[INFO] The file was moved to '47719f51.qua'!
C:\System Volume Information\_restore{D8EA6608-8B04-44AB-9275-E49D4CCF07FD}\RP7\A0000369.dll
[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738
[INFO] The file was moved to '47719f58.qua'!
Begin scan in 'D:\'
Begin scan in 'P:\' <IOMEGA_HDD>

End of the scan: lundi 19 novembre 2007 18:21
Used time: 6:10:39 min

The scan has been done completely.

14236 Scanning directories
779069 Files were scanned
2 viruses and/or unwanted programs were found
2 Files were classified as suspicious:
0 files were deleted
0 files were repaired
4 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
779067 Files not concerned
11491 Archives were scanned
10 Warnings
21 Notes

rapport hisjack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:23:35, on 19/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\PROGRA~1\MI1933~1\Office10\OUTLOOK.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.discut.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SmartUI.lnk = C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.discut.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab




__________________________

essaye de refaire clean

Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

· Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean
· Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec
· Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.

http://kerio.probb.fr/tuto-Clean-h37.html
_________________________


si tout c'est bien passé désactive la restauration système pour purger les virus qui seraient dedans (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

redemarre l'ordi

puis réactive là


________________________


recolle hijackthis et dis tes soucis

kinoucharlot · Answer

Bonjour, 
 clean  n'a rien trouvé 
hisjack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:08:20, on 20/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SmartUI.lnk = C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 


R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

___________________

sinon pas grand chose dans ton rapport, il est ok

_________________


verifie la temperature du processeur (peut etre ouvrir l'ordi pour virer la poussiere qui fais que le ventilo a du mal)

https://www.clubic.com/telecharger-fiche11074-speedfan.html




___________________

tu peux mettre spybot pour proteger ton ordi et scanner avec:

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html




a plus











pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français   ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
AD AWARE + SPYBOT +    si tea timer non active de spybot: WINDOWS DEFENDER ou               SPYWARE TERMINATOR

+/-
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf

kinoucharlot · Answer

bonour
Ce matin mon or dinateur a lancer la verification systeme 
ils a restaurés des clausters 
et verifier l espace libre 
cela a dure 2 heures est ce normal 

j ai toujours mes problèmes de son 
j ai installé antivir
kerio comme pare feu


j ai un souci pour installé spyblaster le programme ne peut se connecter sur le site  j ai essayé directement sue le site mais idem
 j ai installé spedd fan mis en français mais j avoue de ne sais pas comment m'en servir  
les infos sont Scanning SMBus at $1000...
Decoding DIMM #0
 Memory type is DDR
 Module Rows : 2
 Levels : 2.5V
 Parity : NO PARITY
 Refresh Rate : 7.8us
 Total Size : 512MB
Decoding DIMM #2
 Memory type is DDR
 Module Rows : 2
 Levels : 2.5V
 Parity : NO PARITY
 Refresh Rate : 7.8us
 Total Size : 512MB

je te colle un rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:58:50, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MI1933~1\Office10\OUTLOOK.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SmartUI.lnk = C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

jlpjlp · Answer

manuel speedfan

https://www.118712.fr/sortir.html



sinon a la place utilise everest home edition

Virus

22 réponses

Discussions similaires

Newsletters