Infection de spyware ou adware

nseb59 Messages postés 4 Date d'inscription   Statut Membre -  
 nseb59 -
Bonjour,

J'ai un gros probleme g une barre qui viens se mettre en haut de mes pages internet et qui dis:

Warning: possible spyware or adware infection! Click here to scan your computer for spyware and adware...

de plus les pages que j'ouvre se voit recouverte de pub ayant 1 caractere sexuelle

et j'ai 1 barre qui est venue s'ajouter en haut de internet explorer avec des onglet: remove popups scan spyware security test spam protection
ces onglets sont referncer sous le nom emotigt
j'ai essayer de les supprimer avec des logiciels comme avg antispyware ou spyware doctor .
c deux logiciels me trouvent des infections je les supprime mais elle revienne toujours .

svp quelqu'un peut-il m'aider?

merci
Configuration: Windows XP
Internet Explorer 7.0

7 réponses

  1.
    NeoTux Messages postés 3352 Statut Membre 774
     
    Télécharge SmitFraudFix
    Guide d'utilisation : http://mickael.barroux.free.fr/securite/smitfraudfix.php

    selon l antivirus que tu utilise il peut etre detecté comme virus !!!
    dans ce cas la desactive le pendant le telechargement et le scan!!!!

    Double clic sur SmitfraudFix.exe pour le lancer
    Choisis l'option 1 (Recherche)
    Poste le rapport ;)
    0
    1. nseb59 Messages postés 4 Date d'inscription   Statut Membre
       
      Salut NeoTux
      merci de m'aider

      voila le rapport:
      ComboFix 08-02-23.2 - seb 2008-02-23 17:48:09.1 - NTFSx86 MINIMAL
      Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1712 [GMT 1:00]
      Endroit: C:\Documents and Settings\seb\Bureau\ComboFix.exe

      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
      C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
      C:\WINDOWS\dat.txt
      C:\WINDOWS\search_res.txt

      ----- BITS: Possible sites infect‚s -----

      hxxp://softworldnetwork.com
      hxxp://onsafepro.com

      .
      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

      .
      -------\nm


      ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-23 to 2008-02-23 ))))))))))))))))))))))))))))))))))))
      .

      2008-02-23 16:50 . 2008-02-23 16:50 <REP> d-------- C:\Documents and Settings\seb\Application Data\Grisoft
      2008-02-23 16:50 . 2008-02-23 16:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
      2008-02-23 16:50 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
      2008-02-23 16:04 . 2008-02-23 16:37 <REP> d-------- C:\Program Files\Spyware Doctor
      2008-02-23 16:04 . 2008-02-23 16:04 <REP> d-------- C:\Documents and Settings\seb\Application Data\PC Tools
      2008-02-23 16:04 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
      2008-02-23 16:04 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
      2008-02-23 16:04 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
      2008-02-23 16:04 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
      2008-02-23 16:03 . 2008-02-23 17:32 <REP> d-------- C:\Program Files\Google
      2008-02-22 21:21 . 2008-02-22 21:21 <REP> d-------- C:\Documents and Settings\seb\Application Data\VirusEffaceur
      2008-02-22 21:20 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
      2008-02-22 21:17 . 2008-02-22 21:17 <REP> d-------- C:\Documents and Settings\seb\Application Data\reparateurdesysteme
      2008-02-22 21:09 . 2008-02-22 21:09 <REP> d-------- C:\Program Files\Fichiers communs\ReparateurDeSysteme
      2008-02-22 21:09 . 2008-02-22 21:09 <REP> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
      2008-02-22 21:09 . 2008-02-22 21:09 <REP> dr------- C:\Documents and Settings\All Users\Application Data\reparateurdesysteme
      2008-02-22 21:08 . 2008-02-22 21:22 260,632 --a------ C:\Documents and Settings\seb\Application Data\setup_fr[1].exe
      2008-02-22 15:13 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
      2008-02-22 15:13 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
      2008-02-22 15:13 . 2008-02-22 15:13 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
      2008-02-22 15:13 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
      2008-02-22 14:35 . 2008-02-20 23:56 315,392 --a------ C:\WINDOWS\dmdvpnslp.dll
      2008-02-22 14:35 . 2008-02-20 23:56 262,144 --a------ C:\WINDOWS\admgcx.dll
      2008-02-22 14:35 . 2008-02-20 23:56 217,088 --a------ C:\WINDOWS\emotigt.dll
      2008-02-22 14:35 . 2008-02-20 23:56 90,112 --a------ C:\WINDOWS\fsxloqf.exe
      2008-02-22 14:28 . 2008-02-22 15:13 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
      2008-02-22 14:28 . 2008-02-22 15:13 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
      2008-02-22 14:28 . 2008-02-22 15:13 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
      2008-02-22 14:28 . 2008-02-22 15:13 22,328 --a------ C:\Documents and Settings\seb\Application Data\PnkBstrK.sys
      2008-02-22 14:28 . 2008-02-22 14:28 283 --a------ C:\WINDOWS\game.ini
      2008-02-22 14:20 . 2008-02-22 14:20 <REP> d--hs---- C:\WINDOWS\ftpcache
      2008-02-21 09:59 . 2008-02-23 17:51 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
      2008-02-16 11:44 . 2008-02-16 11:47 <REP> d-------- C:\Program Files\GameSpy Arcade
      2008-01-24 21:14 . 2008-01-24 21:14 <REP> d-------- C:\Documents and Settings\seb\Application Data\Yahoo!

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-02-23 09:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI MMC
      2008-02-22 13:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-02-17 11:28 --------- d-----w C:\Program Files\Fichiers communs\Adobe
      2008-02-16 15:59 --------- d-----w C:\Documents and Settings\seb\Application Data\Hamachi
      2008-02-08 08:47 --------- d-----w C:\Program Files\DAEMON Tools Pro
      2008-02-02 11:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
      2008-01-16 13:03 --------- d-----w C:\Program Files\Overland
      2008-01-13 10:28 --------- d-----w C:\Program Files\Java
      2008-01-13 10:27 --------- d-----w C:\Program Files\Fichiers communs\Java
      2008-01-12 14:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Media Center Programs
      2008-01-10 13:47 --------- d-----w C:\Documents and Settings\seb\Application Data\InfraRecorder
      2008-01-08 10:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
      2008-01-08 10:15 --------- d-----w C:\Program Files\Alwil Software
      2007-12-22 19:31 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
      2007-12-15 11:38 315,392 ----a-w C:\WINDOWS\HideWin.exe
      2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
      2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
      2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
      2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
      .

      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FFDE480-14C1-43FC-BEC1-CA97A2541FFD}]
      2008-02-20 23:56 315392 --a------ C:\WINDOWS\dmdvpnslp.dll

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      {EF99BD32-C1FB-11D2-892F-0090271D4F88}
      {54BECB1C-D4EA-47B2-9B56-C6768144FDD5}

      [HKEY_CLASSES_ROOT\clsid\{54becb1c-d4ea-47b2-9b56-c6768144fdd5}]
      [HKEY_CLASSES_ROOT\emotigt.1]
      [HKEY_CLASSES_ROOT\TypeLib\{9DE85731-AF00-4D62-875B-B2433266915F}]
      [HKEY_CLASSES_ROOT\emotigt]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ATI Launchpad"="" []
      "ATI DeviceDetect"="C:\Program Files\ATI Multimedia\main\ATIDtct.EXE" [2005-08-01 21:41 53248]
      "ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2005-05-10 16:21 1482752]
      "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
      "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
      "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-27 21:00 344064]
      "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-07-27 23:23 32768]
      "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-12-05 00:44 176128]
      "HPHUPD05"="C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe" [2003-11-12 23:12 49152]
      "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
      "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2003-12-05 15:41 49152]
      "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2004-02-02 20:43 495616]
      "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
      "bm"="C:\Program Files\Fichiers communs\VirusEffaceur\bm.exe" [ ]
      "ptask"="C:\Program Files\VirusEffaceur\ptask.exe" [ ]
      "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]
      "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
      "DisableRegistryTools"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      "bdmanager"= {0CB130CC-334E-498B-A8C6-719EA6AC8C98} - C:\WINDOWS\bdmanager.dll [ ]
      "admgcx"= {D8204016-D783-4478-91ED-49DF55375880} - C:\WINDOWS\admgcx.dll [2008-02-20 23:56 262144]

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exe:@xpsp2res.dll,-22019
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"= %windir%\\Network Diagnostic\\xpnetdiag.exe:@xpsp3res.dll,-20000
      "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
      "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
      "C:\\Program Files\\Messenger\\msmsgs.exe"=
      "C:\\Documents and Settings\\seb\\Local Settings\\Temp\\ElectronicArts_Patcher_000.exe"=
      "D:\\Games\\Command & Conquer 3\\RetailExe\\1.2\\cnc3game.dat"=
      "D:\\Games\\suprem commander\\GPGNet\\GPG.Multiplayer.Client.exe"=
      "D:\\Games\\suprem comander\\Supreme Commander\\bin\\SupremeCommander.exe"=
      "D:\\Games\\suprem comander\\GPGNet\\GPG.Multiplayer.Client.exe"=
      "D:\\Games\\Civilization 4\\Civilization4.exe"=
      "D:\\Games\\Civilization 4\\Warlords\\Civ4Warlords.exe"=
      "D:\\Games\\Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
      "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
      "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
      "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
      "D:\\Games\\Call of duty 4\\iw3mp.exe"=
      "D:\\Games\\Crysis\\Bin32\\Crysis.exe"=
      "D:\\Games\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=

      S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys []

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c72d800e-aca6-11dc-b96b-001617d51f03}]
      \Shell\AutoRun\command - G:\autorun.exe

      .
      Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
      "2008-02-23 15:55:01 C:\WINDOWS\Tasks\HP Usg Daily.job"
      - C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\pexpress\hphped05.exe
      .
      **************************************************************************

      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-02-23 17:51:21
      Windows 5.1.2600 Service Pack 2 NTFS

      Balayage processus cach‚s ...

      Balayage cach‚ autostart entries ...

      Balayage des fichiers cach‚s ...

      Scan termin‚ avec succŠs
      Les fichiers cach‚s: 0

      **************************************************************************
      .
      ------------------------ Other Running Processes ------------------------
      .
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
      C:\Program Files\Spyware Doctor\pctsAuxs.exe
      C:\Program Files\Spyware Doctor\pctsSvc.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\WINDOWS\system32\imapi.exe
      .
      **************************************************************************
      .
      Temps d'accomplissement: 2008-02-23 17:52:24 - machine was rebooted
      ComboFix-quarantined-files.txt 2008-02-23 16:52:21
      .
      2008-02-13 09:59:06 --- E O F ---
      0
  2. erpilu
     
    Salut,

    Manifestement, tu viens de te faire dévorer par un ou probablement plusieurs spywares, malwares, etc....

    Il te faut télécharger des programmes spécifiques antispywares pour éviter tout ca.
    Un antivirus aussi bon soit-il ne détecte pas les spywares et autres saloperies du meme genre.

    Je te recommande vivement de télécharger (gratuitement) Spybot et ad-aware. Avec ces 2 lá, tu devrais te débarasser de la plupart de ces merdes ambulantes!!!!

    Bon courage

    Erpilu
    0
  3. nseb59 Messages postés 4 Date d'inscription   Statut Membre
     
    Salut NeoTux
    merci de m'aider

    voila le rapport:
    ComboFix 08-02-23.2 - seb 2008-02-23 17:48:09.1 - NTFSx86 MINIMAL
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1712 [GMT 1:00]
    Endroit: C:\Documents and Settings\seb\Bureau\ComboFix.exe

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    C:\WINDOWS\dat.txt
    C:\WINDOWS\search_res.txt

    ----- BITS: Possible sites infect‚s -----

    hxxp://softworldnetwork.com
    hxxp://onsafepro.com

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\nm

    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-23 to 2008-02-23 ))))))))))))))))))))))))))))))))))))
    .

    2008-02-23 16:50 . 2008-02-23 16:50 <REP> d-------- C:\Documents and Settings\seb\Application Data\Grisoft
    2008-02-23 16:50 . 2008-02-23 16:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-02-23 16:50 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-02-23 16:04 . 2008-02-23 16:37 <REP> d-------- C:\Program Files\Spyware Doctor
    2008-02-23 16:04 . 2008-02-23 16:04 <REP> d-------- C:\Documents and Settings\seb\Application Data\PC Tools
    2008-02-23 16:04 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
    2008-02-23 16:04 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
    2008-02-23 16:04 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
    2008-02-23 16:04 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
    2008-02-23 16:03 . 2008-02-23 17:32 <REP> d-------- C:\Program Files\Google
    2008-02-22 21:21 . 2008-02-22 21:21 <REP> d-------- C:\Documents and Settings\seb\Application Data\VirusEffaceur
    2008-02-22 21:20 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
    2008-02-22 21:17 . 2008-02-22 21:17 <REP> d-------- C:\Documents and Settings\seb\Application Data\reparateurdesysteme
    2008-02-22 21:09 . 2008-02-22 21:09 <REP> d-------- C:\Program Files\Fichiers communs\ReparateurDeSysteme
    2008-02-22 21:09 . 2008-02-22 21:09 <REP> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
    2008-02-22 21:09 . 2008-02-22 21:09 <REP> dr------- C:\Documents and Settings\All Users\Application Data\reparateurdesysteme
    2008-02-22 21:08 . 2008-02-22 21:22 260,632 --a------ C:\Documents and Settings\seb\Application Data\setup_fr[1].exe
    2008-02-22 15:13 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
    2008-02-22 15:13 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
    2008-02-22 15:13 . 2008-02-22 15:13 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
    2008-02-22 15:13 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
    2008-02-22 14:35 . 2008-02-20 23:56 315,392 --a------ C:\WINDOWS\dmdvpnslp.dll
    2008-02-22 14:35 . 2008-02-20 23:56 262,144 --a------ C:\WINDOWS\admgcx.dll
    2008-02-22 14:35 . 2008-02-20 23:56 217,088 --a------ C:\WINDOWS\emotigt.dll
    2008-02-22 14:35 . 2008-02-20 23:56 90,112 --a------ C:\WINDOWS\fsxloqf.exe
    2008-02-22 14:28 . 2008-02-22 15:13 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
    2008-02-22 14:28 . 2008-02-22 15:13 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
    2008-02-22 14:28 . 2008-02-22 15:13 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-02-22 14:28 . 2008-02-22 15:13 22,328 --a------ C:\Documents and Settings\seb\Application Data\PnkBstrK.sys
    2008-02-22 14:28 . 2008-02-22 14:28 283 --a------ C:\WINDOWS\game.ini
    2008-02-22 14:20 . 2008-02-22 14:20 <REP> d--hs---- C:\WINDOWS\ftpcache
    2008-02-21 09:59 . 2008-02-23 17:51 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-02-16 11:44 . 2008-02-16 11:47 <REP> d-------- C:\Program Files\GameSpy Arcade
    2008-01-24 21:14 . 2008-01-24 21:14 <REP> d-------- C:\Documents and Settings\seb\Application Data\Yahoo!

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-23 09:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI MMC
    2008-02-22 13:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-17 11:28 --------- d-----w C:\Program Files\Fichiers communs\Adobe
    2008-02-16 15:59 --------- d-----w C:\Documents and Settings\seb\Application Data\Hamachi
    2008-02-08 08:47 --------- d-----w C:\Program Files\DAEMON Tools Pro
    2008-02-02 11:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
    2008-01-16 13:03 --------- d-----w C:\Program Files\Overland
    2008-01-13 10:28 --------- d-----w C:\Program Files\Java
    2008-01-13 10:27 --------- d-----w C:\Program Files\Fichiers communs\Java
    2008-01-12 14:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Media Center Programs
    2008-01-10 13:47 --------- d-----w C:\Documents and Settings\seb\Application Data\InfraRecorder
    2008-01-08 10:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
    2008-01-08 10:15 --------- d-----w C:\Program Files\Alwil Software
    2007-12-22 19:31 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2007-12-15 11:38 315,392 ----a-w C:\WINDOWS\HideWin.exe
    2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
    2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FFDE480-14C1-43FC-BEC1-CA97A2541FFD}]
    2008-02-20 23:56 315392 --a------ C:\WINDOWS\dmdvpnslp.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {EF99BD32-C1FB-11D2-892F-0090271D4F88}
    {54BECB1C-D4EA-47B2-9B56-C6768144FDD5}

    [HKEY_CLASSES_ROOT\clsid\{54becb1c-d4ea-47b2-9b56-c6768144fdd5}]
    [HKEY_CLASSES_ROOT\emotigt.1]
    [HKEY_CLASSES_ROOT\TypeLib\{9DE85731-AF00-4D62-875B-B2433266915F}]
    [HKEY_CLASSES_ROOT\emotigt]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATI Launchpad"="" []
    "ATI DeviceDetect"="C:\Program Files\ATI Multimedia\main\ATIDtct.EXE" [2005-08-01 21:41 53248]
    "ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2005-05-10 16:21 1482752]
    "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
    "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 11:08 16342528 C:\WINDOWS\RTHDCPL.exe]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-07-27 21:00 344064]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-07-27 23:23 32768]
    "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-12-05 00:44 176128]
    "HPHUPD05"="C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe" [2003-11-12 23:12 49152]
    "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
    "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2003-12-05 15:41 49152]
    "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2004-02-02 20:43 495616]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "bm"="C:\Program Files\Fichiers communs\VirusEffaceur\bm.exe" [ ]
    "ptask"="C:\Program Files\VirusEffaceur\ptask.exe" [ ]
    "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]­
    "bdmanager"= {0CB130CC-334E-498B-A8C6-719EA6AC8C98} - C:\WINDOWS\bdmanager.dll [ ]
    "admgcx"= {D8204016-D783-4478-91ED-49DF55375880} - C:\WINDOWS\admgcx.dll [2008-02-20 23:56 262144]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplicat­ions\List]
    "%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exe:@xpsp2res.dll,-22019
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"= %windir%\\Network Diagnostic\\xpnetdiag.exe:@xpsp3res.dll,-20000
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Documents and Settings\\seb\\Local Settings\\Temp\\ElectronicArts_Patcher_000.exe"=
    "D:\\Games\\Command & Conquer 3\\RetailExe\\1.2\\cnc3game.dat"=
    "D:\\Games\\suprem commander\\GPGNet\\GPG.Multiplayer.Client.exe"=
    "D:\\Games\\suprem comander\\Supreme Commander\\bin\\SupremeCommander.exe"=
    "D:\\Games\\suprem comander\\GPGNet\\GPG.Multiplayer.Client.exe"=
    "D:\\Games\\Civilization 4\\Civilization4.exe"=
    "D:\\Games\\Civilization 4\\Warlords\\Civ4Warlords.exe"=
    "D:\\Games\\Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "D:\\Games\\Call of duty 4\\iw3mp.exe"=
    "D:\\Games\\Crysis\\Bin32\\Crysis.exe"=
    "D:\\Games\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=

    S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c72d80­0e-aca6-11dc-b96b-001617d51f03}]
    \Shell\AutoRun\command - G:\autorun.exe

    .
    Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
    "2008-02-23 15:55:01 C:\WINDOWS\Tasks\HP Usg Daily.job"
    - C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\pexpress\hphped05.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-23 17:51:21
    Windows 5.1.2600 Service Pack 2 NTFS

    Balayage processus cach‚s ...

    Balayage cach‚ autostart entries ...

    Balayage des fichiers cach‚s ...

    Scan termin‚ avec succŠs
    Les fichiers cach‚s: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\imapi.exe
    .
    **************************************************************************
    .
    Temps d'accomplissement: 2008-02-23 17:52:24 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-02-23 16:52:21
    .
    2008-02-13 09:59:06 --- E O F ---
    0
  4. NeoTux Messages postés 3352 Statut Membre 774
     
    supprime smitfraudfix

    Télécharge HijackThis :

    --> http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    Tuto: http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm

    Clique alors sur "Do a system scan and save a logfile"
    Le scan se fait très rapidement, puis un bloc-note apparaît
    (le "logfile")

    Dans ce bloc-note, va dans "Edition", puis "Selectionner Tout",
    le texte est alors séléctionné, retourne dans "Edition" toujours
    en laissant le texte séléctionné, et clique sur copier.
    Colle le contenu ici dans ta prochaine réponse
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. nseb59 Messages postés 4 Date d'inscription   Statut Membre
     
    voila le rapport :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 09:48:05, on 24/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\hphmon05.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Spyware Doctor\pctsTray.exe
    C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
    C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Spyware Doctor\pctsAuxs.exe
    C:\Program Files\Spyware Doctor\pctsSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Spyware Doctor\pctsGui.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SXG Advisor - {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} - C:\WINDOWS\dmdvpnslp.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: emotigt - {54BECB1C-D4EA-47B2-9B56-C6768144FDD5} - C:\WINDOWS\emotigt.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [bm] "C:\Program Files\Fichiers communs\VirusEffaceur\bm.exe" dm=http://viruseffaceur.com ad=http://viruseffaceur.com sd=http://gregistre.viruseffaceur.com
    O4 - HKLM\..\Run: [ptask] C:\Program Files\VirusEffaceur\ptask.exe
    O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
    O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
    O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Barre d'état système d'ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7418BC53-83C7-4C44-9CDB-D5DE269D68A3}: NameServer = 212.27.32.176,212.27.32.177
    O17 - HKLM\System\CS1\Services\Tcpip\..\{7418BC53-83C7-4C44-9CDB-D5DE269D68A3}: NameServer = 212.27.32.176,212.27.32.177
    O17 - HKLM\System\CS2\Services\Tcpip\..\{7418BC53-83C7-4C44-9CDB-D5DE269D68A3}: NameServer = 212.27.32.176,212.27.32.177
    O21 - SSODL: bdmanager - {0CB130CC-334E-498B-A8C6-719EA6AC8C98} - C:\WINDOWS\bdmanager.dll (file missing)
    O21 - SSODL: admgcx - {D8204016-D783-4478-91ED-49DF55375880} - C:\WINDOWS\admgcx.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    0
  7. nseb59
     
    bonjour

    j'ai besoin d'aide j'ai plein de spyware

    si quelqu'un pouvais me dire cequ'il faut faire

    j'ai mis le rapport fait avec HijackThis je n'y comprend rien

    si quelqsu'un pouvais m'aider svp

    merci
    0
  8. nseb59
     
    bonjour

    g fé des scan avec antivir et spyware terminator il m'en ont trouvé g tout supprimer
    mais il en reste.

    j'ai toujours cette phrase en haut de ma page internet :
    Warning: possible spyware or adware infection! Click here to scan your computer for spyware and adware...

    et des pubs qui apparaisse

    il y en a moins qu'avant enfin je crois mais il en reste ca ces sur

    j'ai fait un nouveau rapport avec HijackThis

    Il me donne ca si quelqu'un pouvait me dire ce qui ne fonctionne pas

    merci pour votre aide

    voici le rapport:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:26:51, on 25/02/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\hphmon05.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
    C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
    C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Spyware Terminator\sp_rsser.exe
    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SXG Advisor - {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} - C:\WINDOWS\dmdvpnslp.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
    O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
    O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Barre d'état système d'ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7418BC53-83C7-4C44-9CDB-D5DE269D68A3}: NameServer = 212.27.32.176,212.27.32.177
    O17 - HKLM\System\CS1\Services\Tcpip\..\{7418BC53-83C7-4C44-9CDB-D5DE269D68A3}: NameServer = 212.27.32.176,212.27.32.177
    O17 - HKLM\System\CS2\Services\Tcpip\..\{7418BC53-83C7-4C44-9CDB-D5DE269D68A3}: NameServer = 212.27.32.176,212.27.32.177
    O21 - SSODL: bdmanager - {0CB130CC-334E-498B-A8C6-719EA6AC8C98} - C:\WINDOWS\bdmanager.dll (file missing)
    O21 - SSODL: admgcx - {D8204016-D783-4478-91ED-49DF55375880} - C:\WINDOWS\admgcx.dll
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
    0

Discussions similaires

adware.pokki
SuperFun -
SuperFun -

9 réponses
desinstaller pokki
Bowze -
Bowze -

2 réponses