Adware-gen, au secours

sarah -  
Bonjour,

j'ai un problème avec win32:adware-gen (avast me signale aussi win32:agent-LTS et win32:tranjan-gen)
j'ai utilisé bitdefender et hijackthis, voici les rapports, pouvez-vous m'aider à me débarasser de ces horreurs?? merci d'avance

BitDefender Online Scanner

Scan report generated at: Thu, Oct 25, 2007 - 22:01:39

Scan path: C:\;D:\;

hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:47, on 25/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Aspire Arcade\PCMService.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\NOKIAP~1\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlknq.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: The nssfrch - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - C:\WINDOWS\nssfrch.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Aspire Arcade\PCMService.exe"
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\NOKIAP~1\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sarazukilesphotos.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://sarazukilesphotos.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O21 - SSODL: bxsbang - {45CF1E8B-CC31-4026-92F3-DFB45CD68F9D} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {A33F163F-5089-4974-81E7-E370EE621631} - C:\WINDOWS\ocgrep.dll (file missing)
O21 - SSODL: msmhost - {F24123B5-1CBF-43D6-8463-E42B759BA156} - C:\WINDOWS\msmhost.dll
O21 - SSODL: msmdev - {33F50FFD-1148-43F9-BDF6-4F4EAE4529CF} - C:\WINDOWS\msmdev.dll (file missing)
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 9038 bytes

Statistics

Time
01:03:46

Files
209964

Folders
4766

Boot Sectors
2

Archives
4724

Packed Files
7259

Results

Identified Viruses
14

Infected Files
22

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
20

Engines Info

Virus Definitions
858068

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
14

Archive plugins
38

Unpack plugins
7

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>BnnnnBaa.class
Infected with: Java.Trojan.Exploit.Bytverify

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>BnnnnBaa.class
Disinfection failed

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>BnnnnBaa.class
Deleted

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6
Updated

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>VaannnaaBaa.class
Infected with: Trojan.Java.Classloader.E

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>VaannnaaBaa.class
Disinfection failed

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>VaannnaaBaa.class
Deleted

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6
Updated

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>Dnnny.class
Infected with: Java.Trojan.Exploit.Bytverify

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>Dnnny.class
Disinfection failed

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6=>Dnnny.class
Deleted

C:\Documents and Settings\sarahzuki\Application Data\Sun\Java\Deployment\cache\6.0\32\7836d960-70c19cf6
Updated

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp=>archstored:ac8zt2/edi.exe
Infected with: Trojan.Agent.BHO.N

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp=>archstored:ac8zt2/edi.exe
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp=>archstored:ac8zt2/edi.exe
Deleted

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp
Update failed

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp=>archstored:ac8zt2/install.bat
Infected with: Trojan.Agent.BHO.N

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp=>archstored:ac8zt2/install.bat
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp=>archstored:ac8zt2/install.bat
Deleted

C:\Documents and Settings\sarahzuki\Local Settings\Temp\BIT34D.tmp
Update failed

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\07N9YVH6\soft_m[1].js
Infected with: Trojan.Clicker.AC

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\07N9YVH6\soft_m[1].js
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\07N9YVH6\soft_m[1].js
Deleted

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\52S1A7JS\functions.js[1].php
Detected with: Application.JS.ForcePopup.I

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\52S1A7JS\functions.js[1].php
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\52S1A7JS\functions.js[1].php
Deleted

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\52S1A7JS\VideoAccessCodecInstall[1].exe
Infected with: Dropped:Trojan.Downloader.Zlob.AAWH

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\52S1A7JS\VideoAccessCodecInstall[1].exe
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\52S1A7JS\VideoAccessCodecInstall[1].exe
Deleted

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\G1H99S06\functions.js[1].php
Detected with: Application.JS.ForcePopup.I

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\G1H99S06\functions.js[1].php
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\G1H99S06\functions.js[1].php
Deleted

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\N6P2QICM\count[1].htm=>(JAVASCRIPT 1)
Infected with: Exploit.ADODB.Stream.FN

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\N6P2QICM\count[1].htm=>(JAVASCRIPT 1)
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\N6P2QICM\count[1].htm=>(JAVASCRIPT 1)
Deleted

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\N6P2QICM\count[1].htm
Updated

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\Z2GB13LM\setup[1].exe
Infected with: Dropped:Trojan.Downloader.Zlob.AATT

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\Z2GB13LM\setup[1].exe
Disinfection failed

C:\Documents and Settings\sarahzuki\Local Settings\Temporary Internet Files\Content.IE5\Z2GB13LM\setup[1].exe
Deleted

C:\Program Files\antivirus test\PC Security Test 2006\files\spyware.txt
Detected with: Application.VTesttool.A

C:\Program Files\antivirus test\PC Security Test 2006\files\spyware.txt
Deleted

C:\Program Files\antivirus test\PC Security Test 2006\files\virus1.txt
Detected with: Application.VTesttool.B

C:\Program Files\antivirus test\PC Security Test 2006\files\virus1.txt
Deleted

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)=>(Instyler Module 2)
Detected with: Application.VTesttool.A

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)=>(Instyler Module 2)
Deleted

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)
Update failed

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)=>(Instyler Module 3)
Detected with: Application.VTesttool.B

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)=>(Instyler Module 3)
Deleted

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)
Update failed

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)=>(Instyler Module 4)
Detected with: Application.VTesttool.C

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)=>(Instyler Module 4)
Deleted

C:\Program Files\antivirus test\setup.zip=>setup.exe=>(Instyler o)
Update failed

C:\Program Files\VideoAccessCodec\Uninstall.exe
Infected with: Dropped:Trojan.Downloader.Zlob.AAWH

C:\Program Files\VideoAccessCodec\Uninstall.exe
Disinfection failed

C:\Program Files\VideoAccessCodec\Uninstall.exe
Deleted

C:\Program Files\VideoAccessCodec\VideoAccessCodec.ocx
Infected with: Trojan.Downloader.Zlob.AAWI

C:\Program Files\VideoAccessCodec\VideoAccessCodec.ocx
Disinfection failed

C:\Program Files\VideoAccessCodec\VideoAccessCodec.ocx
Deleted

C:\System Volume Information\_restore{838E2B31-B6DD-42FA-BD2C-9E555D3D58A4}\RP258\A0060241.exe
Infected with: Dropped:Trojan.Downloader.Zlob.AAWH

C:\System Volume Information\_restore{838E2B31-B6DD-42FA-BD2C-9E555D3D58A4}\RP258\A0060241.exe
Disinfection failed

C:\System Volume Information\_restore{838E2B31-B6DD-42FA-BD2C-9E555D3D58A4}\RP258\A0060241.exe
Deleted

C:\System Volume Information\_restore{838E2B31-B6DD-42FA-BD2C-9E555D3D58A4}\RP258\A0060242.ocx
Infected with: Trojan.Downloader.Zlob.AAWI

C:\System Volume Information\_restore{838E2B31-B6DD-42FA-BD2C-9E555D3D58A4}\RP258\A0060242.ocx
Disinfection failed

C:\System Volume Information\_restore{838E2B31-B6DD-42FA-BD2C-9E555D3D58A4}\RP258\A0060242.ocx
Deleted

C:\WINDOWS\movctrlknq.dll
Detected with: Adware.NetAdware.S

C:\WINDOWS\movctrlknq.dll
Disinfection failed

C:\WINDOWS\movctrlknq.dll
Delete failed

C:\WINDOWS\msmhost.dll
Infected with: Trojan.Agent.BHO.O

C:\WINDOWS\msmhost.dll
Disinfection failed

C:\WINDOWS\msmhost.dll
Delete failed
Configuration: Windows XP
Internet Explorer 7.0

9 réponses

  1. liguec1
    salut fais ca et post le rapport stp
    télécharge GenProc de Jean-Chretien1 et Narco4 sur ton bureau
    http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip

    lance genproc.bat et mes le rapport qui t'aura ouvert sur ce forum, fais ensuite exactement tous ce qu'il te demande
    0
    1. sarah
      voici le rapport smitfraud:

      SmitFraudFix v2.242

      Rapport fait à 18:51:26,71, 26/10/2007
      Executé à partir de C:\Documents and Settings\sarahzuki\Bureau\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      Le type du système de fichiers est NTFS
      Fix executé en mode normal

      »»»»»»»»»»»»»»»»»»»»»»»» Process

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\PROGRA~1\LAUNCH~1\LManager.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\Acer\eManager\anbmServ.exe
      C:\Program Files\Aspire Arcade\PCMService.exe
      C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
      C:\PROGRA~1\NOKIAP~1\NOKIAP~1\TRAYAP~1.EXE
      C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\Program Files\SuperCopier2\SuperCopier2.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\MSN Messenger\usnsvc.exe
      C:\WINDOWS\explorer.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\WINDOWS\system32\cmd.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      »»»»»»»»»»»»»»»»»»»»»»»» hosts

      »»»»»»»»»»»»»»»»»»»»»»»» C:\

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

      C:\WINDOWS\bxsbang.dll PRESENT !
      C:\WINDOWS\kthemup.exe PRESENT !
      C:\WINDOWS\msmhost.dll PRESENT !
      C:\WINDOWS\nssfrch.dll PRESENT !
      C:\WINDOWS\privacy_danger PRESENT !

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\sarahzuki

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\sarahzuki\Application Data

      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SARAHZ~1\Favoris

      »»»»»»»»»»»»»»»»»»»»»»»» Bureau

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

      C:\Program Files\VideoAccessCodec\ PRESENT !

      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
      "Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
      "SubscribedURL"=""
      "FriendlyName"="Privacy Protection"

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
      "Source"="About:Home"
      "SubscribedURL"="About:Home"
      "FriendlyName"="Ma page d'accueil"

      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLs"=""

      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "System"=""

      »»»»»»»»»»»»»»»»»»»»»»»» Rustock

      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Description: acer IPN2220 Wireless LAN Card - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 212.27.54.252
      DNS Server Search Order: 212.27.53.252

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{B50BBDF4-7C51-4778-A7DC-E265A0B47B68}: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{B50BBDF4-7C51-4778-A7DC-E265A0B47B68}: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS2\Services\Tcpip\..\{B50BBDF4-7C51-4778-A7DC-E265A0B47B68}: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252

      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

      »»»»»»»»»»»»»»»»»»»»»»»» Fin
      0
      1. sarah
        et nouveau rapport hijackthis

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 19:11:26, on 26/10/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16544)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\spoolsv.exe
        C:\Acer\eManager\anbmServ.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\PROGRA~1\LAUNCH~1\LManager.exe
        C:\WINDOWS\SOUNDMAN.EXE
        C:\Program Files\Aspire Arcade\PCMService.exe
        C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
        C:\PROGRA~1\NOKIAP~1\NOKIAP~1\TRAYAP~1.EXE
        C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\SuperCopier2\SuperCopier2.exe
        C:\Program Files\adobe\Reader 8.0\Reader\reader_sl.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
        C:\WINDOWS\System32\alg.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
        C:\Program Files\MSN Messenger\usnsvc.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
        C:\WINDOWS\system32\wbem\wmiprvse.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
        O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlknq.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
        O3 - Toolbar: The nssfrch - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - C:\WINDOWS\nssfrch.dll (file missing)
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
        O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
        O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Aspire Arcade\PCMService.exe"
        O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
        O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\NOKIAP~1\NOKIAP~1\TRAYAP~1.EXE
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\adobe\Reader 8.0\Reader\reader_sl.exe
        O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\adobe\Reader 8.0\Reader\AdobeCollabSync.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sarazukilesphotos.spaces.live.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
        O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://sarazukilesphotos.spaces.live.com/PhotoUpload/MsnPUpld.cab
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
        O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
        0
        1. liguec1
          est ce que c'est genproc qui ta dis de telecharger smitfraudfix.
          relance ce logiciel en mode sans echec et lance nettiyage au lieu de recherche
          0
          2. sarah
            et le dernier rapport smitfraud
            je suis débarrassée vous croyez? j'ai toujours internet explorer qui ferme a cause de modules complémentaires!

            SmitFraudFix v2.242

            Rapport fait à 19:00:55,39, 26/10/2007
            Executé à partir de C:\Documents and Settings\sarahzuki\Mes documents\antivirus\SmitfraudFix
            OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
            Le type du système de fichiers est NTFS
            Fix executé en mode sans echec

            »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

            SrchSTS.exe by S!Ri
            Search SharedTaskScheduler's .dll

            »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

            »»»»»»»»»»»»»»»»»»»»»»»» hosts

            127.0.0.1 localhost

            »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

            S!Ri's WS2Fix: LSP not Found.

            »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

            GenericRenosFix by S!Ri

            »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

            C:\WINDOWS\bxsbang.dll supprimé
            Deleting [HKEY_CLASSES_ROOT\CLSID\{45CF1E8B-CC31-4026-92F3-DFB45CD68F9D}]
            Deleting [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{45CF1E8B-CC31-4026-92F3-DFB45CD68F9D}]
            C:\WINDOWS\kthemup.exe supprimé
            C:\WINDOWS\msmhost.dll supprimé
            Deleting [HKEY_CLASSES_ROOT\CLSID\{8BC1A29A-2BE0-4AD8-96A9-B0AC9CB57E7C}]
            C:\WINDOWS\nssfrch.dll supprimé
            C:\WINDOWS\privacy_danger\ supprimé
            C:\Program Files\VideoAccessCodec\ supprimé

            »»»»»»»»»»»»»»»»»»»»»»»» DNS

            HKLM\SYSTEM\CCS\Services\Tcpip\..\{B50BBDF4-7C51-4778-A7DC-E265A0B47B68}: DhcpNameServer=212.27.54.252 212.27.53.252
            HKLM\SYSTEM\CS1\Services\Tcpip\..\{B50BBDF4-7C51-4778-A7DC-E265A0B47B68}: DhcpNameServer=212.27.54.252 212.27.53.252
            HKLM\SYSTEM\CS2\Services\Tcpip\..\{B50BBDF4-7C51-4778-A7DC-E265A0B47B68}: DhcpNameServer=212.27.54.252 212.27.53.252
            HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
            HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
            HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252

            »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

            »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
            "System"=""

            »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

            Nettoyage terminé.

            »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

            SrchSTS.exe by S!Ri
            Search SharedTaskScheduler's .dll

            »»»»»»»»»»»»»»»»»»»»»»»» Fin
            0
            1. liguec1
              il a deja pas mal nettoyé remets un rapport hijackthis stp?
              et peut tu rep a ma question du message 4
              0
              1. sarah
                oui c'était genproc qui m'a dit de faire ça! voilà le rapport hijackthis
                merci

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 16:09:58, on 27/10/2007
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\csrss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\Ati2evxx.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\system32\spoolsv.exe
                C:\Acer\eManager\anbmServ.exe
                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                C:\WINDOWS\AGRSMMSG.exe
                C:\Program Files\ltmoh\Ltmoh.exe
                C:\PROGRA~1\LAUNCH~1\LManager.exe
                C:\WINDOWS\SOUNDMAN.EXE
                C:\Program Files\Aspire Arcade\PCMService.exe
                C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
                C:\PROGRA~1\NOKIAP~1\NOKIAP~1\TRAYAP~1.EXE
                C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
                C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\MSN Messenger\MsnMsgr.Exe
                C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                C:\Program Files\SuperCopier2\SuperCopier2.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                C:\WINDOWS\system32\svchost.exe
                C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                C:\WINDOWS\System32\alg.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                C:\Program Files\MSN Messenger\usnsvc.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                C:\WINDOWS\system32\wbem\wmiprvse.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlknq.dll
                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                O3 - Toolbar: The nssfrch - {61AB8A39-FCCB-47CC-BAF3-750D1834E773} - C:\WINDOWS\nssfrch.dll (file missing)
                O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
                O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
                O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Aspire Arcade\PCMService.exe"
                O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
                O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\NOKIAP~1\NOKIAP~1\TRAYAP~1.EXE
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\adobe\Reader 8.0\Reader\reader_sl.exe
                O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\adobe\Reader 8.0\Reader\AdobeCollabSync.exe
                O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sarazukilesphotos.spaces.live.com//PhotoUpload/MsnPUpld.cab
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://sarazukilesphotos.spaces.live.com/PhotoUpload/MsnPUpld.cab
                O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
                O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                0
                1. sarah
                  et si y'a un truc qui reste et qui existait pas avant, j'ai une barre sous la google toolbar avec ça d'écrit dessus:
                  Warning: possible spyware or adware infection! Click here to scan your computer for spyware and adware...
                  ça n'existait pas avant alors je me demande si y'a pas encore un 'ti truc qui coince
                  merci encore, ça va déjà beaucoup mieux là!
                  0
                  1. liguec1
                    salut désolé de te repondre que maintenant

                    ok : relance hijackthis et tu coche ces lignes ( regarde ici c'est parfaitement expliqué en images
                    http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm )

                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    0

                    Discussions similaires

                    Win64 malware gen
                    jules555

                    1 réponse
                    Win64:Malware-gen
                    ptb35

                    3 réponses
                    Que fait le virus LPI Win32 Pup-Gen
                    Tristan Chrome

                    2 réponses
                    adware.pokki
                    SuperFun

                    9 réponses
                    win32:malware-gen bloqué par avast
                    ikkual

                    69 réponses