Plein de Trj et des "messages suspects"

Bonsoir,

il va falloir etre un peu plus precise dans tes descriptions...
tu as fait un scan antivirus ? ou autre chose ? c'est la quarantaine de quel logiciel ?

les alertes de message suspect de ton antivirus ?
ta boite mail ? sur outlook ou un autre logiciel de messagerie ?

télécharge : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
Utilisation :

* L'installer dans un dossier prévu à cet effet.
o Par exemple, C:\HijackThis
o Choisis l'option "do a system scan and save a logfile"; un rapport va être généré…

colles ce rapport ici.

Bonjour, merci de m'aider.

C'est la quarantaine de Avast.

Par contre comme j'ai dit, je ne sais absolument pas sur quelle boite arrive les messages suspects, ils ne sont ds aucune de mes boites person hotmail ou gmail et je n'utilise pas outlook avc cet ordi. Apparement certains ont deja eu ce proleme (http://www.commentcamarche.net/forum/affich 3147260 virus qui envoie des e mails).

Voila mon Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:45:44, on 01/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\hgzh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Hewlett-Packard\HP Pavilion Webcam\tsnp2std.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Configure Plug n Play Devices] plugnplay.exe
O4 - HKLM\..\Run: [zclnr] C:\WINDOWS\system32\zclnr.exe
O4 - HKLM\..\Run: [dvlq] C:\WINDOWS\system32\dvlq.exe
O4 - HKLM\..\Run: [jiqug] C:\WINDOWS\system32\jiqug.exe
O4 - HKLM\..\Run: [ursrjmgoc] C:\WINDOWS\system32\ursrjmgoc.exe
O4 - HKLM\..\Run: [hgzh] C:\WINDOWS\system32\hgzh.exe
O4 - HKLM\..\Run: [xflkmymhtpf] C:\WINDOWS\system32\xflkmymhtpf.exe
O4 - HKLM\..\RunServices: [zclnr] C:\WINDOWS\system32\zclnr.exe
O4 - HKLM\..\RunServices: [dvlq] C:\WINDOWS\system32\dvlq.exe
O4 - HKLM\..\RunServices: [jiqug] C:\WINDOWS\system32\jiqug.exe
O4 - HKLM\..\RunServices: [ursrjmgoc] C:\WINDOWS\system32\ursrjmgoc.exe
O4 - HKLM\..\RunServices: [hgzh] C:\WINDOWS\system32\hgzh.exe
O4 - HKLM\..\RunServices: [xflkmymhtpf] C:\WINDOWS\system32\xflkmymhtpf.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Pavilion Webcam Tray Icon.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2d824e341e2a438b9f73c323949e9ac9
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2d824e341e2a438b9f73c323949e9ac9
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Print Spooler Service (yoiln4avsjkdxu) - Unknown owner - C:\WINDOWS\system32\jiqug.exe

Bonsoir,

fais un scan en ligne avec bitdefendeur, www.bitdefender.com/scan8/ie.html
postes le rapport

installes-toi un parefeu : http://www.commentcamarche.net/faq/sujet 3486 s curit le parefeu de windows xp
et ne laisses pas sortir des programmes que tu ne connais pas.

Bonjour, voila mon rapport BitDefender....

Qu'est ce que ca donne, si Clownface n'est ps là quelqu'un peut-il me dire ce que je dois faire maintenant ??

Merci de votre aide.

BitDefender Online Scanner

Scan report generated at: Fri, Nov 02, 2007 - 16:46:26
Scan path: C:\;D:\;E:\;

Statistics

Time
01:08:16

Files
387027

Folders
5822

Boot Sectors
4

Archives
9279

Packed Files
22947

Results

Identified Viruses
8

Infected Files
24

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
24

Engines Info

Virus Definitions
859990

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
14

Archive plugins
38

Unpack plugins
7

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>BnnnnBaa.class
Infected with: Java.Trojan.Exploit.Bytverify

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>BnnnnBaa.class
Disinfection failed

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>BnnnnBaa.class
Deleted

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip
Updated

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>VaannnaaBaa.class
Infected with: Trojan.Java.Classloader.E

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>VaannnaaBaa.class
Disinfection failed

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>VaannnaaBaa.class
Deleted

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip
Updated

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>Dnnny.class
Infected with: Java.Trojan.Exploit.Bytverify

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>Dnnny.class
Disinfection failed

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip=>Dnnny.class
Deleted

C:\Documents and Settings\utilisateur\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ehp2_stdneh.jar-42e05065-6b11e822.zip
Updated

C:\Documents and Settings\utilisateur\Local Settings\Temp\picture_0013e.JPEG.zip=>picture_0013e.JPEG-SecuredBy-MSN.scr
Infected with: Trojan.Dropper.IRC.TKB

C:\Documents and Settings\utilisateur\Local Settings\Temp\picture_0013e.JPEG.zip=>picture_0013e.JPEG-SecuredBy-MSN.scr
Disinfection failed

C:\Documents and Settings\utilisateur\Local Settings\Temp\picture_0013e.JPEG.zip=>picture_0013e.JPEG-SecuredBy-MSN.scr
Deleted

C:\Documents and Settings\utilisateur\Local Settings\Temp\picture_0013e.JPEG.zip
Updated

C:\Documents and Settings\utilisateur\Mes documents\Mes images\picture_0013e.JPEG.zip=>picture_0013e.JPEG-SecuredBy-MSN.scr
Infected with: Trojan.Dropper.IRC.TKB

C:\Documents and Settings\utilisateur\Mes documents\Mes images\picture_0013e.JPEG.zip=>picture_0013e.JPEG-SecuredBy-MSN.scr
Disinfection failed

C:\Documents and Settings\utilisateur\Mes documents\Mes images\picture_0013e.JPEG.zip=>picture_0013e.JPEG-SecuredBy-MSN.scr
Deleted

C:\Documents and Settings\utilisateur\Mes documents\Mes images\picture_0013e.JPEG.zip
Updated

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Bayahibe - saona\bayahibe mag martine lety moi\AUTORUN.INF
Infected with: Trojan.Bat.Autoruns.AS

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Bayahibe - saona\bayahibe mag martine lety moi\AUTORUN.INF
Disinfection failed

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Bayahibe - saona\bayahibe mag martine lety moi\AUTORUN.INF
Deleted

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Jarabacoa- anniv anibal\Jarabacoa 001.INF
Infected with: Trojan.Bat.Autoruns.AS

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Jarabacoa- anniv anibal\Jarabacoa 001.INF
Disinfection failed

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Jarabacoa- anniv anibal\Jarabacoa 001.INF
Deleted

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Ville Coloniale\AUTORUN.INF
Infected with: Trojan.Bat.Autoruns.AS

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Ville Coloniale\AUTORUN.INF
Disinfection failed

C:\Documents and Settings\utilisateur\Mes documents\Mes images\REP DOM\Ville Coloniale\AUTORUN.INF
Deleted

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\79K0QCKL\front[1].exe
Infected with: Trojan.Dropper.IRC.TKB

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\79K0QCKL\front[1].exe
Disinfection failed

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\79K0QCKL\front[1].exe
Deleted

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\YCOU9WSQ\movie3[1].htm
Infected with: Trojan.Downloader.HTML.Zlob.E

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\YCOU9WSQ\movie3[1].htm
Disinfection failed

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\YCOU9WSQ\movie3[1].htm
Deleted

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\YCOU9WSQ\setup[1].exe
Infected with: Trojan.Downloader.Zlob.AAVW

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\YCOU9WSQ\setup[1].exe
Disinfection failed

C:\Documents and Settings\utilisateur\Temporary Internet Files\Content.IE5\YCOU9WSQ\setup[1].exe
Deleted

C:\Foto_celular.scr
Infected with: Backdoor.Celofot.D

C:\Foto_celular.scr
Disinfection failed

C:\Foto_celular.scr
Deleted

C:\Foto_celular.zip=>Foto_celular.scr
Infected with: Backdoor.Celofot.D

C:\Foto_celular.zip=>Foto_celular.scr
Disinfection failed

C:\Foto_celular.zip=>Foto_celular.scr
Deleted

C:\Foto_celular.zip
Updated

C:\QooBox\Quarantine\C\AutoRun.inf.vir
Infected with: Trojan.Bat.Autoruns.AS

C:\QooBox\Quarantine\C\AutoRun.inf.vir
Disinfection failed

C:\QooBox\Quarantine\C\AutoRun.inf.vir
Deleted

C:\QooBox\Quarantine\D\Autorun.inf.vir
Infected with: Trojan.Bat.Autoruns.AS

C:\QooBox\Quarantine\D\Autorun.inf.vir
Disinfection failed

C:\QooBox\Quarantine\D\Autorun.inf.vir
Deleted

C:\RECYCLER\S-1-5-21-1712868559-1358053709-2836717384-1006\Dc290.exe
Infected with: Trojan.Generic.60162

C:\RECYCLER\S-1-5-21-1712868559-1358053709-2836717384-1006\Dc290.exe
Disinfection failed

C:\RECYCLER\S-1-5-21-1712868559-1358053709-2836717384-1006\Dc290.exe
Deleted

C:\RECYCLER\S-1-5-21-1712868559-1358053709-2836717384-1006\Dc339.INF
Infected with: Trojan.Bat.Autoruns.AS

C:\RECYCLER\S-1-5-21-1712868559-1358053709-2836717384-1006\Dc339.INF
Disinfection failed

C:\RECYCLER\S-1-5-21-1712868559-1358053709-2836717384-1006\Dc339.INF
Deleted

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP1\A0001123.exe
Infected with: Backdoor.Celofot.D

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP1\A0001123.exe
Disinfection failed

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP1\A0001123.exe
Deleted

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP1\A0001124.exe
Infected with: Backdoor.Celofot.D

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP1\A0001124.exe
Disinfection failed

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP1\A0001124.exe
Deleted

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP10\A0002849.INF
Infected with: Trojan.Bat.Autoruns.AS

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP10\A0002849.INF
Disinfection failed

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP10\A0002849.INF
Deleted

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007579.scr
Infected with: Backdoor.Celofot.D

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007579.scr
Disinfection failed

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007579.scr
Deleted

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007582.exe
Infected with: Trojan.Generic.60162

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007582.exe
Disinfection failed

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007582.exe
Deleted

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007583.INF
Infected with: Trojan.Bat.Autoruns.AS

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007583.INF
Disinfection failed

C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP33\A0007583.INF
Deleted

C:\WINDOWS\system32\plugnplay.exe
Infected with: Trojan.Dropper.IRC.TKB

C:\WINDOWS\system32\plugnplay.exe
Disinfection failed

C:\WINDOWS\system32\plugnplay.exe
Deleted

Bonsoir,

Télécharge ceci : http://www.commentcamarche.net/telecharger/telecharger 230 smitfraudfix
tuto : https://www.zebulon.fr/dossiers/tutoriaux/66-smitfraudfix.html

fais l'option 1 et postes le rapport.

Bonjour, voici mon rapport /

SmitFraudFix v2.200

Rapport fait à 14:30:46,98, 15/11/2007
Executé à partir de C:\Documents and Settings\utilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ursrjmgoc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Pavilion Webcam\tsnp2std.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\utilisateur

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\utilisateur\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\UTILIS~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~2\\GOEC62~1.DLL"
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom 802.11b/g WLAN - Miniport d'ordonnancement de paquets
DNS Server Search Order: 200.42.213.11
DNS Server Search Order: 200.42.213.21

HKLM\SYSTEM\CCS\Services\Tcpip\..\{44BAED19-A15F-4CDF-A6D5-45FF0B860AC3}: DhcpNameServer=200.42.213.11 200.42.213.21
HKLM\SYSTEM\CS1\Services\Tcpip\..\{44BAED19-A15F-4CDF-A6D5-45FF0B860AC3}: DhcpNameServer=200.42.213.11 200.42.213.21
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=200.42.213.11 200.42.213.21
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=200.42.213.11 200.42.213.21

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

J'attends l'étape suivante, merci de votre aide

Bonsoir,

relances smitfraudfix et choisis l'option 5 (sauf si tu connais ce dns : 200.42.213.11 - 200.42.213.21 (suite à recherche sur google personne n'a ça en france...)
postes le rapport

tu vas aussi aller dans ajout/suppression de programme et tu vas désinstaller java 1.5.0_09 qui n'est plus à jour, vulnérable,
et infecté a priori...