Virus KillAV et Win32.ctx

Tico -  
Bonjour,

hier j'ai détecté le virus KillAV avec Norton et tenté de le détruire. Après 4 reprises il n'a réussi qu'a moitié. J'ai donc téléchargé et installé AVAST puis reparti ma machine en 'safe mode' il a détecté Win32.ctx et il a mis en quarantaine 2 fichiers que j'ai détruit par la suite. Depuis se temps, je reçois toujours le Windows Security Alert au 5 min., je n'ai plus accès à mon panneau de control pour installer ou désinstaller des logiciels. Que faire?

Merci à l'avance...
Configuration: Windows XP
Internet Explorer 7.0

12 réponses

  • Votes
  • Date
  • Date décroissante
  1. Utilisateur anonyme
    Bonsoir

    Télécharge sur le bureau
    [url=http://www.merijn.org/files/hijackthis.zip]hijackthis.zip[/url]
    = Clic-droit sur Hijackthis
    = Extraire ici ( ou extraire sans confirmation ou tout ou unzip)
    = clic droit sur Hijackthis ( en forme de dynamite) ==> renommer ==> écrire : test.exe ( à la place de hijackthis.exe) <== Important
    =Double-clic dessus
    = Clic Do a system scan and save the log
    =coller le rapport
    si problème voir l'aide
    [url=https://forums.cnetfrance.fr]Aide hijackthis[/url]
    1. Tico
      J'ai téléchargé Hijackthis.exe mais je ne suis pas capable de le renommer pour Test.exe.
      1. Tico
        Voilà je viens de réussir le Hijackthis et voici le contenu:

        Logfile of HijackThis v1.99.1
        Scan saved at 13:36:00, on 2007-10-10
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16512)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\System32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\ACS.exe
        C:\WINDOWS\Explorer.exe
        C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
        C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\WINDOWS\System32\DVDRAMSV.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\system32\printer.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
        C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
        C:\Program Files\EzButton\EzButton.EXE
        C:\Program Files\Apoint2K\Apoint.exe
        C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
        C:\WINDOWS\system32\dla\tfswctrl.exe
        C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
        C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Apoint2K\Apntex.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\MétéoMédia\MétéoIMédia\WeatherEye.exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
        C:\WINDOWS\system32\RAMASST.exe
        C:\Program Files\Skype\Plugin Manager\skypePM.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
        C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
        C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
        C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
        C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
        C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
        C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
        C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
        C:\Documents and Settings\Sylvain\Local Settings\Temporary Internet Files\Content.IE5\F7GMBA6F\hijackthis[1]\Test.exe.exe

        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
        O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
        O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE
        O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
        O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
        O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
        O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
        O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600"
        O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB002" /M "Stylus CX4800"
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
        O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
        O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
        O4 - HKCU\..\Run: [MétéoIMédia] C:\Program Files\MétéoMédia\MétéoIMédia\WeatherEye
        O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
        O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
        O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
        O4 - Startup: system.exe
        O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
        O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: autorun.exe
        O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
        O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by119fd.bay119.hotmail.msn.com/resources/MsnPUpld.cab
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
        O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
        O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
        O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
        O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
        O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
        O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
        O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
        O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
        O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
        1. Utilisateur anonyme
          Télécharge sur le bureau

          [url=http://siri.urz.free.fr/Fix/SmitfraudFix.zip]SmitfraudFix.zip[/url]

          => Double clic sur SmitfraudFix.zip
          => Extraire tout
          => Double clic sur SmitfraudFix
          => Double Clic sur SmitfraudFix.cmd
          => Choisir Option 1
          => Sauver le rapport
          2. Tico
            Merci jusqu'à maintenant!

            Voilà le rapport de SmitFraudfix:

            SmitFraudFix v2.240

            Scan done at 14:09:19,76, 2007-10-10
            Run from C:\Documents and Settings\Sylvain\Local Settings\Temporary Internet

            Files\Content.IE5\WHD3O1OG\SmitfraudFix[1]\SmitfraudFix
            OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
            The filesystem type is NTFS
            Fix run in normal mode

            »»»»»»»»»»»»»»»»»»»»»»»» Process

            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\System32\Ati2evxx.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\System32\ACS.exe
            C:\WINDOWS\Explorer.exe
            C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
            C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
            C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
            C:\WINDOWS\System32\DVDRAMSV.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\system32\printer.exe
            C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
            C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
            C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
            C:\Program Files\EzButton\EzButton.EXE
            C:\Program Files\Apoint2K\Apoint.exe
            C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
            C:\WINDOWS\system32\dla\tfswctrl.exe
            C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
            C:\Program Files\ltmoh\Ltmoh.exe
            C:\WINDOWS\AGRSMMSG.exe
            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
            C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
            C:\Program Files\Common Files\Symantec Shared\ccApp.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Apoint2K\Apntex.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\Program Files\MétéoMédia\MétéoIMédia\WeatherEye.exe
            C:\Program Files\Skype\Phone\Skype.exe
            C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
            C:\WINDOWS\system32\RAMASST.exe
            C:\Program Files\Skype\Plugin Manager\skypePM.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
            C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Documents and Settings\Sylvain\Local Settings\Temporary Internet

            Files\Content.IE5\F7GMBA6F\hijackthis[1]\Test.exe.exe
            C:\WINDOWS\system32\NOTEPAD.EXE
            C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
            C:\WINDOWS\system32\cmd.exe
            C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
            C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
            C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
            C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
            C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
            C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

            »»»»»»»»»»»»»»»»»»»»»»»» hosts

            hosts file corrupted !

            192.168.200.3 download.microsoft.com
            192.168.200.3 downloads.microsoft.com
            192.168.200.3 go.microsoft.com
            192.168.200.3 microsoft.com
            192.168.200.3 msdn.microsoft.com
            192.168.200.3 office.microsoft.com
            192.168.200.3 support.microsoft.com
            192.168.200.3 windowsupdate.microsoft.com
            192.168.200.3 www.microsoft.com
            192.168.200.3 pandasoftware.com
            192.168.200.3 www.pandasoftware.com

            »»»»»»»»»»»»»»»»»»»»»»»» C:\

            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

            C:\WINDOWS\system32\printer.exe FOUND !

            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

            »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sylvain

            »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sylvain\Application Data

            »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

            C:\DOCUME~1\Sylvain\STARTM~1\Programs\Startup\system.exe FOUND !
            C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\autorun.exe FOUND !

            »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Sylvain\FAVORI~1

            »»»»»»»»»»»»»»»»»»»»»»»» Desktop

            »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

            »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

            »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
            "Source"="About:Home"
            "SubscribedURL"="About:Home"
            "FriendlyName"="My Current Home Page"

            »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
            !!!Attention, following keys are not inevitably infected!!!

            SrchSTS.exe by S!Ri
            Search SharedTaskScheduler's .dll

            »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
            !!!Attention, following keys are not inevitably infected!!!

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
            "AppInit_DLLs"="C:\\WINDOWS\\system32\\sulimo.dat"

            »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
            !!!Attention, following keys are not inevitably infected!!!

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
            "System"=""

            »»»»»»»»»»»»»»»»»»»»»»»» Rustock

            »»»»»»»»»»»»»»»»»»»»»»»» DNS

            Description: Atheros AR5004G Wireless Network Adapter - Packet Scheduler Miniport
            DNS Server Search Order: 200.122.136.99
            DNS Server Search Order: 200.122.136.97
            DNS Server Search Order: 196.40.15.200

            HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A95DC09-FDE3-4216-896D-6EE8234465D2}: DhcpNameServer=200.122.136.99

            200.122.136.97 196.40.15.200
            HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A95DC09-FDE3-4216-896D-6EE8234465D2}: DhcpNameServer=200.122.136.99

            200.122.136.97 196.40.15.200
            HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200
            HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200

            »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

            »»»»»»»»»»»»»»»»»»»»»»»» End
            2. Tico
              J'ai choici l'option 2 de SmitFraudfix et qu'arrive-t-il par la suite?

              Le PC a travaillé un peu puis le fichier SmitFraudfix a disparu de son répertoire. Comment savoir si le travail a été fait?
              1. Utilisateur anonyme
                une fois SmitFraudfix 2 fini tu doit avoir un rapport
                tu fait un copier coler
                1. Tico
                  J'ai dû retélécharger Smitfraudfix pour le réexécuter. J'ai choisi l'option 2. Il a fait le travail et produit ce rapport:

                  SmitFraudFix v2.240

                  Scan done at 15:37:07,37, 2007-10-10
                  Run from C:\Documents and Settings\Sylvain\Local Settings\Temporary Internet Files\Content.IE5\WIKKLPPM\SmitfraudFix[1]\SmitfraudFix
                  OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
                  The filesystem type is NTFS
                  Fix run in normal mode

                  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
                  !!!Attention, following keys are not inevitably infected!!!

                  SrchSTS.exe by S!Ri
                  Search SharedTaskScheduler's .dll

                  »»»»»»»»»»»»»»»»»»»»»»»» Killing process

                  »»»»»»»»»»»»»»»»»»»»»»»» hosts

                  192.168.200.3 ad.doubleclick.net
                  192.168.200.3 ad.fastclick.net
                  192.168.200.3 ads.fastclick.net
                  192.168.200.3 ar.atwola.com
                  192.168.200.3 atdmt.com
                  192.168.200.3 avp.ch
                  192.168.200.3 avp.com
                  192.168.200.3 avp.ru
                  192.168.200.3 awaps.net
                  192.168.200.3 banner.fastclick.net
                  192.168.200.3 banners.fastclick.net
                  192.168.200.3 ca.com
                  192.168.200.3 click.atdmt.com
                  192.168.200.3 clicks.atdmt.com
                  192.168.200.3 customer.symantec.com
                  192.168.200.3 dispatch.mcafee.com
                  192.168.200.3 download.mcafee.com
                  192.168.200.3 downloads-us1.kaspersky-labs.com
                  192.168.200.3 downloads-us2.kaspersky-labs.com
                  192.168.200.3 downloads-us3.kaspersky-labs.com
                  192.168.200.3 downloads1.kaspersky-labs.com
                  192.168.200.3 downloads2.kaspersky-labs.com
                  192.168.200.3 downloads3.kaspersky-labs.com
                  192.168.200.3 downloads4.kaspersky-labs.com
                  192.168.200.3 engine.awaps.net
                  192.168.200.3 f-secure.com
                  192.168.200.3 fastclick.net
                  192.168.200.3 ftp.avp.ch
                  192.168.200.3 ftp.downloads1.kaspersky-labs.com
                  192.168.200.3 ftp.downloads2.kaspersky-labs.com
                  192.168.200.3 ftp.downloads3.kaspersky-labs.com
                  192.168.200.3 ftp.f-secure.com
                  192.168.200.3 ftp.kasperskylab.ru
                  192.168.200.3 ftp.sophos.com
                  192.168.200.3 ids.kaspersky-labs.com
                  192.168.200.3 kaspersky-labs.com
                  192.168.200.3 kaspersky.com
                  192.168.200.3 liveupdate.symantec.com
                  192.168.200.3 liveupdate.symantecliveupdate.com
                  192.168.200.3 mast.mcafee.com
                  192.168.200.3 mcafee.com
                  192.168.200.3 media.fastclick.net
                  192.168.200.3 my-etrust.com
                  192.168.200.3 nai.com
                  192.168.200.3 networkassociates.com
                  192.168.200.3 norton.com
                  192.168.200.3 phx.corporate-ir.net
                  192.168.200.3 rads.mcafee.com
                  192.168.200.3 secure.nai.com
                  192.168.200.3 securityresponse.symantec.com
                  192.168.200.3 service1.symantec.com
                  192.168.200.3 sophos.com
                  192.168.200.3 spd.atdmt.com
                  192.168.200.3 symantec.com
                  192.168.200.3 trendmicro.com
                  192.168.200.3 update.symantec.com
                  192.168.200.3 updates.symantec.com
                  192.168.200.3 updates1.kaspersky-labs.com
                  192.168.200.3 updates2.kaspersky-labs.com
                  192.168.200.3 updates3.kaspersky-labs.com
                  192.168.200.3 updates4.kaspersky-labs.com
                  192.168.200.3 updates5.kaspersky-labs.com
                  192.168.200.3 us.mcafee.com
                  192.168.200.3 vil.nai.com
                  192.168.200.3 viruslist.com
                  192.168.200.3 viruslist.ru
                  192.168.200.3 virusscan.jotti.org
                  192.168.200.3 virustotal.com
                  192.168.200.3 www.avp.ch
                  192.168.200.3 www.avp.com
                  192.168.200.3 www.avp.ru
                  192.168.200.3 www.awaps.net
                  192.168.200.3 www.ca.com
                  192.168.200.3 www.f-secure.com
                  192.168.200.3 www.fastclick.net
                  192.168.200.3 www.grisoft.com
                  192.168.200.3 www.kaspersky-labs.com
                  192.168.200.3 www.kaspersky.com
                  192.168.200.3 www.kaspersky.ru
                  192.168.200.3 www.mcafee.com
                  192.168.200.3 www.my-etrust.com
                  192.168.200.3 www.nai.com
                  192.168.200.3 www.networkassociates.com
                  192.168.200.3 www.sophos.com
                  192.168.200.3 www.symantec.com
                  192.168.200.3 www.symantec.com
                  192.168.200.3 www.trendmicro.com
                  192.168.200.3 www.viruslist.com
                  192.168.200.3 www.viruslist.ru
                  192.168.200.3 www.virustotal.com
                  192.168.200.3 www3.ca.com

                  »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

                  S!Ri's WS2Fix: LSP not Found.

                  »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                  GenericRenosFix by S!Ri

                  »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

                  C:\WINDOWS\system32\printer.exe Deleted
                  C:\DOCUME~1\Sylvain\STARTM~1\Programs\Startup\system.exe Deleted
                  C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\autorun.exe Deleted

                  »»»»»»»»»»»»»»»»»»»»»»»» DNS

                  Description: Atheros AR5004G Wireless Network Adapter - Packet Scheduler Miniport
                  DNS Server Search Order: 200.122.136.99
                  DNS Server Search Order: 200.122.136.97
                  DNS Server Search Order: 196.40.15.200

                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A95DC09-FDE3-4216-896D-6EE8234465D2}: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200
                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A95DC09-FDE3-4216-896D-6EE8234465D2}: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200
                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200
                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200

                  »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

                  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                  !!!Attention, following keys are not inevitably infected!!!

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                  "System"=""

                  »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

                  Registry Cleaning done.

                  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
                  !!!Attention, following keys are not inevitably infected!!!

                  SrchSTS.exe by S!Ri
                  Search SharedTaskScheduler's .dll

                  »»»»»»»»»»»»»»»»»»»»»»»» End
                  1. Tico
                    Je suis de retour et j'ai envoyé le contenu du rapport suite à l'exécution de Smitfraudfix.
                    J'attends de nouvelles instructions
                    Merci!
                    1. Tico
                      J'ai besoin d'aide pour terminer le travail s.v.p. Je n'ose pas repartir mon PC avant d'avoir l'opinion d'un expert suite à l'exécution de Smitfraudfix dont voici la copie du rapport:

                      SmitFraudFix v2.240

                      Scan done at 15:37:07,37, 2007-10-10
                      Run from C:\Documents and Settings\Sylvain\Local Settings\Temporary Internet Files\Content.IE5\WIKKLPPM\SmitfraudFix[1]\SmitfraudFix
                      OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
                      The filesystem type is NTFS
                      Fix run in normal mode

                      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
                      !!!Attention, following keys are not inevitably infected!!!

                      SrchSTS.exe by S!Ri
                      Search SharedTaskScheduler's .dll

                      »»»»»»»»»»»»»»»»»»»»»»»» Killing process

                      »»»»»»»»»»»»»»»»»»»»»»»» hosts

                      192.168.200.3 ad.doubleclick.net
                      192.168.200.3 ad.fastclick.net
                      192.168.200.3 ads.fastclick.net
                      192.168.200.3 ar.atwola.com
                      192.168.200.3 atdmt.com
                      192.168.200.3 avp.ch
                      192.168.200.3 avp.com
                      192.168.200.3 avp.ru
                      192.168.200.3 awaps.net
                      192.168.200.3 banner.fastclick.net
                      192.168.200.3 banners.fastclick.net
                      192.168.200.3 ca.com
                      192.168.200.3 click.atdmt.com
                      192.168.200.3 clicks.atdmt.com
                      192.168.200.3 customer.symantec.com
                      192.168.200.3 dispatch.mcafee.com
                      192.168.200.3 download.mcafee.com
                      192.168.200.3 downloads-us1.kaspersky-labs.com
                      192.168.200.3 downloads-us2.kaspersky-labs.com
                      192.168.200.3 downloads-us3.kaspersky-labs.com
                      192.168.200.3 downloads1.kaspersky-labs.com
                      192.168.200.3 downloads2.kaspersky-labs.com
                      192.168.200.3 downloads3.kaspersky-labs.com
                      192.168.200.3 downloads4.kaspersky-labs.com
                      192.168.200.3 engine.awaps.net
                      192.168.200.3 f-secure.com
                      192.168.200.3 fastclick.net
                      192.168.200.3 ftp.avp.ch
                      192.168.200.3 ftp.downloads1.kaspersky-labs.com
                      192.168.200.3 ftp.downloads2.kaspersky-labs.com
                      192.168.200.3 ftp.downloads3.kaspersky-labs.com
                      192.168.200.3 ftp.f-secure.com
                      192.168.200.3 ftp.kasperskylab.ru
                      192.168.200.3 ftp.sophos.com
                      192.168.200.3 ids.kaspersky-labs.com
                      192.168.200.3 kaspersky-labs.com
                      192.168.200.3 kaspersky.com
                      192.168.200.3 liveupdate.symantec.com
                      192.168.200.3 liveupdate.symantecliveupdate.com
                      192.168.200.3 mast.mcafee.com
                      192.168.200.3 mcafee.com
                      192.168.200.3 media.fastclick.net
                      192.168.200.3 my-etrust.com
                      192.168.200.3 nai.com
                      192.168.200.3 networkassociates.com
                      192.168.200.3 norton.com
                      192.168.200.3 phx.corporate-ir.net
                      192.168.200.3 rads.mcafee.com
                      192.168.200.3 secure.nai.com
                      192.168.200.3 securityresponse.symantec.com
                      192.168.200.3 service1.symantec.com
                      192.168.200.3 sophos.com
                      192.168.200.3 spd.atdmt.com
                      192.168.200.3 symantec.com
                      192.168.200.3 trendmicro.com
                      192.168.200.3 update.symantec.com
                      192.168.200.3 updates.symantec.com
                      192.168.200.3 updates1.kaspersky-labs.com
                      192.168.200.3 updates2.kaspersky-labs.com
                      192.168.200.3 updates3.kaspersky-labs.com
                      192.168.200.3 updates4.kaspersky-labs.com
                      192.168.200.3 updates5.kaspersky-labs.com
                      192.168.200.3 us.mcafee.com
                      192.168.200.3 vil.nai.com
                      192.168.200.3 viruslist.com
                      192.168.200.3 viruslist.ru
                      192.168.200.3 virusscan.jotti.org
                      192.168.200.3 virustotal.com
                      192.168.200.3 www.avp.ch
                      192.168.200.3 www.avp.com
                      192.168.200.3 www.avp.ru
                      192.168.200.3 www.awaps.net
                      192.168.200.3 www.ca.com
                      192.168.200.3 www.f-secure.com
                      192.168.200.3 www.fastclick.net
                      192.168.200.3 www.grisoft.com
                      192.168.200.3 www.kaspersky-labs.com
                      192.168.200.3 www.kaspersky.com
                      192.168.200.3 www.kaspersky.ru
                      192.168.200.3 www.mcafee.com
                      192.168.200.3 www.my-etrust.com
                      192.168.200.3 www.nai.com
                      192.168.200.3 www.networkassociates.com
                      192.168.200.3 www.sophos.com
                      192.168.200.3 www.symantec.com
                      192.168.200.3 www.symantec.com
                      192.168.200.3 www.trendmicro.com
                      192.168.200.3 www.viruslist.com
                      192.168.200.3 www.viruslist.ru
                      192.168.200.3 www.virustotal.com
                      192.168.200.3 www3.ca.com

                      »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

                      S!Ri's WS2Fix: LSP not Found.

                      »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                      GenericRenosFix by S!Ri

                      »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

                      C:\WINDOWS\system32\printer.exe Deleted
                      C:\DOCUME~1\Sylvain\STARTM~1\Programs\Startup\system.exe Deleted
                      C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\autorun.exe Deleted

                      »»»»»»»»»»»»»»»»»»»»»»»» DNS

                      Description: Atheros AR5004G Wireless Network Adapter - Packet Scheduler Miniport
                      DNS Server Search Order: 200.122.136.99
                      DNS Server Search Order: 200.122.136.97
                      DNS Server Search Order: 196.40.15.200

                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A95DC09-FDE3-4216-896D-6EE8234465D2}: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200
                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A95DC09-FDE3-4216-896D-6EE8234465D2}: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200
                      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200
                      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=200.122.136.99 200.122.136.97 196.40.15.200

                      »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

                      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                      !!!Attention, following keys are not inevitably infected!!!

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                      "System"=""

                      »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

                      Registry Cleaning done.

                      »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
                      !!!Attention, following keys are not inevitably infected!!!

                      SrchSTS.exe by S!Ri
                      Search SharedTaskScheduler's .dll

                      »»»»»»»»»»»»»»»»»»»»»»»» End
                      1. Utilisateur anonyme
                        Bonsoir
                        déjà un peu de ménage de fait

                        maintenent
                        faire ceci
                        Télécharger sur le bureau : [url=http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe]navilog.exe[/url]

                        = Double-Clic navilog1.zip
                        = Extraire tout ( ou extraire sans confirmation ou unzip)
                        = Double-Clic navilog1 qui est sur le bureau
                        = Appuyer sur une touche jusqu' arriver aux options
                        = Choisir option 1 ( = taper 1 )
                        ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes

                        le rapport se trouve dans c: fixnavi.txt

                        tu postes ce rapport.

                        ---------------------
                        2°) Télecharger [url=http://www.malekal.com/download/clean.zip]clean.zip[/url] sur le bureau
                        Dézipper sur le bureau.
                        = ouvrir le dossier clean
                        = cliquer sur le symbole roue dentée avec le nom clean
                        = choisir l'option 1 et laisser clean travailler jusqu'à l'apparition du texte "appuyer sur une touche pour continuer"
                        = ensuite colle le rapport

                        Discussions similaires

                        Problème avec "PUADIManager:Win32/OfferCore
                        Knaki

                        3 réponses
                        Softonic,est-ce un virus ?
                        techmel1

                        6 réponses
                        Chrome://newtab
                        Nova

                        14 réponses
                        Désinstaller Softonic
                        Diguimette

                        5 réponses
                        PUADlManager:Win32/OfferCore
                        tenmalade

                        2 réponses