win32.trojandownloader.zlob? Résolu/Fermé

Question

Bonjour,
mon PC est manifestement infecté, peut-être par  win32.trojandownloader.zlob ou downloader.Conhook.hl?

j'ai utilisé différentes procédures trouvées sur ke forum, dont SmartFraudFix, mais rien n'y fait... il reste bombardé d'alertes de  sécurité me proposant divers téléchargements...

voici les rapports:

 ---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	16:36:42 20/11/2007

 + Résultat de l'analyse:	



C:\Documents and Settings\Anthony_2\Cookies\anthony_2@247realmedia[1].txt -> TrackingCookie.247realmedia : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@2o7[2].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@ehg-pcsecurityshield.hitbox[1].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@hitbox[1].txt -> TrackingCookie.Hitbox : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@smartadserver[2].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@m.webtrends[2].txt -> TrackingCookie.Webtrends : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Aucune action entreprise.
C:\Documents and Settings\Anthony_2\Cookies\anthony_2@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.


Fin du rapport

BitDefender Online Scanner -Scan ReportBitDefender Online Scanner  
      Scan report generated at: Wed, Nov 21, 2007 - 00:40:09
         
      Scan path: A:\;C:\;D:\;E:\;F:\;  
         
            Statistics
            Time03:16:30
            Files425557
            Folders9607
            Boot Sectors4
            Archives15529
            Packed Files16687
        
            Results
            Identified Viruses 11
            Infected Files 22
            Suspect Files 0
            Warnings0
            Disinfected0
            Deleted Files27
        
            Engines Info
            Virus Definitions878637
            Engine buildAVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
            Scan plugins14
            Archive plugins38
            Unpack plugins7
            E-mail plugins6
            System plugins1
        
            Scan Settings
            First ActionDisinfect
            Second ActionDelete
            HeuristicsYes
            Enable WarningsYes
            Scanned Extensions*;
            Exclude Extensions 
            Scan EmailsYes
            Scan ArchivesYes
            Scan PackedYes
            Scan FilesYes
            Scan BootYes
        
        Scanned File Status
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\0226082B.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\0226082B.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\0226082B.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\02293228.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\02293228.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\02293228.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\0C7061B9.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\0C7061B9.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\0C7061B9.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\11832A68.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\11832A68.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\11832A68.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\31F31313.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\31F31313.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\31F31313.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\5027228A.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\5027228A.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\5027228A.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\61376306.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\61376306.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\61376306.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\648D46C6.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\648D46C6.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\648D46C6.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\6CF84F31.class=>(Quarantine-2)Infected with: 
            Java.Trojan.Exploit.Bytverify2.Gen
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\6CF84F31.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\6CF84F31.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\741E1F9C.class=>(Quarantine-2)Infected with: 
            Trojan.Java.Classloader.C
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\741E1F9C.class=>(Quarantine-2)Disinfection 
            failed
            C:\Documents and Settings\Administrateur\Bureau\anthony\Program 
            Files\Norton Internet Security\Norton 
            AntiVirus\Quarantine\741E1F9C.class=>(Quarantine-2)Deleted
            C:\Documents and Settings\Anthony_2\Local 
            Settings\Temp\image28.zip=>image28-www.photobucket.comInfected with: 
            Trojan.Peed.Gen
            C:\Documents and Settings\Anthony_2\Local 
            Settings\Temp\image28.zip=>image28-www.photobucket.comDisinfection 
            failed
            C:\Documents and Settings\Anthony_2\Local 
            Settings\Temp\image28.zip=>image28-www.photobucket.comDeleted
            C:\Documents and Settings\Anthony_2\Local 
            Settings\Temp\image28.zipUpdated
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\CPYRK1YZ\in30[1].exeInfected with: 
            Trojan.Peed.Gen
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\CPYRK1YZ\in30[1].exeDisinfection failed
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\CPYRK1YZ\in30[1].exeDeleted
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\CPYRK1YZ\pochki20071106[1]Infected with: 
            Trojan.Fotomoto.F
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\CPYRK1YZ\pochki20071106[1]Disinfection 
            failed
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\CPYRK1YZ\pochki20071106[1]Deleted
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\FSKKGZZM\ptch[1]Infected with: 
            Trojan.Vundo.DQO
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\FSKKGZZM\ptch[1]Disinfection failed
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\FSKKGZZM\ptch[1]Deleted
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\KDEVS5Q3\mosx1024[1]Infected with: 
            Trojan.Downloader.Conhook.BI
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\KDEVS5Q3\mosx1024[1]Deleted
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\KDEVS5Q3\poiu[1]Infected with: 
            Trojan.Clicker.MNB
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\KDEVS5Q3\poiu[1]Disinfection failed
            C:\Documents and Settings\Anthony_2\Local Settings\Temporary 
            Internet Files\Content.IE5\KDEVS5Q3\poiu[1]Delete failed
            C:\WINDOWS\Downloaded Program Files\Account.dllInfected with: 
            Trojan.Dloader.YH
            C:\WINDOWS\Downloaded Program Files\Account.dllDisinfection failed
            C:\WINDOWS\Downloaded Program Files\Account.dllDeleted
            C:\WINDOWS\system32\awtspol.dllInfected with: Trojan.Inject.ET
            C:\WINDOWS\system32\awtspol.dllDisinfection failed
            C:\WINDOWS\system32\awtspol.dllDelete failed
            C:\WINDOWS\system32\fviqhlgu.dllInfected with: Trojan.Vundo.DQO
            C:\WINDOWS\system32\fviqhlgu.dllDisinfection failed
            C:\WINDOWS\system32\fviqhlgu.dllDelete failed
            C:\WINDOWS\system32\sksilwpl.exeInfected with: Trojan.Fotomoto.F
            C:\WINDOWS\system32\sksilwpl.exeDisinfection failed
            C:\WINDOWS\system32\sksilwpl.exeDeleted
            C:\WINDOWS\system32\smtsvc.exeInfected with: 
            DeepScan:Generic.Malware.SIdld!.0F2DE431
            C:\WINDOWS\system32\smtsvc.exeDisinfection failed
            C:\WINDOWS\system32\smtsvc.exeDelete failed
            C:\WINDOWS\system32\__c0091504.datInfected with: 
            Trojan.Downloader.Conhook.BI
            C:\WINDOWS\system32\__c0091504.datDisinfection failed
            C:\WINDOWS\system32\__c0091504.datDelete failed

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:44:57, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\USB Card RW\shwicon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\smtsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\SpamPal\spampal.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\fexutdyn.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShowIcon_KingByte_USB Card RW v1.14e045] "C:\Program Files\USB Card RW\shwicon.exe" -t"KingByte\USB Card RW v1.14e045"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OmniPage] C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [System Terminal Storage] smtsvc.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [e838bfc1] rundll32.exe "C:\WINDOWS\system32\irekbasa.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B0A451A6-A5A6-11D4-A790-0010A4E6086F} (GettyFinder2 Control) - file://D:\activex\GettyFinder2.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0091504.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\snhnxfpv.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

moi29 · Answer

démarre en mode sans échec et supprime tous tes cookies 
C:\Documents and Settings\Anthony_2\Cookies\
et aussi tout tes fichiers temp 
c:/windows/temp/
C:\Documents and Settings\Anthony_2	emp
télécharge ccleaner pour tous nettoyer

moi29 · Answer

http://www.supprimer-spyware.org/zlob.html?gclid=CPb9oJLC7Y8CFQlIMAodyj-HGw

^^Marie^^ · Answer

Salut

Tu es surtout infecté par Vundo

Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

* Double-clique VundoFix.exe afin de le lancer. 
* Lorsque l'outil se lance à nouveau, clique sur le bouton Scan for Vundo 
* Clique sur le bouton Scan for Vundo. 
* Lorsque le scan est complété, clique sur le bouton Remove Vundo 
* Une invite te demandera si tu veux supprimer les fichiers, clique YES 
* Après avoir cliqué "Yes", le Bureau disparaitra un moment lors de la suppression des fichiers. 
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK 
* Démarre ton PC à nouveau. 
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt 



Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT 
créé sur le bureau dans ta prochaine réponse 


Et un nouveau log Hijacthis

A++


Edit &#9658; 

C -  Ccleaner :
 (nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc.) 

* Télécharge CCleaner. 

https://www.pcastuces.com/logitheque/ccleaner.htm 
Installe le dans un répertoire dédié. 
Décoche pendant l'installation 
--- les deux cases "Ajouter l'option ... " 
--- Contrôler les mises à jour 
--- Ajouter la Barre d'Outils Yahoo! CCleaner 
* Lance Ccleaner pour un nettoyage complet.
 Tutorial ici: 
 https://kerio.probb.fr/t242-tuto-ccleaner-v-2 
https://www.malekal.com/tutoriel-ccleaner/ 
ET
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

^^Marie^^ · Answer

Re Java\jre1.5.0_06 JAVA https://www.java.com/fr/download/manual.jsp A)- C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe Ce qui veut dire que ta console Java n'est pas à jour ! Les mises à jour Java ne sont pas des mises à jour de confort ; ce sont des mises à jour de SÉCURITÉ . Une vulnérabilité a été identifiée dans Sun JDK et JRE, elle pourrait être exploitée par des attaquants distants afin de compromettre un système vulnérable. Vas chez Java Sun < et télécharge la dernière Version 6 Update3. Après installation et redémarrage, vas dans le "panneau de configuration"/"Ajout-Suppr. de programmes" afin de désinstaller les anciennes versions. Ceci pour récupérer de l'espace disque et éventuellement pour virer les failles présentes dans ces anciennes versions. Retourne alors chez Java ci-dessus et clique sur le bouton "Vérifier l'installation" pour t'assurer que tout est en ordre. Une fois JRE installé, dans votre « console de paramétrage », accessible depuis le « Panneau de configuration », choisir l’onglet "Java", puis dans "paramètres de l'application Java Runtime", clic sur bouton "afficher", vous accédez à cet écran." Source: ). Reste à supprimer dans "C:\" > "Program Files" > "Dossier Java" le vieux dossier qui n'est pas ôter lors de la désinstallation.

^^Marie^^ · Answer

Installe Java et tu me refais un log Hijacthis en le renommant 
stp

Fais un clic droit sur hijackthis, choisis "renommer" marque : abcde.exe 
Puis remet un rapport stp

axonais · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:10:55, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\USB Card RW\shwicon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\smtsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\SpamPal\spampal.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShowIcon_KingByte_USB Card RW v1.14e045] "C:\Program Files\USB Card RW\shwicon.exe" -t"KingByte\USB Card RW v1.14e045"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OmniPage] C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [System Terminal Storage] smtsvc.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [e838bfc1] rundll32.exe "C:\WINDOWS\system32\irekbasa.dll",b
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B0A451A6-A5A6-11D4-A790-0010A4E6086F} (GettyFinder2 Control) - file://D:\activex\GettyFinder2.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0091504.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\snhnxfpv.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

axonais · Answer

pas de chance ? AVG vient de trouver "downloader.agent.emo" dans C:\WINDOWS\17PHolmes2000201.exe

nouvelle attaque ou la suite?

^^Marie^^ · Answer

Bonsoir, 

* Relance Vundofix 
* Ne clique pas sur "Scan for a vundo" 
* Clique droit au milieu de la fenêtre 
* Clique sur Add more files ? 
* Copie/colle les fichiers ci-dessous ( un par case) : 

C:\windows\system32\annyhlui.dllbox 
C:\windows\system32\dftyhcyv.dll 
C:\windows\system32\fexutdyn.dll 
C:\windows\system32\fexutdyn.dllbox 
C:\windows\system32\jjllm.ini 
C:\windows\system32\jjllm.ini2 
C:\windows\system32\mlljj.dll 



* Clique sur Add files 
* Ensuite clique sur Close Windows 
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale) 
* Si l'outils demande un redémarrage, accepte 
* Poste le rapport Vundofix!

axonais · Answer

VundoFix V6.6.2

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 11:51:07 21/11/2007

Listing files found while scanning....

C:\windows\system32\annyhlui.dllbox
C:\windows\system32\dftyhcyv.dll
C:\windows\system32\fexutdyn.dll
C:\windows\system32\fexutdyn.dllbox
C:\windows\system32\jjllm.ini
C:\windows\system32\jjllm.ini2
C:\windows\system32\mlljj.dll

Beginning removal...

 Attempting to delete C:\windows\system32\annyhlui.dllbox
C:\windows\system32\annyhlui.dllbox Has been deleted!

 Attempting to delete C:\windows\system32\dftyhcyv.dll
C:\windows\system32\dftyhcyv.dll Has been deleted!

 Attempting to delete C:\windows\system32\fexutdyn.dll
C:\windows\system32\fexutdyn.dll Has been deleted!

 Attempting to delete C:\windows\system32\fexutdyn.dllbox
C:\windows\system32\fexutdyn.dllbox Has been deleted!

 Attempting to delete C:\windows\system32\jjllm.ini
C:\windows\system32\jjllm.ini Has been deleted!

 Attempting to delete C:\windows\system32\jjllm.ini2
C:\windows\system32\jjllm.ini2 Has been deleted!

 Attempting to delete C:\windows\system32\mlljj.dll
C:\windows\system32\mlljj.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version...

Scan started at 15:03:14 21/11/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

Performing Repairs to the registry.
Done!


c'est mieux?

^^Marie^^ · Answer

Refais un log Hijacthis

Je repasse demain

A++

axonais · Answer

voilà.....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:36:47, on 21/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\USB Card RW\shwicon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\smtsvc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\SpamPal\spampal.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShowIcon_KingByte_USB Card RW v1.14e045] "C:\Program Files\USB Card RW\shwicon.exe" -t"KingByte\USB Card RW v1.14e045"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OmniPage] C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [System Terminal Storage] smtsvc.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [e838bfc1] rundll32.exe "C:\WINDOWS\system32\irekbasa.dll",b
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu2000201.exe 61A847B5BBF72810329B385472F801F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B0A451A6-A5A6-11D4-A790-0010A4E6086F} (GettyFinder2 Control) - file://D:\activex\GettyFinder2.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{333D6155-3E59-433B-84E8-51959A5031BC}: NameServer = 212.151.136.246 212.151.137.170
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0091504.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\snhnxfpv.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

^^Marie^^ · Answer

Tu l'as renommé ??

Fais un clic droit sur hijackthis, choisis "renommer" marque : abcde.exe
Puis remet un rapport stp

Vide ta quarantaine de Norton

moi29 · Answer

marie il aurait deux antivirus ??? moi je vois avast mais je peu me tromper ....

axonais · Answer

oups c'était le raccourci que j'avais renommé...

 
j'ai renommé hijackthis, et je n'ai plus Norton depuis longtemps, par contre j'ai avast et avg anti-spyware

voilà le nouveau rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:27, on 22/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\USB Card RW\shwicon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\smtsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\SpamPal\spampal.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Trend Micro\HijackThis\abcde.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {1d7c02dc-9a75-f9d8-ecd4-047367a52536} - {63525a76-3740-4dce-8d9f-57a9cd20c7d1} - C:\WINDOWS\system32\ltmpctxf.dll
O2 - BHO: (no name) - {73E00092-5539-4661-9B61-3A66FC0D772E} - C:\WINDOWS\system32\cbxwvtt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C0A70477-A576-4A9F-AE6C-5AE3072A5629} - C:\WINDOWS\system32\mlljj.dll (file missing)
O2 - BHO: (no name) - {d0a5375d-d6a5-4cff-abf0-cd9b4e517736} - C:\WINDOWS\system32\charaxjy.dll (file missing)
O2 - BHO: (no name) - {FDC61165-B968-4304-848E-CB467BE86241} - C:\WINDOWS\system32\ddcyx.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShowIcon_KingByte_USB Card RW v1.14e045] "C:\Program Files\USB Card RW\shwicon.exe" -t"KingByte\USB Card RW v1.14e045"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OmniPage] C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [System Terminal Storage] smtsvc.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [e838bfc1] rundll32.exe "C:\WINDOWS\system32\ylyluxac.dll",b
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu2000201.exe 61A847B5BBF72810329B385472F801F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B0A451A6-A5A6-11D4-A790-0010A4E6086F} (GettyFinder2 Control) - file://D:\activex\GettyFinder2.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{333D6155-3E59-433B-84E8-51959A5031BC}: NameServer = 212.151.136.246 212.151.137.170
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00C2198.dat
O20 - Winlogon Notify: cbxwvtt - C:\WINDOWS\SYSTEM32\cbxwvtt.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\snhnxfpv.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

^^Marie^^ · Answer

télécharge combofix (par sUBs)ici : 
Combofix est un programme qui supprime des trojans/backdoor connues et rootkits
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


et enregistre le sur le bureau. 

2/ double-clique sur combofix.exe et suis les instructions 

3/ à la fin, il va produire un rapport C:\ComboFix.txt 

4/ copie/colle ce rapport dans ta prochaine réponse. 

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. 

Poste aussi un nouveau rapport Hijackthis.

moi29 · Answer

juste un avis il es infecter par virtumonde 

4. HijackThis

Afin de retirer les clés registre liées à Vundo / Virtumonde ainsi que les messages au démarrage de votre PC vous annonçant que certains fichiers ".dll" n'ont pas pu se lancer (liés à Vundo / Virtumonde), lancez HijackThis (renommé en Scanner.exe) puis cliquez sur "Do a system scan only".

Ensuite cochez les cases en face des paires de lignes 02 et 020 infectées par Vundo / Virtumonde 
O2 - BHO: (no name) - {73E00092-5539-4661-9B61-3A66FC0D772E} - C:\WINDOWS\system32\cbxwvtt.dll 
O20 - Winlogon Notify: cbxwvtt - C:\WINDOWS\SYSTEM32\cbxwvtt.dll 

Cliquez enfin sur le bouton Fix checked, puis au message cliquez sur Oui.

Vous pouvez maintenant quitter HijackThis.

mais s'est juste mon avis ......................

axonais · Answer

hélas hélas 



ComboFix 07-11-19.3 - Anthony_2 2007-11-22 10:47:13.1 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.1.1036.18.352 [GMT 1:00]
Running from: C:\Documents and Settings\Anthony_2\Bureau\ComboFix.exe
 * Created a new restore point
.

	Incapable d'obtenir les privilèges Système

quelques précisions:

-j'avais réactivé hier soir la restauration, eest-ce que celà change quelque chose?
-je n'ai pas pu fermer toutes les fenetres pendant l'analyse de combofix, puisque j'étais toujours la cible des envois de message de "securité"
-vers la fin de l'analyse apres l'affichage des fichiers effacés, avast m'a envoyé un message de détection de "win32.Tiny-JC" et celà bloquait, donc, je lui ai dit de ne rien faire ( c'était dans un fichier que combofix venait d'effacer)

plutôt coriace, l'animal!?

^^Marie^^ · Answer

Refais 

Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse

axonais · Answer

et j'oubliais: j'ai dû rebooter parce que j'avais un superbe écran bleu m'indiquant que "un problème a été détecté et Windows a dû être arrété    KERNEL_STACK_INPAGE_ERROR"

de plus à chaque démarrage, j'ai une petite alerte m'indiquant que mon pare-feu n'est pas activé, puis celà s'arrange tout seul dans les 10 secondes à peine

^^Marie^^ · Answer

Supprime tous les logiciels que l'on t'a fait installer

    * Télécharge ToolsCleaner de A.Roshtein sur ton Bureau. &#9658; il finira les restes de désinstallation

http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

    * Clique sur Recherche et laisse le scan se terminer.
    * Clique, sur Suppression pour finaliser.
    * Tu peux, si tu le souhaites, te servir des Options facultatives.
    * Clique sur Quitter, pour que le rapport puisse se créer.
    * Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

axonais · Answer

[11/22/2007, 11:57:21] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Anthony_2\Bureau\VirtumundoBeGone.exe" )
[11/22/2007, 11:57:28] - Detected System Information:
[11/22/2007, 11:57:28] -  Windows Version: 5.1.2600, Service Pack 2
[11/22/2007, 11:57:28] -  Current Username: Anthony_2 (Admin)
[11/22/2007, 11:57:28] -  Windows is in NORMAL mode.
[11/22/2007, 11:57:28] - Searching for Browser Helper Objects:
[11/22/2007, 11:57:28] -  BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/22/2007, 11:57:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:28] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[11/22/2007, 11:57:28] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[11/22/2007, 11:57:28] -  BHO 2: {63525a76-3740-4dce-8d9f-57a9cd20c7d1} ()
[11/22/2007, 11:57:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:28] -  Checking for HKLM\...\Winlogon\Notify\ltmpctxf
[11/22/2007, 11:57:28] -  Key not found: HKLM\...\Winlogon\Notify\ltmpctxf, continuing.
[11/22/2007, 11:57:28] -  BHO 3: {73E00092-5539-4661-9B61-3A66FC0D772E} ()
[11/22/2007, 11:57:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:28] -  Checking for HKLM\...\Winlogon\Notify\cbxwvtt
[11/22/2007, 11:57:28] -  Found: HKLM\...\Winlogon\Notify\cbxwvtt - This is probably Virtumundo.
[11/22/2007, 11:57:28] -  Assigning {73E00092-5539-4661-9B61-3A66FC0D772E} MSEvents Object
[11/22/2007, 11:57:29] - BHO list has been changed! Starting over...
[11/22/2007, 11:57:29] -  BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/22/2007, 11:57:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:29] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[11/22/2007, 11:57:29] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[11/22/2007, 11:57:29] -  BHO 2: {63525a76-3740-4dce-8d9f-57a9cd20c7d1} ()
[11/22/2007, 11:57:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:29] -  Checking for HKLM\...\Winlogon\Notify\ltmpctxf
[11/22/2007, 11:57:29] -  Key not found: HKLM\...\Winlogon\Notify\ltmpctxf, continuing.
[11/22/2007, 11:57:29] -  BHO 3: {73E00092-5539-4661-9B61-3A66FC0D772E} (MSEvents Object)
[11/22/2007, 11:57:29] - ALERT: Found MSEvents Object!
[11/22/2007, 11:57:29] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 11:57:29] -  BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/22/2007, 11:57:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:29] -  No filename found. Continuing.
[11/22/2007, 11:57:29] -  BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} ()
[11/22/2007, 11:57:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:30] -  Checking for HKLM\...\Winlogon\Notify\wxsfbxbz
[11/22/2007, 11:57:30] -  Found: HKLM\...\Winlogon\Notify\wxsfbxbz - This is probably Virtumundo.
[11/22/2007, 11:57:30] -  Assigning {A95B2816-1D7E-4561-A202-68C0DE02353A} MSEvents Object
[11/22/2007, 11:57:30] - BHO list has been changed! Starting over...
[11/22/2007, 11:57:30] -  BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/22/2007, 11:57:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:30] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[11/22/2007, 11:57:30] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[11/22/2007, 11:57:30] -  BHO 2: {63525a76-3740-4dce-8d9f-57a9cd20c7d1} ()
[11/22/2007, 11:57:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:30] -  Checking for HKLM\...\Winlogon\Notify\ltmpctxf
[11/22/2007, 11:57:31] -  Key not found: HKLM\...\Winlogon\Notify\ltmpctxf, continuing.
[11/22/2007, 11:57:31] -  BHO 3: {73E00092-5539-4661-9B61-3A66FC0D772E} (MSEvents Object)
[11/22/2007, 11:57:31] - ALERT: Found MSEvents Object!
[11/22/2007, 11:57:31] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 11:57:31] -  BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/22/2007, 11:57:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:31] -  No filename found. Continuing.
[11/22/2007, 11:57:31] -  BHO 6: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/22/2007, 11:57:31] - ALERT: Found MSEvents Object!
[11/22/2007, 11:57:31] -  BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/22/2007, 11:57:31] -  BHO 8: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/22/2007, 11:57:31] -  BHO 9: {C0A70477-A576-4A9F-AE6C-5AE3072A5629} ()
[11/22/2007, 11:57:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:31] -  Checking for HKLM\...\Winlogon\Notify\mlljj
[11/22/2007, 11:57:31] -  Key not found: HKLM\...\Winlogon\Notify\mlljj, continuing.
[11/22/2007, 11:57:31] -  BHO 10: {d0a5375d-d6a5-4cff-abf0-cd9b4e517736} ()
[11/22/2007, 11:57:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:31] -  Checking for HKLM\...\Winlogon\Notify\charaxjy
[11/22/2007, 11:57:32] -  Key not found: HKLM\...\Winlogon\Notify\charaxjy, continuing.
[11/22/2007, 11:57:32] -  BHO 11: {E35565A1-6A52-4BFC-A1A2-24D4B674307C} ()
[11/22/2007, 11:57:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:32] -  Checking for HKLM\...\Winlogon\Notify\sstqo
[11/22/2007, 11:57:32] -  Key not found: HKLM\...\Winlogon\Notify\sstqo, continuing.
[11/22/2007, 11:57:32] -  BHO 12: {FDC61165-B968-4304-848E-CB467BE86241} ()
[11/22/2007, 11:57:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:32] -  Checking for HKLM\...\Winlogon\Notify\ddcyx
[11/22/2007, 11:57:32] -  Key not found: HKLM\...\Winlogon\Notify\ddcyx, continuing.
[11/22/2007, 11:57:32] - Finished Searching Browser Helper Objects
[11/22/2007, 11:57:32] - *** Detected MSEvents Object
[11/22/2007, 11:57:32] - Trying to remove MSEvents Object...
[11/22/2007, 11:57:33] -    Terminating Process: IEXPLORE.EXE
[11/22/2007, 11:57:34] -    Terminating Process: RUNDLL32.EXE
[11/22/2007, 11:57:34] -    Disabling Automatic Shell Restart
[11/22/2007, 11:57:34] -    Terminating Process: EXPLORER.EXE
[11/22/2007, 11:57:35] -    Suspending the NT Session Manager System Service
[11/22/2007, 11:57:35] -    Terminating Windows NT Logon/Logoff Manager
[11/22/2007, 11:57:35] -    Re-enabling Automatic Shell Restart
[11/22/2007, 11:57:35] -   File to disable: C:\WINDOWS\system32\cbxwvtt.dll
[11/22/2007, 11:57:35] -  Renaming C:\WINDOWS\system32\cbxwvtt.dll -> C:\WINDOWS\system32\cbxwvtt.dll.vir
[11/22/2007, 11:57:36] -  File successfully renamed!
[11/22/2007, 11:57:36] -   Removing HKLM\...\Browser Helper Objects\{73E00092-5539-4661-9B61-3A66FC0D772E}
[11/22/2007, 11:57:36] -   Removing HKCR\CLSID\{73E00092-5539-4661-9B61-3A66FC0D772E}
[11/22/2007, 11:57:36] -   Adding Kill Bit for ActiveX for GUID: {73E00092-5539-4661-9B61-3A66FC0D772E}
[11/22/2007, 11:57:36] -   Deleting ATLEvents/MSEvents Registry entries
[11/22/2007, 11:57:36] -   Removing HKLM\...\Winlogon\Notify\cbxwvtt
[11/22/2007, 11:57:36] - Searching for Browser Helper Objects:
[11/22/2007, 11:57:36] -  BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/22/2007, 11:57:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:36] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[11/22/2007, 11:57:36] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[11/22/2007, 11:57:36] -  BHO 2: {63525a76-3740-4dce-8d9f-57a9cd20c7d1} ()
[11/22/2007, 11:57:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:37] -  Checking for HKLM\...\Winlogon\Notify\ltmpctxf
[11/22/2007, 11:57:37] -  Key not found: HKLM\...\Winlogon\Notify\ltmpctxf, continuing.
[11/22/2007, 11:57:37] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 11:57:37] -  BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/22/2007, 11:57:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:37] -  No filename found. Continuing.
[11/22/2007, 11:57:37] -  BHO 5: {A95B2816-1D7E-4561-A202-68C0DE02353A} (MSEvents Object)
[11/22/2007, 11:57:37] - ALERT: Found MSEvents Object!
[11/22/2007, 11:57:37] -  BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/22/2007, 11:57:37] -  BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/22/2007, 11:57:37] -  BHO 8: {C0A70477-A576-4A9F-AE6C-5AE3072A5629} ()
[11/22/2007, 11:57:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:37] -  Checking for HKLM\...\Winlogon\Notify\mlljj
[11/22/2007, 11:57:37] -  Key not found: HKLM\...\Winlogon\Notify\mlljj, continuing.
[11/22/2007, 11:57:37] -  BHO 9: {d0a5375d-d6a5-4cff-abf0-cd9b4e517736} ()
[11/22/2007, 11:57:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:38] -  Checking for HKLM\...\Winlogon\Notify\charaxjy
[11/22/2007, 11:57:38] -  Key not found: HKLM\...\Winlogon\Notify\charaxjy, continuing.
[11/22/2007, 11:57:38] -  BHO 10: {E35565A1-6A52-4BFC-A1A2-24D4B674307C} ()
[11/22/2007, 11:57:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:38] -  Checking for HKLM\...\Winlogon\Notify\sstqo
[11/22/2007, 11:57:38] -  Key not found: HKLM\...\Winlogon\Notify\sstqo, continuing.
[11/22/2007, 11:57:38] -  BHO 11: {FDC61165-B968-4304-848E-CB467BE86241} ()
[11/22/2007, 11:57:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:38] -  Checking for HKLM\...\Winlogon\Notify\ddcyx
[11/22/2007, 11:57:38] -  Key not found: HKLM\...\Winlogon\Notify\ddcyx, continuing.
[11/22/2007, 11:57:38] - Finished Searching Browser Helper Objects
[11/22/2007, 11:57:38] - *** Detected MSEvents Object
[11/22/2007, 11:57:38] - Trying to remove MSEvents Object...
[11/22/2007, 11:57:39] -    Terminating Process: IEXPLORE.EXE
[11/22/2007, 11:57:39] -    Terminating Process: RUNDLL32.EXE
[11/22/2007, 11:57:39] -    Disabling Automatic Shell Restart
[11/22/2007, 11:57:40] -    Terminating Process: EXPLORER.EXE
[11/22/2007, 11:57:40] -    Suspending the NT Session Manager System Service
[11/22/2007, 11:57:40] -    Terminating Windows NT Logon/Logoff Manager
[11/22/2007, 11:57:40] -    Re-enabling Automatic Shell Restart
[11/22/2007, 11:57:40] -   File to disable: C:\WINDOWS\system32\wxsfbxbz.dll
[11/22/2007, 11:57:40] -  Renaming C:\WINDOWS\system32\wxsfbxbz.dll -> C:\WINDOWS\system32\wxsfbxbz.dll.vir
[11/22/2007, 11:57:41] -  File successfully renamed!
[11/22/2007, 11:57:41] -   Removing HKLM\...\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 11:57:41] -   Removing HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 11:57:41] -   Adding Kill Bit for ActiveX for GUID: {A95B2816-1D7E-4561-A202-68C0DE02353A}
[11/22/2007, 11:57:41] -   Deleting ATLEvents/MSEvents Registry entries
[11/22/2007, 11:57:41] -   Removing HKLM\...\Winlogon\Notify\wxsfbxbz
[11/22/2007, 11:57:42] - Searching for Browser Helper Objects:
[11/22/2007, 11:57:42] -  BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/22/2007, 11:57:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:42] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[11/22/2007, 11:57:42] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[11/22/2007, 11:57:42] -  BHO 2: {63525a76-3740-4dce-8d9f-57a9cd20c7d1} ()
[11/22/2007, 11:57:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:42] -  Checking for HKLM\...\Winlogon\Notify\ltmpctxf
[11/22/2007, 11:57:42] -  Key not found: HKLM\...\Winlogon\Notify\ltmpctxf, continuing.
[11/22/2007, 11:57:42] -  BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/22/2007, 11:57:42] -  BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/22/2007, 11:57:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:42] -  No filename found. Continuing.
[11/22/2007, 11:57:42] -  BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/22/2007, 11:57:43] -  BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/22/2007, 11:57:43] -  BHO 7: {C0A70477-A576-4A9F-AE6C-5AE3072A5629} ()
[11/22/2007, 11:57:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:43] -  Checking for HKLM\...\Winlogon\Notify\mlljj
[11/22/2007, 11:57:43] -  Key not found: HKLM\...\Winlogon\Notify\mlljj, continuing.
[11/22/2007, 11:57:43] -  BHO 8: {d0a5375d-d6a5-4cff-abf0-cd9b4e517736} ()
[11/22/2007, 11:57:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:43] -  Checking for HKLM\...\Winlogon\Notify\charaxjy
[11/22/2007, 11:57:43] -  Key not found: HKLM\...\Winlogon\Notify\charaxjy, continuing.
[11/22/2007, 11:57:43] -  BHO 9: {E35565A1-6A52-4BFC-A1A2-24D4B674307C} ()
[11/22/2007, 11:57:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:43] -  Checking for HKLM\...\Winlogon\Notify\sstqo
[11/22/2007, 11:57:43] -  Key not found: HKLM\...\Winlogon\Notify\sstqo, continuing.
[11/22/2007, 11:57:43] -  BHO 10: {FDC61165-B968-4304-848E-CB467BE86241} ()
[11/22/2007, 11:57:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/22/2007, 11:57:43] -  Checking for HKLM\...\Winlogon\Notify\ddcyx
[11/22/2007, 11:57:43] -  Key not found: HKLM\...\Winlogon\Notify\ddcyx, continuing.
[11/22/2007, 11:57:44] - Finished Searching Browser Helper Objects
[11/22/2007, 11:57:44] - Finishing up...
[11/22/2007, 11:57:44] - A restart is needed.
[11/22/2007, 11:57:55] - Attempting to Restart via STOP error (Blue Screen!)

axonais · Answer

je n'ai laissé que CCleaner que j'avais déjà depuis plusieurs mois...

voici le rapport:
-->- Recherche: 

C:\Vundofix backups: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !


Fichiers temporaires nettoyés !
Corbeille vidée!
Point de restauration crée !
---------------------------------
-->- Suppression: 
C:\Vundofix backups: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

PS  l'adresse pour télécharger toolscleaner a changé, c'est maintenant: 
http://pagesperso-orange.fr/AceRothstein/changelog/ChangelogTC.html

axonais · Answer

est-ce que je dois relancer Combofix? puis refaire la procédure (enlever et nettoyer avec toolscleaner)? pour l'instant je ne l'avais fait qu'une fois et peit-être pas juqu'au bout...

axonais · Answer

je crois que je viens de comprendre pourquoi le rapport de hijackthis renommé abcde n'était pas le bon: je n'avais pas renommé l'application elle même, dans le dossier programfiles

voilà maintenant le nouveau rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:51, on 2007-11-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\USB Card RW\shwicon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\smtsvc.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\SpamPal\spampal.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Trend Micro\HijackThis\abcde.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {34A959E2-F811-42C3-AD98-1FEB6DB71CF0} - C:\WINDOWS\system32\sstqo.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {1d7c02dc-9a75-f9d8-ecd4-047367a52536} - {63525a76-3740-4dce-8d9f-57a9cd20c7d1} - C:\WINDOWS\system32\ltmpctxf.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C0A70477-A576-4A9F-AE6C-5AE3072A5629} - C:\WINDOWS\system32\mlljj.dll (file missing)
O2 - BHO: (no name) - {d0a5375d-d6a5-4cff-abf0-cd9b4e517736} - C:\WINDOWS\system32\charaxjy.dll (file missing)
O2 - BHO: (no name) - {FDC61165-B968-4304-848E-CB467BE86241} - C:\WINDOWS\system32\ddcyx.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\wxsfbxbz.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShowIcon_KingByte_USB Card RW v1.14e045] "C:\Program Files\USB Card RW\shwicon.exe" -t"KingByte\USB Card RW v1.14e045"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OmniPage] C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [System Terminal Storage] smtsvc.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [e838bfc1] rundll32.exe "C:\WINDOWS\system32\ylyluxac.dll",b
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B0A451A6-A5A6-11D4-A790-0010A4E6086F} (GettyFinder2 Control) - file://D:\activex\GettyFinder2.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00C2198.dat
O23 - Service: Service de la passerelle de la couche Application (ALG) - Unknown owner - cmd.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

axonais · Answer

j'ai oublié de poster le dernier rapport hijacksthids il me semble...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:36:36, on 22/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\USB Card RW\shwicon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\WINDOWS\system32\smtsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\SpamPal\spampal.exe
C:\Program Files\Trend Micro\HijackThis\abcde.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: {1d7c02dc-9a75-f9d8-ecd4-047367a52536} - {63525a76-3740-4dce-8d9f-57a9cd20c7d1} - C:\WINDOWS\system32\ltmpctxf.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShowIcon_KingByte_USB Card RW v1.14e045] "C:\Program Files\USB Card RW\shwicon.exe" -t"KingByte\USB Card RW v1.14e045"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OmniPage] C:\PROGRA~1\Caere\OMNIPA~1.0\opware32.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB002" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [System Terminal Storage] smtsvc.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [e838bfc1] rundll32.exe "C:\WINDOWS\system32\ylyluxac.dll",b
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab
O16 - DPF: {B0A451A6-A5A6-11D4-A790-0010A4E6086F} (GettyFinder2 Control) - file://D:\activex\GettyFinder2.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} (Setup Class) - http://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/chuzzle/popcaploader_v6.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
End of file - 11688 bytes


j'espere que cette fois c'est mieux nettoyé!!!

apres j'ai fini avec tools cleaner

pour l'instant ça a l'air de tenir mais d'apres ce que j'ai vu sur le forum, je dois peut-être me mefier de:
O2 - BHO: {1d7c02dc-9a75-f9d8-ecd4-047367a52536} - {63525a76-3740-4dce-8d9f-57a9cd20c7d1} - C:\WINDOWS\system32\ltmpctxf.dll


ou une autre menace bien cachée?

@ bientôt...

moi29 · Answer

bonsoir non ton log es propre je ne vois plus rien .... mais tu peus attendre un autre avis si tu veus 
bonne soirée

^^Marie^^ · Answer

Salut

Ce n'est pas fini

Installe JAVA
https://www.java.com/fr/download/manual.jsp

Les mises à jour Java ne sont pas des mises à jour de confort ; ce sont des mises à jour de SÉCURITÉ . 

Tu me refais un log Hijacthis
Et on Supprimeras des programmes inutiles au démarrage.

A++

^^Marie^^ · Answer

Re

Installe un pare feu

télécharger la version gratuite de Kerio  
Kerio (parefeu) 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html 
TUTO
https://kerio.probb.fr/t250-tuto-sunbelt-personal-firewall-4-6  
SITE de Kerio
https://kerio.probb.fr/



1/ Télécharge et installe CCleaner 

http://www.clubic.com/lancer-le-telechargement-20932-0-ccleaner-crap-cleaner-.html

 2/ Télécharge AVG 
https://www.avg.com/en-ww/free-antivirus-download
Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. 
Tu fermes
 
3/ Redémarre en mode sans échec
 (Pour cela : démarrer le PC en tapotant sur la touche F8 du clavier
 jusqu'à ce que le menu des options avancées de Windows apparaisse 
puis avec les touches fléchées du clavier, sélectionner Mode sans échec 
puis appuyer sur la touche Entrée...) 
Attention tu n'as pas accès à Internet dans ce mode donc note ou imprime les consignes qui suivent. 
 
4/ Lance HijackThis 

puis --> Do a system scan only 
coche les lignes indiquées ci-dessous 
puis --> Fix checked 
puis oui à la question de confirmation

O2 - BHO: {1d7c02dc-9a75-f9d8-ecd4-047367a52536} - {63525a76-3740-4dce-8d9f-57a9cd20c7d1} - C:\WINDOWS\system32\ltmpctxf.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShowIcon_KingByte_USB Card RW v1.14e045] "C:\Program Files\USB Card RW\shwicon.exe" -t"KingByte\USB Card RW v1.14e045"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [e838bfc1] rundll32.exe "C:\WINDOWS\system32\ylyluxac.dll",b
O4 - Global Startup: BTTray.lnk = ?

7/ Lance CCleaner puis bouton Analyse ensuite
 Bouton Lancer le Nettoyage 

8/ Lance AVG
Lance AVG Anti-Spyware 
Clique sur le bouton Analyse (de la barre d'outils) 
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. 
Reviens à l'onglet Analyse. Clique sur Analyse complète du système. 
/!\ Si un fichier est infecté en fin d'analyse /!\
choisis l'option " Appliquer toutes les actions " en bas. 
Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous" 
Enregistre ce fichier texte sur ton bureau.
Copie/colle le rapport 



9/ Redémarre normalement et poste un nouveau rapport HijackThis. 
 
as-tu encore des dysfonctionnements ?

^^Marie^^ · Answer

Ok

Supprime TOUS les logiciels que je t'ai ait installer

Tu finiras le nettoyage avec Tool

·	Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.

http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
·	Clique sur Recherche et laisse le scan se terminer.
·	Clique, sur Suppression pour finaliser.
·	Tu peux, si tu le souhaites, te servir des Options facultatives.
·	Clique sur Quitter, pour que le rapport puisse se créer.
·	Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

On attend 1/2 jour pour conclure

A++ 
Bonne route

Win32.trojandownloader.zlob?

29 réponses

Discussions similaires