Bonjour, Ca y est, j'ai craqué, je viens de passé à firefox suite à une nouvelle merdouille. J'aimerais nettoyer mon ordi maintenant que ce grand pas est fait. Là, j'ai un message qui m'explique que ça va être la catastrophe si je fait pas comme il dit, mais j'ai pas vraiment confiance! Voici mon log Hijack en étant désolé de vous déranger encore une fois mais j'espere qu'avec firefox, je vais être moins chiant (du reste, qu'est ce qu'il faut que je fasse pour sécuriser mon tout nouveau navigateur?) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:08, on 12/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe c:\windows\system32\svchost.exe C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe C:\WINDOWS\system32\proper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\proper.exe O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing) O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe O4 - Startup: infos.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: autos.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php O17 - HKLM\System\CCS\Services\Tcpip\..\{D894A65F-B0D4-4D59-B754-6DE215946685}: NameServer = 80.10.246.130 81.253.149.10 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

slt, smit fraud fix (colle le rapport) 1/ telecharger : http://siri.urz.free.fr/Fix/SmitfraudFix.php 2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes. une fois le rapport effectué redémarre en mode sans échec (en appuyant sur F8 ou suppr, ou F5 au démarrage en général)

voici le rapport smitF: SmitFraudFix v2.252 Rapport fait à 19:30:31,39, 12/11/2007 Executé à partir de C:\Documents and Settings\supertomate\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est FAT32 Fix executé en mode normal »»»»»»»»»»»»»»»»»»»»»»»» Process »»»»»»»»»»»»»»»»»»»»»»»» hosts Fichier hosts corrompu ! 192.168.200.3 download.microsoft.com 192.168.200.3 downloads.microsoft.com 192.168.200.3 go.microsoft.com 192.168.200.3 microsoft.com 192.168.200.3 msdn.microsoft.com 192.168.200.3 office.microsoft.com 192.168.200.3 support.microsoft.com 192.168.200.3 windowsupdate.microsoft.com 192.168.200.3 www.microsoft.com 192.168.200.3 pandasoftware.com 192.168.200.3 www.pandasoftware.com »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\proper.exe PRESENT ! C:\WINDOWS\system32\winter.exe PRESENT ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\supertomate »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\supertomate\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer »»»»»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»»»»»»» Bureau »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "LoadAppInit_DLLs"=dword:00000001 »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll »»»»»»»»»»»»»»»»»»»»»»»» Fin euh, j'ai pas compris pourquoi je devais redémarrez en MSE? merci à toi

il faut faire en mode sans echec car certains virus se chargent au demarrage de l'ordi , ce qui est évité en demarrant en mode sans echec et facilite la tache pour virer les virus avec smitfraud fix refaire comme en 2/ mais sélectionne l'option 2 et appuyer sur entrée pour commencer la désinfection. lorsque le programme demande si tu veut nettoyer le registre mets oui en tapant 0 et entrée ____________ scan avec des antiespions (en mode sans échec): spybot : (si vous avez une version instalée avant sept 2007 changer là par la version 1.5) https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html voir demo d utilisation (merci Balltrap) http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm ______________________ combofix (colle le rapport) http://download.bleepingcomputer.com/sUBs/ComboFix.exe _______________________ colle le rapport d'un scan en ligne avec un des suivants: bitdefender en ligne : http://www.bitdefender.fr/scan_fr/scan8/ie.html Panda en ligne : http://pandasoftware.fr secuser en ligne : http://www.secuser.com/outils/antivirus.htm _________________________ recolle un rapport hijackthis en le renommant et dis tes pbs

combofix ComboFix 07-11-08.1 - dams 2007-11-12 19:53:23.1 - [color=red][b]FAT32[/b][/color]x86 MINIMAL Running from: C:\Documents and Settings\dams\Bureau\désinfection\ComboFix.exe . Incapable d'obtenir les privilèges Système (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\autos.exe C:\Documents and Settings\dams\Menu Démarrer\Programmes\Démarrage\infos.exe C:\WINDOWS\system32\drivers\asc3550p.sys C:\WINDOWS\system32\kr_done1 C:\WINDOWS\system32\proper.exe C:\WINDOWS\system32\winter.exe C:\WINDOWS\system32\netap.dll . . . . Echec de suppression . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_ASC3550P -------\LEGACY_SYMAVC32 -------\asc3550p -------\symavc32 ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-12 to 2007-11-12 )))))))))))))))))))))))))))))))))))) . 2007-11-12 19:30 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-12 19:30 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-12 18:53 0 --a------ C:\WINDOWS\nsreg.dat 2007-11-12 18:49 5,837,392 --a------ C:\Program Files\Firefox Setup 2.0.0.9.exe 2007-11-12 18:23 11,392 --a------ C:\WINDOWS\system32\drivers\sfloppy.sys 2007-11-12 18:23 11,392 --a------ C:\WINDOWS\system32\dllcache\sfloppy.sys 2007-11-12 18:21 34,688 --a------ C:\WINDOWS\system32\drivers\lbrtfdc.sys 2007-11-12 18:21 34,688 --a------ C:\WINDOWS\system32\dllcache\lbrtfdc.sys 2007-11-12 18:21 30,336 --a------ C:\WINDOWS\system32\drivers\modem.sys 2007-11-12 18:21 30,336 --a------ C:\WINDOWS\system32\dllcache\modem.sys 2007-11-12 18:21 8,192 --a------ C:\WINDOWS\system32\drivers\i2omgmt.sys 2007-11-12 18:21 8,192 --a------ C:\WINDOWS\system32\dllcache\i2omgmt.sys 2007-11-12 18:20 93,184 --a------ C:\WINDOWS\system32\netap.dll 2007-11-12 18:20 18,688 C:\WINDOWS\system32\drivers\hrfgkuai.dat 2007-11-12 18:20 8,192 --a------ C:\WINDOWS\system32\drivers\Changer.sys 2007-11-12 18:20 8,192 --a------ C:\WINDOWS\system32\dllcache\changer.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-06 11:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 11:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-05-23 20:38:44 109 --sha-w C:\WINDOWS\system32\475610251.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0069B26D-8D52-4AD8-9E31-A72F1AC65D7F}] 2001-08-24 12:00 93184 --a------ C:\WINDOWS\system32\netap.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Device Detector"="C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" [2003-09-17 17:39] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] R0 taguwsac;taguwsac;C:\WINDOWS\system32\drivers\hrfgkuai.dat . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-11-12 18:57:10 C:\WINDOWS\Tasks\rczmhc.job" - c:\windows\system32\ctfahhou.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-12 19:57:37 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-12 19:58:08 - machine was rebooted . --- E O F --- smithfraud fix: SmitFraudFix v2.252 Rapport fait à 20:01:33,15, 12/11/2007 Executé à partir de C:\Documents and Settings\dams\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est FAT32 Fix executé en mode normal »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 80.10.246.130 DNS Server Search Order: 81.253.149.10 HKLM\SYSTEM\CCS\Services\Tcpip\..\{D894A65F-B0D4-4D59-B754-6DE215946685}: NameServer=80.10.246.130 81.253.149.10 HKLM\SYSTEM\CS1\Services\Tcpip\..\{D894A65F-B0D4-4D59-B754-6DE215946685}: NameServer=80.10.246.130 81.253.149.10 »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Fin j'ai pas pu installer spybot, il m'a dit pendant l'install un truc genre "nom d'utilisateur a disparu" (désolé une mauvaise manip m'a fait sauter la phrase) après le scan en ligne, je lui dit de netoyer ou j'envoie juste le rapport? bon, j'suis à la bourre, faut qu'j'y aille, a plus

tu colle le rapport et tu desinfecté avec le scan en ligne bitdefender en ligne : http://www.bitdefender.fr/scan_fr/scan8/ie.html Panda en ligne : http://pandasoftware.fr secuser en ligne : http://www.secuser.com/outils/antivirus.htm _________________________ recolle un rapport hijackthis en le renommant et dis tes pbs

Mes problèmes: par rapport à hier, je n'ai plus d'alertes de la part d'avast. Par contre, j'ai microsoft qui s'incruste (changement de ma page d'accueil, de ma barre d'outil avec des icones dont j'ai rien à foutre). De plus, il m'arrive un truc bizarre aujourd'hui: sur le forum de commentçamarche, je n'arrive pas à ouvrir une page autre que celle mis en mémoire dans mes favoris. Pour te répondre, je dois passer par firefox, ça bloque avec explorer (mais pas de problèmes avec d'autres sites...) panda (en fait j'ai pas désinfecté car pour le faire, il faut s'inscrire et je sais pas ce que ça implique): ;*********************************************************************************************************************************************************************************** ANALYSIS: 2007-11-13 13:48:35 PROTECTIONS: 1 MALWARE: 64 SUSPECTS: 1 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== avast! antivirus 4.7.1043 [VPS 071111-1] 4.7.1043 Yes Yes ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00064632 Dialer.ABR Dialers No 0 Yes No C:\WINDOWS\Downloaded Program Files\STARTBF2.INF 00132710 dialer.xd Dialers No 0 Yes No c:\windows\switchagreement.txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@casalemedia[2].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@doubleclick[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@atdmt[2].txt 00139535 Application/Processor HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\SmitfraudFix\Process.exe 00139535 Application/Processor HackTools No 0 Yes No C:\SDFix\APPS\Process.exe 00139535 Application/Processor HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\SmitfraudFix\Process.exe 00139535 Application/Processor HackTools No 0 Yes No C:\WINDOWS\SYSTEM32\Process.exe 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@tradedoubler[1].txt 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@tradedoubler[2].txt 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@247realmedia[1].txt 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@247realmedia[2].txt 00145460 Cookie/2o7 TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@2o7[1].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@mediaplex[1].txt 00145792 Cookie/SexList TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@sexlist[2].txt 00145869 Cookie/SpyLog TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@spylog[1].txt 00146967 Cookie/PayCounter TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@paycounter[2].txt 00147814 Cookie/AspinallsOnlineCasino TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@pacificpoker[2].txt 00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@ccbill[1].txt 00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@findwhat[1].txt 00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@yadro[2].txt 00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@yadro[1].txt 00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@xiti[1].txt 00167706 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter3.sextracker[1].txt 00167706 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter3.sextracker[3].txt 00167709 Cookie/fe.lea.lycos TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@fe.lea.lycos[1].txt 00167724 Cookie/HotLog TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@hotlog[2].txt 00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@toplist[1].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@statcounter[2].txt 00167759 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter9.sextracker[2].txt 00167761 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter8.sextracker[1].txt 00167762 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter13.sextracker[1].txt 00167763 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter1.sextracker[1].txt 00167764 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter7.sextracker[2].txt 00167765 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@hg1.hitbox[1].txt 00167770 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter15.sextracker[1].txt 00167783 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter6.sextracker[2].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@ad.yieldmanager[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@ad.yieldmanager[2].txt 00168058 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter4.sextracker[2].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@apmebf[2].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@serving-sys[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@serving-sys[2].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@bs.serving-sys[2].txt 00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@weborama[3].txt 00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@weborama[2].txt 00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@adtech[2].txt 00168116 Cookie/Comclick TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@fl01.ct2.comclick[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@advertising[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@advertising[3].txt 00169286 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@sextracker[2].txt 00169286 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@sextracker[3].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@adrevolver[3].txt 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@statse.webtrendslive[2].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@overture[1].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@zedo[2].txt 00172449 Cookie/MetriWeb TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@metriweb[1].txt 00176499 Cookie/Maxifiles TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@www.maxifiles[2].txt 00180153 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter2.sextracker[2].txt 00180153 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter2.sextracker[3].txt 00180154 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter16.sextracker[2].txt 00180246 Cookie/XXXCounter TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@xxxcounter[3].txt 00180246 Cookie/XXXCounter TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@xxxcounter[1].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@adrevolver[1].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@adultfriendfinder[1].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@adultfriendfinder[2].txt 00206953 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter14.sextracker[1].txt 00207936 Cookie/Adviva TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@adviva[1].txt 00251542 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter5.sextracker[1].txt 00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@smartadserver[1].txt 00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@smartadserver[2].txt 00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@ads.addynamix[2].txt 00517584 Application/SuperFast HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\SmitfraudFix\RESTART.EXE 00517584 Application/SuperFast HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\SmitfraudFix\RESTART.EXE 00549914 Dialer.KGW Dialers Yes 1 Yes No C:\WINDOWS\TEMP\ZZPEAA.EXE 01262593 Application/NirCmd.A HackTools No 0 Yes No C:\WINDOWS\NIRCMD.EXE 01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\ComboFix.exe[nircmd.exe] 01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\ComboFix.exe[nircmd.cfexe] 01299526 Adware/LinkOptimizer Adware No 0 Yes No C:\WINDOWS\SYSTEM32\CTFAHHOU.EXE 02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\SmitfraudFix\Reboot.exe 02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\Documents and Settings\supertomate\Bureau\SmitfraudFix\Reboot.exe 02261869 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\supertomate\Cookies\supertomate@counter12.sextracker[1].txt 02702186 Adware/SecurityError Adware No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\All Users\Menu DÃ©marrer\Programmes\DÃ©marrage\autos.exe.vir 02702186 Adware/SecurityError Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\winter.exe.vir 02702186 Adware/SecurityError Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\proper.exe.vir 02702186 Adware/SecurityError Adware No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\supertomate\Menu DÃ©marrer\Programmes\DÃ©marrage\infos.exe.vir ;=================================================================================================================================================================================== SUSPECTS Location ;=================================================================================================================================================================================== C:\WINDOWS\SYSTEM32\NETAP.DLL ;=================================================================================================================================================================================== hijackthis (j'ai pas pigé ce que je devais renommer?): Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:00, on 13/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe c:\windows\system32\services.exe C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\TEMP\zzpeaa.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [zzpeaa.exe] C:\WINDOWS\TEMP\zzpeaa.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan O17 - HKLM\System\CCS\Services\Tcpip\..\{D894A65F-B0D4-4D59-B754-6DE215946685}: NameServer = 80.10.246.1 80.10.246.132 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

vire tout ce qui est dans le fichier quarantine en allant dans poste de travail puis C puis qoobox C:\QooBox\Quarantine ______________________ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [zzpeaa.exe] C:\WINDOWS\TEMP\zzpeaa.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll ___________________________ télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau. double-clique sur OTMoveIt.exe pour le lancer. copie la liste qui se trouve en citation ci-dessous, et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. Citation : C:\WINDOWS\system32\netap.dll C:\WINDOWS\Downloaded Program Files\STARTBF2.INF c:\windows\switchagreement.txt C:\WINDOWS\TEMP\ZZPEAA.EXE C:\WINDOWS\SYSTEM32\CTFAHHOU.EXE clique sur MoveIt! pour lancer la suppression. le résultat apparaitra dans le cadre "Results". clique sur Exit pour fermer. poste le rapport situé dans C:\_OTMoveIt\MovedFiles. il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. ___________________________ utilise pour supprimer tes traces CCLEANER: (lance un nettoyage et répare 3 fois les erreurs) sans installer la barre yahoo https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html _______________________________ scan avec spybot : (si vous avez une version instalée avant sept 2007 changer là par la version 1.5) https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html voir demo d utilisation (merci Balltrap) http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm ____________________________ AVG antispyware https://www.01net.com/telecharger/ Tuto : http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html ->Relance AVG AS -> "Analyse" ->"Paramètres" Sous la question "Comment réagir ?" : -> clique sur "Actions recommandées" et choisis "Quarantaines" -> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" Si un fichier est infecté en fin d'analyse ->Clique sur "Appliquer toutes les actions " ->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous". ->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici ________________________ colle un scan en ligne, un rapport hijackthi et dis tes pbs

Il semblerait que je n'ai plus de problèmes! top cool! Bon, je me méfies encore, des fois tout va bien et ça revient le lendemain. Mais enfin, tout a l'air d'aller vraiment bien! Merci beaucoup, c'est trop classe. M'enfin si tu veux quand même jeter un coup d'oeil sur tous ces hiéroglyphes pour vérifier... OTmoveit DllUnregisterServer procedure not found in C:\WINDOWS\system32\netap.dll C:\WINDOWS\system32\netap.dll NOT unregistered. File move failed. C:\WINDOWS\system32\netap.dll scheduled to be moved on reboot. C:\WINDOWS\Downloaded Program Files\STARTBF2.INF moved successfully. c:\windows\switchagreement.txt moved successfully. C:\WINDOWS\TEMP\ZZPEAA.EXE moved successfully. File move failed. C:\WINDOWS\SYSTEM32\CTFAHHOU.EXE scheduled to be moved on reboot. Created on 11/13/2007 14:25:38 spybot: --- Search result list --- Smitfraud-C.: [SBI $1167C539] Réglages (Valeur du registre, fixed) HKEY_USERS\S-1-5-21-1004336348-1972579041-839522115-1003\WindowsSubVersion BraveSentry: [SBI $67214887] Réglages (Valeur du registre, fixed) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 --- Spybot - Search & Destroy version: 1.5 (build: 20070830) --- 2007-11-13 unins000.exe (51.46.0.0) 2007-08-31 blindman.exe (1.0.0.6) 2007-08-31 SDMain.exe (1.0.0.4) 2007-08-31 SDUpdate.exe (1.0.6.4) 2007-08-31 SDWinSec.exe (1.0.0.8) 2007-08-31 SpybotSD.exe (1.5.1.15) 2007-08-31 TeaTimer.exe (1.5.0.9) 2007-08-31 Update.exe (1.4.0.5) 2007-08-31 advcheck.dll (1.5.3.0) 2007-04-02 aports.dll (2.1.0.0) 2007-04-02 DelZip179.dll (1.79.5.3) 2007-08-31 SDHelper.dll (1.5.0.8) 2007-08-31 Tools.dll (2.1.2.0) 2007-11-07 Includes\Revision.sbi (*) 2007-11-07 Includes\Cookies.sbi (*) 2007-10-31 Includes\Dialer.sbi (*) 2007-11-07 Includes\Hijackers.sbi (*) 2007-10-04 Includes\Keyloggers.sbi (*) 2004-11-29 Includes\LSP.sbi (*) 2007-11-07 Includes\Malware.sbi (*) 2007-10-24 Includes\PUPS.sbi (*) 2007-05-30 Includes\Security.sbi (*) 2007-11-07 Includes\Spybots.sbi (*) 2007-11-06 Includes\Tracks.uti 2007-11-07 Includes\Trojans.sbi (*) 2007-11-07 Includes\DialerC.sbi (*) 2007-11-07 Includes\HijackersC.sbi (*) 2007-11-07 Includes\KeyloggersC.sbi (*) 2007-11-07 Includes\MalwareC.sbi (*) 2007-11-07 Includes\PUPSC.sbi (*) 2007-11-07 Includes\SecurityC.sbi (*) 2007-11-07 Includes\SpybotsC.sbi (*) 2007-11-07 Includes\TrojansC.sbi (*) 2008-12-24 Plugins\TCPIPAddress.dll --- System information --- Windows XP (Build: 2600) Service Pack 2 (5.1.2600) --- Startup entries list --- Located: HK_LM:Run, avast! command: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe file: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe size: 79224 MD5: 8CF58586AE4577ED71FFE8883A6D4B3B Located: HK_LM:Run, Device Detector command: "C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" -autorun file: C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe size: 212992 MD5: 1F47361DEBEAE7811E786DFF6998CB6A Located: HK_LM:Run, SunJavaUpdateSched command: "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" file: C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe size: 83608 MD5: 9C1C80BBF8E6044980890E2D2D91091C Located: HK_LM:Run, zzpeaa.exe command: C:\WINDOWS\TEMP\zzpeaa.exe file: size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: Démarrage (tous utilisateurs), DSLMON.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe file: C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe size: 962661 MD5: 4364B5C4F31241660D30D2C9980F877E Located: Démarrage (tous utilisateurs), Lancement rapide d'Adobe Reader.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe file: C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe size: 29696 MD5: DEB88AEF013DD1EEFB462D7CAD642166 Located: Démarrage (tous utilisateurs), Microsoft Office.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\Microsoft Office\Office10\OSA.EXE file: C:\Program Files\Microsoft Office\Office10\OSA.EXE size: 83360 MD5: 5BC65464354A9FD3BEAA28E18839734A Located: WinLogon, crypt32chain command: crypt32.dll file: crypt32.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, cryptnet command: cryptnet.dll file: cryptnet.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, cscdll command: cscdll.dll file: cscdll.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, ScCertProp command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, Schedule command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, sclgntfy command: sclgntfy.dll file: sclgntfy.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, SensLogn command: WlNotify.dll file: WlNotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, termsrv command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, wlballoon command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! --- Browser helper object list --- {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} () location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Path: C:\WINDOWS\system32\ Long name: netap.dll Short name: Date (created): 12/11/2007 18:20:18 Date (last access): 13/11/2007 Date (last write): 24/08/2001 12:00:00 Filesize: 93184 Attributes: archive MD5: F1A933E968912B77893AD305C5AB661A CRC32: CAF93675 {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: AcroIEHlprObj Class description: Adobe Acrobat reader classification: Legitimate known filename: AcroIEhelper.ocx<br>AcroIEhelper.dll info link: https://get2.adobe.com/reader/otherversions/ info source: TonyKlein Path: C:\Program Files\Adobe\Acrobat 7.0\ActiveX\ Long name: AcroIEHelper.dll Short name: ACROIE~1.DLL Date (created): 14/12/2004 01:56:50 Date (last access): 13/11/2007 Date (last write): 14/12/2004 01:56:50 Filesize: 63136 Attributes: archive MD5: 42729C3DE75A7A51FC6F9EF6546C9199 CRC32: 4D60BD07 Version: 7.0.0.1333 {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Spybot-S&D IE Protection description: Spybot-S&D IE Browser plugin classification: Legitimate known filename: SDhelper.dll info link: http://spybot.eon.net.au/ info source: Patrick M. Kolla Path: C:\PROGRA~1\SPYBOT~1\ Long name: SDHelper.dll Short name: SDHELPER.DLL Date (created): 13/11/2007 14:49:10 Date (last access): 13/11/2007 Date (last write): 31/08/2007 16:46:14 Filesize: 1122128 Attributes: archive MD5: B8958471DAA4481E93B03DF8F991DD6E CRC32: 35E35F14 Version: 1.5.0.8 {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: SSVHelper Class Path: C:\Program Files\Java\jre1.6.0_01\bin\ Long name: ssv.dll Short name: Date (created): 03/05/2007 01:23:24 Date (last access): 13/11/2007 Date (last write): 14/03/2007 03:43:40 Filesize: 501400 Attributes: archive MD5: 70FD57D6EDBED8D80C1995257C99D27E CRC32: 3CE654AC Version: 6.0.10.6 --- ActiveX list --- {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) DPF name: CLSID name: TotalScan Installer Class Installer: C:\WINDOWS\Downloaded Program Files\ascstubie.inf Codebase: https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan Path: C:\WINDOWS\Downloaded Program Files\ Long name: ascstubie.dll Short name: ASCSTU~1.DLL Date (created): 21/08/2007 14:37:26 Date (last access): 13/11/2007 Date (last write): 21/08/2007 14:37:26 Filesize: 124208 Attributes: archive MD5: 0AD87599756B34C0214AFCE961E78DD5 CRC32: EA254381 Version: 1.0.0.7 {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) DPF name: Java Runtime Environment 1.6.0 CLSID name: Java Plug-in 1.6.0_01 Installer: C:\WINDOWS\Downloaded Program Files\jinstall-6u1.inf Codebase: http://java.sun.com/update/1.6.0/jinstall-6u1-windows-i586-jc.cab description: Sun Java classification: Legitimate known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll info link: info source: Patrick M. Kolla Path: C:\Program Files\Java\jre1.6.0_01\bin\ Long name: npjpi160_01.dll Short name: NPJPI1~1.DLL Date (created): 14/03/2007 02:04:46 Date (last access): 13/11/2007 Date (last write): 14/03/2007 03:43:42 Filesize: 132760 Attributes: archive MD5: F112FB2FD2EF66D439799E3F834DF000 CRC32: D2B09219 Version: 6.0.0.6 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () DPF name: CLSID name: Installer: C:\WINDOWS\Downloaded Program Files\erma.inf Codebase: http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0) DPF name: Java Runtime Environment 1.6.0 CLSID name: Java Plug-in 1.6.0_01 Installer: Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab Path: C:\Program Files\Java\jre1.6.0_01\bin\ Long name: npjpi160_01.dll Short name: NPJPI1~1.DLL Date (created): 14/03/2007 02:04:46 Date (last access): 13/11/2007 Date (last write): 14/03/2007 03:43:42 Filesize: 132760 Attributes: archive MD5: F112FB2FD2EF66D439799E3F834DF000 CRC32: D2B09219 Version: 6.0.0.6 {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0) DPF name: Java Runtime Environment 1.6.0 CLSID name: Java Plug-in 1.6.0_01 Installer: Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab Path: C:\Program Files\Java\jre1.6.0_01\bin\ Long name: npjpi160_01.dll Short name: NPJPI1~1.DLL Date (created): 14/03/2007 02:04:46 Date (last access): 13/11/2007 Date (last write): 14/03/2007 03:43:42 Filesize: 132760 Attributes: archive MD5: F112FB2FD2EF66D439799E3F834DF000 CRC32: D2B09219 Version: 6.0.0.6 --- Process list --- PID: 0 ( 0) [System] PID: 536 ( 0) \SystemRoot\System32\smss.exe size: 50688 PID: 616 ( 0) \??\C:\WINDOWS\system32\csrss.exe size: 6144 PID: 640 ( 0) \??\C:\WINDOWS\system32\winlogon.exe size: 506368 PID: 684 ( 0) C:\WINDOWS\system32\services.exe size: 108544 MD5: 732E0B1ABAACE15D80EC19056B0A2AF9 PID: 696 ( 0) C:\WINDOWS\system32\lsass.exe size: 13312 MD5: 9F3744A5C6F49291A7A685040A013399 PID: 840 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 888 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 924 ( 0) C:\WINDOWS\System32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 972 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 1040 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 1240 ( 0) C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe size: 16248 MD5: 765E0E2BDB83C58FFC411DA401D8BA66 PID: 1300 ( 0) C:\WINDOWS\Explorer.EXE size: 1036288 MD5: 4C33E5B9A6197B6ED215F6CFBA0A2DAA PID: 1424 ( 0) C:\WINDOWS\system32\spoolsv.exe size: 57856 MD5: B4EF928E4FAD79364A80ACBA6D999934 PID: 1688 ( 0) C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe size: 212992 MD5: 1F47361DEBEAE7811E786DFF6998CB6A PID: 1712 ( 0) C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe size: 79224 MD5: 8CF58586AE4577ED71FFE8883A6D4B3B PID: 1720 ( 0) C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe size: 83608 MD5: 9C1C80BBF8E6044980890E2D2D91091C PID: 1784 ( 0) C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe size: 962661 MD5: 4364B5C4F31241660D30D2C9980F877E PID: 148 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 288 ( 0) C:\WINDOWS\System32\alg.exe size: 44544 MD5: 2FE681D10C5FC343DBBC0610B8DD4D24 PID: 1348 ( 0) C:\WINDOWS\system32\wscntfy.exe size: 13824 MD5: 54CDDAD404557ED98433D6ECBFC92691 PID: 1368 ( 0) C:\WINDOWS\system32\wuauclt.exe size: 53080 MD5: F3E9065EB617A7E3A832A7976BFA021B PID: 1800 ( 0) C:\Program Files\Internet Explorer\IEXPLORE.EXE size: 93184 MD5: 833E2B3F0E2484C0F2B804AE871B4381 PID: 1588 ( 0) C:\Program Files\Internet Explorer\IEXPLORE.EXE size: 93184 MD5: 833E2B3F0E2484C0F2B804AE871B4381 PID: 1076 ( 0) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe size: 4943184 MD5: C92780F50B8BB7A89E919585916494A9 --- Browser start & search pages list --- Spybot - Search & Destroy browser pages report, 13/11/2007 15:28:30 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page C:\windows\system32\blank.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page about:blank HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@ http://home.microsoft.com/access/autosearch.asp?p=%s HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page C:\windows\system32\blank.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm --- Winsock Layered Service Provider list --- Protocol 0: MSAFD Tcpip [TCP/IP] GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP IP protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD Tcpip [*] Protocol 1: MSAFD Tcpip [UDP/IP] GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP IP protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD Tcpip [*] Protocol 2: MSAFD Tcpip [RAW/IP] GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP IP protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD Tcpip [*] Protocol 3: RSVP UDP Service Provider GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A} Filename: %SystemRoot%\system32\rsvpsp.dll Description: Microsoft Windows NT/2k/XP RVSP DB filename: %SystemRoot%\system32\rsvpsp.dll DB protocol: RSVP * Service Provider Protocol 4: RSVP TCP Service Provider GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A} Filename: %SystemRoot%\system32\rsvpsp.dll Description: Microsoft Windows NT/2k/XP RVSP DB filename: %SystemRoot%\system32\rsvpsp.dll DB protocol: RSVP * Service Provider Protocol 5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EDA6D416-D4C4-45C7-913A-726FF106028F}] SEQPACKET 0 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EDA6D416-D4C4-45C7-913A-726FF106028F}] DATAGRAM 0 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{34E7EB56-DE5D-439E-A4CF-B2D969DC3972}] SEQPACKET 1 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{34E7EB56-DE5D-439E-A4CF-B2D969DC3972}] DATAGRAM 1 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{3A522FD2-0635-4425-93E2-901A15ABCA56}] SEQPACKET 2 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{3A522FD2-0635-4425-93E2-901A15ABCA56}] DATAGRAM 2 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 11: MSAFD NetBIOS [\Device\NetBT_Tcpip_{79BE8A43-3DAE-43F3-95DE-0FE61588F7B3}] SEQPACKET 3 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{79BE8A43-3DAE-43F3-95DE-0FE61588F7B3}] DATAGRAM 3 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D894A65F-B0D4-4D59-B754-6DE215946685}] SEQPACKET 4 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D894A65F-B0D4-4D59-B754-6DE215946685}] DATAGRAM 4 GUID: {8D5F1830-C273-11CF-95C8-00805F48A192} Filename: %SystemRoot%\system32\mswsock.dll Description: Microsoft Windows NT/2k/XP NetBios protocol DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: MSAFD NetBIOS * Namespace Provider 0: TCP/IP GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B} Filename: %SystemRoot%\System32\mswsock.dll Description: Microsoft Windows NT/2k/XP TCP/IP name space provider DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: TCP/IP Namespace Provider 1: NTDS GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC} Filename: %SystemRoot%\System32\winrnr.dll Description: Microsoft Windows NT/2k/XP name space provider DB filename: %SystemRoot%\system32\winrnr.dll DB protocol: NTDS Namespace Provider 2: Espace de noms NLA (Network Location Awareness) GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83} Filename: %SystemRoot%\System32\mswsock.dll Description: Microsoft Windows NT/2k/XP name space provider DB filename: %SystemRoot%\system32\mswsock.dll DB protocol: NLA-Namespace AVG antispyware --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 16:57 13/11/2007 + Résultat de l'analyse: C:\System Volume Information\_restore{0F07705D-DBDE-46FE-8454-10079F06DCEC}\RP2\A0000254.EXE -> Trojan.Dialer.ru : Nettoyé et sauvegardé (mise en quarantaine). Fin du rapport panda ;*********************************************************************************************************************************************************************************** ANALYSIS: 2007-11-13 17:17:56 PROTECTIONS: 1 MALWARE: 6 SUSPECTS: 1 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== avast! antivirus 4.7.1043 [VPS 071111-1] 4.7.1043 Yes Yes ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00064632 Dialer.ABR Dialers No 0 Yes No C:\_OTMoveIt\MovedFiles\WINDOWS\Downloaded Program Files\STARTBF2.INF 00139535 Application/Processor HackTools No 0 Yes No C:\WINDOWS\SYSTEM32\Process.exe 00139535 Application/Processor HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\SmitfraudFix\Process.exe 00139535 Application/Processor HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\SmitfraudFix\Process.exe 00139535 Application/Processor HackTools No 0 Yes No C:\SDFix\APPS\Process.exe 00517584 Application/SuperFast HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\SmitfraudFix\RESTART.EXE 00517584 Application/SuperFast HackTools No 0 Yes No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\SmitfraudFix\RESTART.EXE 01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\ComboFix.exe[nircmd.exe] 01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\ComboFix.exe[nircmd.cfexe] 01262593 Application/NirCmd.A HackTools No 0 Yes No C:\WINDOWS\NIRCMD.EXE 01299526 Adware/LinkOptimizer Adware No 0 Yes No C:\_OTMoveIt\MovedFiles\WINDOWS\SYSTEM32\CTFAHHOU.EXE 02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\Documents and Settings\supertomate\Bureau\SmitfraudFix\Reboot.exe 02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\Documents and Settings\supertomate\Bureau\dÃ©sinfection\SmitfraudFix\Reboot.exe ;=================================================================================================================================================================================== SUSPECTS Location ;=================================================================================================================================================================================== C:\WINDOWS\SYSTEM32\NETAP.DLL ;=================================================================================================================================================================================== hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:18, on 13/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [zzpeaa.exe] C:\WINDOWS\TEMP\zzpeaa.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan O17 - HKLM\System\CCS\Services\Tcpip\..\{D894A65F-B0D4-4D59-B754-6DE215946685}: NameServer = 80.10.246.130 81.253.149.10 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [zzpeaa.exe] C:\WINDOWS\TEMP\zzpeaa.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll __________________ télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau. double-clique sur OTMoveIt.exe pour le lancer. copie la liste qui se trouve en citation ci-dessous, et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. Citation : C:\WINDOWS\system32\netap.dll clique sur MoveIt! pour lancer la suppression. le résultat apparaitra dans le cadre "Results". clique sur Exit pour fermer. poste le rapport situé dans C:\_OTMoveIt\MovedFiles. il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. __________________________ pour protéger gratos ton ordi (en plus de la mise a jour windows) http://www.commentcamarche.net/telecharger/logiciel 4 securite mettre un antivirus AVAST en français ou ANTIVIR (en anglais mais très efficace) https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal) ------------- des anti-espions : AD AWARE + SPYBOT + si tea timer non active de spybot: WINDOWS DEFENDER ou SPYWARE TERMINATOR +/- SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)... Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version -------- un pare feu : celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html https://manuelsdaide.com/contact/ http://www.open-files.com/forum/index.php?showtopic=29277 http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm ----------- CCLEANER pour effacer les traces de surf

OTmoveit DllUnregisterServer procedure not found in C:\WINDOWS\system32\netap.dll C:\WINDOWS\system32\netap.dll NOT unregistered. File move failed. C:\WINDOWS\system32\netap.dll scheduled to be moved on reboot. Created on 11/13/2007 18:11:58 Toujours pas de problème sur l'ordi. Pour mes protections, vu que je bascule sur firefox, est-ce qu'il faut la même chose que ce que tu me recommandes? Pour l'instant j'ai avast et c'est tout (je crois). Mille mercis

Warning! potential spyware operation! - Page 2

Réponse 21 / 27
jlpjlp Contributeur sécurité
tu peux virer smitfraud fix

encore des problemes?

recolle un rapport hijackthis
et antivir pour voir
0
Réponse 22 / 27
supertomat Auteur
Euh, pour virer Smitfraud fix et les autres (AVG, combo, OTmoveIT, spybot, vundoFix), je fais comment? Si je les supprime juste de mon bureau, il va pas me rester des fichiers sur les bras?

AUCUN problème décelé sur mon ordi, tout va bien

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:52, on 17/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O17 - HKLM\System\CCS\Services\Tcpip\..\{D894A65F-B0D4-4D59-B754-6DE215946685}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
0
Réponse 23 / 27
jlpjlp Contributeur sécurité
fix cette ligne avec hijackthis

O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll (file missing)

___________

Je comprends pas grand chose mais je vois à la fin "1 Files cannot be scanned" et "1 warnings", c'est grave doc?

non c'est rien tu peux ignoré, tu n'as aucun virus!!!!
________________

protege ton ordi comme indiqué dans mon precedent message

ton pb est résolu!!!
0
Réponse 24 / 27
supertomat Auteur
J'ai fixé la ligne comme tu m'as dit mais si je refait un log Hijackthis, il me la remet.

Quand je fixe, il me met le message suivant:

"Hijackthis is about to remove a BHO and the corresponding file from your system. Close all Internet Explorer windows AND allWindows Explorer windows before continuing for the best chance of success."

J'ai donc tout fermé mais la ligne est toujours là:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:57, on 18/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {0069B26D-8D52-4AD8-9E31-A72F1AC65D7F} - C:\WINDOWS\system32\netap.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
0
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 25 / 27
jlpjlp
Bonjour,

tu avais avant de fixer avec hijakthis fermé tous les autres logiciels dont internet explorer?

reéssaye en fermant tout sauf hijakthis

si elle reste de toute facon c'est pas grave, le fichier a été viré (file missing) ce qui est le principal!

a plus
0
Réponse 26 / 27
supertomat Auteur
J'ai bien tout fermé avant de fixer et la ligne reste quand même! Mais si tu dis que c'est pas grave...

Merci beaucoup
0
Réponse 27 / 27
jlpjlp Contributeur sécurité
ok

bonne continuation
0
Précédent
- 1
- 2

Warning! potential spyware operation! - Page 2

Discussions similaires

Newsletters