TrojanDowloader XS

Résolu

richou57 Messages postés 7 Statut Membre -
mannigan Messages postés 12 Statut Membre - 25 sept. 2008 à 11:37

Bonjour

Je suis confronté à "TrojanDowloader XS" , j'arrive pas a m'en défaire....

Je vous transmet le rapport d'analyse de FixWareout.
Quelle est la suite des opérations ??
Merci de donner les conseils en langage clair et accessible car je ne maîtrise pas bien les termes des solutions utilisés dans ce forum d'echanges .

Mon ordi : Windows XP intel inside pentium 4

A bientôt Richou57

01/04/2008 11:35:42 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.

System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"SiS KHooker"="C:\\WINDOWS\\System32\\khooker.exe"
"SiSUSBRG"="C:\\WINDOWS\\sisUSBrg.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"Synchronization Manager"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,\
73,74,65,6d,33,32,5c,6d,6f,62,73,79,6e,63,2e,65,78,65,20,2f,6c,6f,67,6f,6e,\
00
"LogitechGalleryRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe"
"WOOWATCH"="C:\\PROGRA~1\\Wanadoo\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\Wanadoo\\GestMaj.exe TaskBarIcon.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe\""
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"WinampAgent"="\"C:\\Program Files\\Winamp\\winampa.exe\""
"ISUSPM"="\"C:\\Program Files\\Fichiers communs\\InstallShield\\UpdateService\\ISUSPM.exe\" -scheduler"
"yvunqhib"="regsvr32 /u \"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\yvunqhib.dll\""
"ctfmona"="C:\\WINDOWS\\system32\\ctfmona.exe"
"WinIFixer"="C:\\Program Files\\WinIFixer\\WinIFixer.exe"
"SpyMaxx"="C:\\Program Files\\SpyMaxx\\SpyMaxx.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"=hex(1):33,08,92,7c,6c,e4,12,00,5c,00,57,00,\
6b,00,44,00,65,00,74,00,65,00,63,00,74,00,2e,00,65,00,78,00,65,00
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Felix"="C:\\Program Files\\ScreenMates\\Felix.exe"
"WOOKIT"="C:\\PROGRA~1\\Wanadoo\\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM="
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_9"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Configuration: Windows XP
Internet Explorer 7.0

Afficher la suite

9 réponses

Réponse 1 / 9
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041

slt,

colle un rapport hijackthis

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :
http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

_______________

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
0
1. richou57 Messages postés 7 Statut Membre
  
  Salut jlpjlp,
  
  merci pour ta réponse rapide , je te joins le rapport demandé richou
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 14:07:46, on 01/04/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Ahead\InCD\InCDsrv.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\sbwltbxa.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\System32\CbEvtSvc.exe
  C:\WINDOWS\system32\cisvc.exe
  C:\WINDOWS\System32\FTRTSVC.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\System32\tcpsvcs.exe
  C:\WINDOWS\System32\snmp.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\system32\cidaemon.exe
  C:\WINDOWS\system32\notepad.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Ahead\InCD\InCD.exe
  C:\WINDOWS\System32\khooker.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
  C:\WINDOWS\system32\regsvr32.exe
  C:\WINDOWS\system32\ctfmona.exe
  C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
  C:\PROGRA~1\Wanadoo\ComComp.exe
  C:\PROGRA~1\Wanadoo\Toaster.exe
  C:\PROGRA~1\Wanadoo\Inactivity.exe
  C:\PROGRA~1\Wanadoo\PollingModule.exe
  C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
  C:\PROGRA~1\Wanadoo\Watch.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Documents and Settings\Richard SZYNKOLEWSKI\Favoris\Mes documents\HiJackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7180
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
  R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
  R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sbwltbxa.exe,
  O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
  O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
  O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
  O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
  O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
  O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
  O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
  O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
  O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
  O2 - BHO: (no name) - {6edee3b8-1dd2-11b2-9859-d1277bc576ea} - C:\WINDOWS\fgdupkvs.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
  O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
  O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
  O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
  O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
  O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
  O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
  O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
  O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
  O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
  O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
  O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
  O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -scheduler
  O4 - HKLM\..\Run: [yvunqhib] regsvr32 /u "C:\Documents and Settings\All Users.WINDOWS\Application Data\yvunqhib.dll"
  O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe
  O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe
  O4 - HKLM\..\Run: [SpyMaxx] C:\Program Files\SpyMaxx\SpyMaxx.exe
  O4 - HKCU\..\Run: [Microsoft Works Update Detection] ???\WkDetect.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Felix] C:\Program Files\ScreenMates\Felix.exe
  O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
  O4 - Startup: .protected
  O4 - Global Startup: .protected
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\DOCUME~1\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - (no file)
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
  O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
  O16 - DPF: {1B3E3251-658E-4F03-8881-68302FE3CE9E} - http://www.friend.fr/friend/FLight2005-01.xms
  O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.fr.aol.com/molbin/shared/mcinsctl/fr/4,0,0,84/mcinsctl.cab
  O16 - DPF: {5CA8D349-C6E7-11D4-8166-009027DF3BB2} (France Telecom MDDK ActiveX Control) - http://accueil.ava.serveur-ava.com/stkid_data/ocx/mDKid.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
  O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://charon777.free.fr/plugins/hardwaredetection_2_0_4_10.cab
  O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.fr.aol.com/molbin/shared/mcgdmgr/fr/1,0,0,21/mcgdmgr.cab
  O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
  O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
  O23 - Service: CbEvtSvc - Unknown owner - C:\WINDOWS\System32\CbEvtSvc.exe
  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  O24 - Desktop Component 0: (no name) - file:///C:/Program%20Files/MUSICMATCH/MUSICMATCH%20Jukebox/Html/guidelogo.gif
  
  0
Réponse 2 / 9
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041

ok tu es gavé d'infections!!! je sais pas ce que tu fais avec ton ordi!

_______________

desisntalle si present via ton panneau de configuration:

Share Accelerator MM Toolbar

__________________

fais combofix comme déjà demandé

__________________

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

-------------------------------------

scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

______________________
recolle un nouveau rapport hijackthis
0
1. richou57 Messages postés 7 Statut Membre
  
  slt jlpjlp
  
  Je me suis absenté toute l'après-midi....suite avec le rapport combofix @plus Richou
  
  ComboFix 08-04-01.2 - Richard SZYNKOLEWSKI 2008-04-02 0:09:39.1 - NTFSx86
  Endroit: C:\Documents and Settings\Richard SZYNKOLEWSKI\Local Settings\Temporary Internet Files\Content.IE5\DWK6548K\ComboFix[1].exe
  * Création d'un nouveau point de restauration
  
  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
  .
  
  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\.protected
  C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\.protected
  C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\SystemDoctor 2006 Free
  C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\SystemDoctor 2006 Free\Logs\update.log
  C:\Documents and Settings\Richard SZYNKOLEWSKI\Menu Démarrer\Programmes\Démarrage\.protected
  C:\Program Files\seekmo
  C:\Program Files\seekmo\seekmohook.dll
  C:\WINDOWS\.protected
  C:\WINDOWS\180ax.exe
  C:\WINDOWS\2020search.dll
  C:\WINDOWS\2020search2.dll
  C:\WINDOWS\bjam.dll
  C:\WINDOWS\bokja.exe
  C:\WINDOWS\cdsm32.dll
  C:\WINDOWS\default.htm
  C:\WINDOWS\mspphe.dll
  C:\WINDOWS\mssvr.exe
  C:\WINDOWS\PerfInfo
  C:\WINDOWS\PerfInfo\7O9XBXYCrJwp.exe
  C:\WINDOWS\saiemod.dll
  C:\WINDOWS\salm.exe
  C:\WINDOWS\stcloader.exe
  C:\WINDOWS\swin32.dll
  C:\WINDOWS\system32\B.tmp
  C:\WINDOWS\system32\ctfmona.exe
  C:\WINDOWS\system32\drivers\etc\.protected
  C:\WINDOWS\system32\kernel.dll
  C:\WINDOWS\system32\msixu.dll
  C:\WINDOWS\system32\wer8274.dll
  C:\WINDOWS\system32\winfrun32.bin
  C:\WINDOWS\TEMP\salm.exe
  C:\WINDOWS\tmlpcert2007
  C:\WINDOWS\updatetc.exe
  C:\WINDOWS\voiceip.dll
  
  .
  ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  -------\Legacy_IPRIP
  -------\Service_grande48
  -------\Service_Iprip
  
  ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-01 to 2008-04-01 ))))))))))))))))))))))))))))))))))))
  .
  
  2008-04-02 00:27 . 2008-04-02 00:27 30,208 --a------ C:\WINDOWS\updatetc.exe
  2008-04-02 00:27 . 2008-04-02 00:27 13,824 --a------ C:\WINDOWS\saiemod.dll
  2008-04-02 00:17 . 2008-04-02 00:28 <REP> d-------- C:\Program Files\seekmo
  2008-04-01 23:54 . 2008-04-02 00:01 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
  2008-04-01 23:44 . 2008-04-01 23:44 <REP> d-------- C:\Program Files\Trend Micro
  2008-04-01 11:23 . 2008-04-01 11:23 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
  2008-04-01 11:06 . 2008-04-01 11:06 <REP> d-------- C:\Program Files\Yahoo!
  2008-04-01 11:06 . 2008-04-01 11:07 <REP> d-------- C:\Program Files\CCleaner
  2008-04-01 10:18 . 2008-04-01 11:49 <REP> d----c--- C:\fixwareout
  2008-03-31 23:38 . 2008-03-31 23:38 12,288 --a------ C:\WINDOWS\123messenger.per
  2008-03-31 23:09 . 2008-03-31 23:09 <REP> d-------- C:\Program Files\180solutions
  2008-03-31 20:52 . 2008-03-31 20:52 22,016 --a------ C:\WINDOWS\browserad.dll
  2008-03-31 20:26 . 2008-03-31 20:26 16,896 --a------ C:\WINDOWS\ati2dvag32.dll
  2008-03-31 19:17 . 2008-03-31 19:17 30,976 --a------ C:\WINDOWS\system32\shdocpe.dll
  2008-03-31 19:17 . 2008-03-31 19:17 13,056 --a------ C:\WINDOWS\shdocpe.dll
  2008-03-31 19:08 . 2008-03-31 19:08 90,540 --a------ C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\1093742217.exe
  2008-03-31 11:27 . 2008-03-31 11:27 31,232 --a------ C:\WINDOWS\avisynthex32.dll
  2008-03-31 11:27 . 2008-03-31 11:27 23,296 --a------ C:\WINDOWS\shdocpl.dll
  2008-03-31 10:46 . 2008-03-31 10:46 90,540 --a------ C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\1092693577.exe
  2008-03-30 21:01 . 2008-03-30 21:17 <REP> d-------- C:\Program Files\Win_Performance
  2008-03-30 19:41 . 2008-03-30 19:41 <REP> d-------- C:\Program Files\180searchassistant
  2008-03-30 19:41 . 2008-03-30 19:41 <REP> d-------- C:\Program Files\180search assistant
  2008-03-30 18:12 . 2008-03-30 18:12 <REP> d-------- C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com
  2008-03-30 18:11 . 2008-04-01 11:50 269,334 --a------ C:\WINDOWS\system32\ctfmonb.bmp
  2008-03-30 18:11 . 2008-04-01 23:51 160,256 --a------ C:\WINDOWS\system32\blackster.scr
  2008-03-29 23:39 . 2008-03-29 23:39 <REP> d-------- C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\XPdefender
  2008-03-29 23:32 . 2008-03-29 23:32 <REP> d-------- C:\Program Files\zango
  2008-03-29 23:32 . 2008-03-29 23:32 <REP> d-------- C:\Program Files\stc
  2008-03-29 23:31 . 2008-03-29 23:31 <REP> d-------- C:\Program Files\Sysmnt
  2008-03-29 23:19 . 2008-03-29 23:19 90,540 --a------ C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\1092169257.exe
  2008-03-29 23:17 . 2008-03-29 23:17 3,806,230 --a------ C:\WINDOWS\7O9XBXYCrJ.exe
  2008-03-29 23:16 . 2008-03-29 23:16 <REP> dr------- C:\Documents and Settings\LocalService.AUTORITE NT.000\Favoris
  2008-03-29 23:15 . 2008-03-29 23:15 <REP> d-------- C:\WINDOWS\cjenomsb
  2008-03-29 23:15 . 2008-03-29 23:15 180,736 --a------ C:\WINDOWS\lmlkbmzu.dll
  2008-03-29 23:15 . 2008-03-30 19:14 151,552 --a------ C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\951192718.exe
  2008-03-29 23:15 . 2008-03-29 23:15 90,541 --a------ C:\WINDOWS\uzqvibqt.exe
  2008-03-29 23:15 . 2008-03-29 23:15 90,541 --a------ C:\WINDOWS\system32\sbwltbxa.exe
  2008-03-29 23:15 . 2008-03-29 23:15 61,440 --a------ C:\WINDOWS\fgdupkvs.dll
  2008-03-29 23:15 . 2008-03-29 23:15 61,440 --a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\yvunqhib.dll
  2008-03-29 23:00 . 2008-03-29 23:00 62,976 --a------ C:\WINDOWS\system32\CbEvtSvc.exe
  2008-03-26 23:04 . 2008-03-26 23:04 <REP> d-------- C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\AVS4YOU
  2008-03-26 23:02 . 2008-03-26 23:02 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVS4YOU
  2008-03-26 22:59 . 2008-03-30 21:14 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
  2008-03-26 22:58 . 2008-03-30 21:14 <REP> d-------- C:\Program Files\AVS4YOU
  2008-03-26 22:58 . 2007-02-27 20:36 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
  2008-03-26 22:58 . 2007-02-27 20:36 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
  2008-03-26 22:58 . 2007-02-27 20:36 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll
  2008-03-26 22:58 . 2007-02-27 20:36 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
  2008-03-26 22:58 . 2007-02-27 20:36 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
  2008-03-26 22:58 . 2007-02-27 20:36 82,944 --a------ C:\WINDOWS\system32\vct3216.acm
  2008-03-26 22:58 . 2007-02-27 20:36 53,248 --a------ C:\WINDOWS\system32\xvid.ax
  2008-03-26 22:58 . 2007-02-27 20:36 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm
  2008-03-26 22:58 . 2007-02-27 20:36 13,239 --a------ C:\WINDOWS\system32\Scg726.acm
  2008-03-26 00:54 . 2008-03-26 00:54 <REP> d-------- C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\vlc
  2008-03-26 00:48 . 2008-03-26 00:48 <REP> d-------- C:\Program Files\VideoLAN
  2008-03-25 13:17 . 2008-03-25 13:17 <REP> d-------- C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\InterVideo
  2008-03-25 13:11 . 2008-03-27 15:21 <REP> d-------- C:\Program Files\QuickTime
  2008-03-25 13:02 . 2008-03-25 13:02 <REP> d-------- C:\Program Files\Fichiers communs\Ulead
  2008-03-25 13:02 . 2006-05-11 19:41 654 --------- C:\WINDOWS\remove.iss
  2008-03-25 13:01 . 2008-03-25 13:01 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallShield
  2008-03-25 10:52 . 2008-03-25 10:52 14 --a------ C:\WINDOWS\system32\SystemInfo32.sys
  2008-03-25 10:45 . 2008-03-25 10:45 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\DVD X Studios
  2008-03-24 23:38 . 2008-03-24 23:38 <REP> d-------- C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\Media Player Classic
  2008-03-24 19:13 . 2008-03-24 20:12 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar
  2008-03-24 19:04 . 2008-03-24 23:48 <REP> d-------- C:\Program Files\Winamp
  2008-03-19 20:33 . 2008-04-02 00:21 <REP> d-------- C:\Program Files\Share_Accelerator_MM
  2008-03-19 20:33 . 2004-02-17 01:00 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll
  2008-03-19 20:32 . 2008-03-19 21:11 <REP> d-------- C:\Program Files\Zapu
  2008-03-19 17:25 . 2008-03-30 18:58 <REP> d-------- C:\Program Files\Google
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-04-01 22:28 --------- d-----w C:\Program Files\Wanadoo
  2008-04-01 22:18 28,160 ----a-w C:\WINDOWS\bokja.exe
  2008-04-01 22:18 23,552 ----a-w C:\WINDOWS\stcloader.exe
  2008-04-01 22:18 21,760 ----a-w C:\WINDOWS\voiceip.dll
  2008-04-01 22:18 19,968 ----a-w C:\WINDOWS\cdsm32.dll
  2008-04-01 22:18 13,056 ----a-w C:\WINDOWS\swin32.dll
  2008-04-01 22:17 28,160 ----a-w C:\WINDOWS\2020search2.dll
  2008-04-01 22:17 25,600 ----a-w C:\WINDOWS\180ax.exe
  2008-04-01 22:17 22,272 ----a-w C:\WINDOWS\2020search.dll
  2008-04-01 22:17 22,016 ----a-w C:\WINDOWS\bjam.dll
  2008-04-01 22:17 17,152 ----a-w C:\WINDOWS\mspphe.dll
  2008-04-01 22:17 15,104 ----a-w C:\WINDOWS\salm.exe
  2008-04-01 22:17 12,288 ----a-w C:\WINDOWS\mssvr.exe
  2008-04-01 22:01 --------- d-----w C:\Program Files\Hijackthis Version Française
  2008-03-25 22:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
  2008-03-25 11:11 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
  2008-03-25 10:52 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
  2008-03-24 16:27 --------- d-----w C:\Program Files\eMule
  2008-03-22 07:30 --------- d-----w C:\Program Files\Fichiers communs\Adobe
  2008-03-15 21:57 --------- d-----w C:\Program Files\Java
  2008-03-09 12:17 --------- d-----w C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\Apple Computer
  2008-02-28 13:33 --------- d-----w C:\Program Files\Fichiers communs\Java
  2008-02-28 13:24 107,132 ----a-w C:\WINDOWS\UninstallFirefox.exe
  2008-02-15 07:51 --------- d-----w C:\Program Files\MSN Messenger
  2008-02-01 23:07 --------- d-----w C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\Skype
  2006-02-17 22:53 13,590 -c--a-w C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\wklnhst.dat
  2004-12-18 19:56 57,264 -c--a-w C:\Documents and Settings\Richard SZYNKOLEWSKI\Application Data\GDIPFONTCACHEV1.DAT
  2004-05-18 19:46 181 -c-ha-w C:\Documents and Settings\NetworkService.AUTORITE NT\hpothb07.dat
  2004-05-18 19:46 179 -c-ha-w C:\Documents and Settings\LocalService.AUTORITE NT\hpothb07.dat
  2004-05-18 19:46 169 -c-ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
  2004-05-18 19:46 167 -c-ha-w C:\Documents and Settings\LocalService\hpothb07.dat
  2004-05-18 19:46 0 -c-ha-w C:\Documents and Settings\NetworkService.AUTORITE NT.000\hpothb07.dat
  2004-05-18 19:46 0 -c-ha-w C:\Documents and Settings\LocalService.AUTORITE NT.000\hpothb07.dat
  2003-08-13 09:34 10,073,144 ----a-w C:\Documents and Settings\OFFICE11\EXCEL.EXE
  2003-08-10 06:06 7,522,360 ----a-w C:\Documents and Settings\OFFICE11\OUTLLIB.DLL
  2003-08-08 07:16 637,496 -c--a-w C:\Documents and Settings\OFFICE11\OWSCLT.DLL
  2003-08-06 20:31 362,552 -c--a-w C:\Documents and Settings\OFFICE11\SETLANG.EXE
  2003-08-06 20:24 12,037,688 ----a-w C:\Documents and Settings\OFFICE11\WINWORD.EXE
  2003-08-03 17:52 2,808,376 -c--a-w C:\Documents and Settings\OFFICE11\STSLIST.DLL
  2003-07-31 22:21 1,782,840 -c--a-w C:\Documents and Settings\OFFICE11\PPTVIEW.EXE
  2003-07-31 22:19 131,648 -c--a-w C:\Documents and Settings\OFFICE11\ENVELOPE.DLL
  2003-07-31 22:12 29,272 -c--a-w C:\Documents and Settings\OFFICE11\MLSHEXT.DLL
  2003-07-31 22:12 232,536 -c--a-w C:\Documents and Settings\OFFICE11\OLKFSTUB.DLL
  2003-07-31 19:07 119,384 -c--a-w C:\Documents and Settings\OFFICE11\PROFLWIZ.EXE
  2003-07-30 19:40 6,133,312 ----a-w C:\Documents and Settings\OFFICE11\POWERPNT.EXE
  2003-07-26 02:00 174,648 -c--a-w C:\Documents and Settings\OFFICE11\STSUPLD.DLL
  2003-07-26 01:57 75,832 -c--a-w C:\Documents and Settings\OFFICE11\DLGSETP.DLL
  2003-07-26 01:57 345,144 -c--a-w C:\Documents and Settings\OFFICE11\EXSEC32.DLL
  2003-07-24 06:01 1,949,240 -c--a-w C:\Documents and Settings\OFFICE11\FPCUTL.DLL
  2003-07-24 05:40 482,872 -c--a-w C:\Documents and Settings\OFFICE11\MSTORES.DLL
  2003-07-24 05:32 121,400 -c--a-w C:\Documents and Settings\OFFICE11\IMPMAIL.DLL
  2003-07-23 21:35 127,032 -c--a-w C:\Documents and Settings\OFFICE11\MSOCFU.DLL
  2003-07-21 18:46 390,712 -c--a-w C:\Documents and Settings\OFFICE11\RTFHTML.DLL
  2003-07-15 10:14 828,472 -c--a-w C:\Documents and Settings\OFFICE11\OISAPP.DLL
  2003-07-15 10:14 283,696 -c--a-w C:\Documents and Settings\OFFICE11\OIS.EXE
  2003-07-15 10:14 27,192 -c--a-w C:\Documents and Settings\OFFICE11\oisctrl.dll
  2003-07-15 10:14 242,240 -c--a-w C:\Documents and Settings\OFFICE11\OISGRAPH.DLL
  2003-07-15 06:36 186,424 -c--a-w C:\Documents and Settings\OFFICE11\FPDTC.DLL
  2003-07-15 06:11 2,139,192 -c--a-w C:\Documents and Settings\OFFICE11\GRAPH.EXE
  2003-07-15 06:05 1,054,264 -c--a-w C:\Documents and Settings\OFFICE11\OMFC.DLL
  2003-07-15 06:02 637,496 -c--a-w C:\Documents and Settings\OFFICE11\MSQRY32.EXE
  2003-07-15 06:02 627,256 -c--a-w C:\Documents and Settings\OFFICE11\MSTORDB.EXE
  2003-07-15 06:01 445,496 -c--a-w C:\Documents and Settings\OFFICE11\MODHELP.DLL
  2003-07-15 06:00 72,248 -c--a-w C:\Documents and Settings\OFFICE11\OWSSUPP.DLL
  2003-07-15 06:00 145,984 -c--a-w C:\Documents and Settings\OFFICE11\MSWEBCAP.DLL
  2003-07-15 05:57 98,360 -c--a-w C:\Documents and Settings\OFFICE11\DSSM.EXE
  2003-07-15 05:57 59,960 -c--a-w C:\Documents and Settings\OFFICE11\UNBIND.EXE
  2003-07-15 05:57 56,888 -c--a-w C:\Documents and Settings\OFFICE11\NAME.DLL
  2003-07-15 05:57 40,512 -c--a-w C:\Documents and Settings\OFFICE11\REFIEBAR.DLL
  2003-07-15 05:57 38,968 -c--a-w C:\Documents and Settings\OFFICE11\AUTHZAX.DLL
  2003-07-15 05:57 349,248 -c--a-w C:\Documents and Settings\OFFICE11\SELFCERT.EXE
  2003-07-15 05:56 96,824 ----a-w C:\Documents and Settings\OFFICE11\MCPS.DLL
  2003-07-15 05:56 54,328 -c--a-w C:\Documents and Settings\OFFICE11\MSOMSE.DLL
  2003-07-15 05:56 40,504 -c--a-w C:\Documents and Settings\OFFICE11\MSE7.EXE
  2003-07-15 05:56 14,904 -c--a-w C:\Documents and Settings\OFFICE11\DSITF.DLL
  2003-07-15 05:56 13,888 -c--a-w C:\Documents and Settings\OFFICE11\NPOFFICE.DLL
  2003-07-15 05:56 124,984 -c--a-w C:\Documents and Settings\OFFICE11\MSTORE.EXE
  2003-07-15 05:53 94,768 -c--a-w C:\Documents and Settings\OFFICE11\AW.DLL
  2003-07-15 05:53 55,872 -c--a-w C:\Documents and Settings\OFFICE11\MSOSVABW.DLL
  2003-07-15 05:53 39,488 -c--a-w C:\Documents and Settings\OFFICE11\MSOSVFBR.DLL
  2003-07-15 05:52 67,128 ----a-w C:\Documents and Settings\OFFICE11\MSOHEV.DLL
  2003-07-15 05:52 55,360 -c--a-w C:\Documents and Settings\OFFICE11\MSOHTMED.EXE
  2003-07-15 05:52 27,704 ----a-w C:\Documents and Settings\OFFICE11\MSODCW.DLL
  2003-07-15 05:46 176,696 -c--a-w C:\Documents and Settings\OFFICE11\MIMEDIR.DLL
  2003-07-15 05:45 196,152 ----a-w C:\Documents and Settings\OFFICE11\OUTLOOK.EXE
  2003-07-15 05:44 88,128 -c--a-w C:\Documents and Settings\OFFICE11\OUTLMIME.DLL
  2003-07-15 05:44 66,616 -c--a-w C:\Documents and Settings\OFFICE11\SENDTO.DLL
  2003-07-15 05:44 102,968 -c--a-w C:\Documents and Settings\OFFICE11\OUTLCTL.DLL
  2003-07-15 05:43 87,616 -c--a-w C:\Documents and Settings\OFFICE11\ADDRPARS.DLL
  2003-07-15 05:43 64,056 -c--a-w C:\Documents and Settings\OFFICE11\OUTLRPC.DLL
  2003-07-15 05:43 49,208 -c--a-w C:\Documents and Settings\OFFICE11\OUTLWAB.DLL
  2003-07-15 05:43 139,320 -c--a-w C:\Documents and Settings\OFFICE11\OUTLPH.DLL
  2003-07-15 05:42 44,088 -c--a-w C:\Documents and Settings\OFFICE11\OUTLVBS.DLL
  2003-07-15 05:42 37,432 -c--a-w C:\Documents and Settings\OFFICE11\RECALL.DLL
  2003-07-15 05:41 24,640 -c--a-w C:\Documents and Settings\OFFICE11\OUTLACCT.DLL
  2003-07-15 05:41 13,368 -c--a-w C:\Documents and Settings\OFFICE11\FINDER.EXE
  2003-07-15 02:14 350,264 -c--a-w C:\Documents and Settings\OFFICE11\CDLMSO.DLL
  2003-07-15 02:14 106,552 -c--a-w C:\Documents and Settings\OFFICE11\MSOCF.DLL
  2003-07-14 21:57 87,096 -c--a-w C:\Documents and Settings\OFFICE11\IEAWSDC.DLL
  2003-07-14 21:57 72,256 -c--a-w C:\Documents and Settings\OFFICE11\UCSCRIBE.DLL
  2005-05-26 12:03 56 -csha-r C:\WINDOWS\system32\6655DDBC32.sys
  .
  
  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000250-0320-4dd4-be4f-7566d2314352}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13197ace-6851-45c3-a7ff-c281324d5489}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e1075f4-eec4-4a86-add7-cd5f52858c31}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5dafd089-24b1-4c5e-bd42-8ca72550717b}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5fa6752a-c4a0-4222-88c2-928ae5ab4966}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{622cc208-b014-4fe0-801b-874a5e5e403a}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6edee3b8-1dd2-11b2-9859-d1277bc576ea}]
  2008-03-29 23:15 61440 --a------ C:\WINDOWS\fgdupkvs.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{965a592f-8efa-4250-8630-7960230792f1}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9c5b2f29-1f46-4639-a6b4-828942301d3e}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765728274}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fc3a74e5-f281-4f10-ae1e-733078684f3c}]
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb}]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Microsoft Works Update Detection"="???\WkDetect.exe" [ ]
  "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
  "Felix"="C:\Program Files\ScreenMates\Felix.exe" [ ]
  "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
  "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
  "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-11-26 14:42 1349120]
  "SiS KHooker"="C:\WINDOWS\System32\khooker.exe" [2002-01-25 03:30 290816]
  "SiSUSBRG"="C:\WINDOWS\sisUSBrg.exe" [2002-04-25 18:06 32768]
  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2002-01-15 05:42 110592]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2002-01-15 05:40 450560]
  "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [ ]
  "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-20 01:09 144384]
  "LogitechGalleryRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [ ]
  "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
  "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
  "ISUSPM"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" [ ]
  "ctfmona"="C:\WINDOWS\system32\ctfmona.exe" [ ]
  "WinIFixer"="C:\Program Files\WinIFixer\WinIFixer.exe" [ ]
  "SpyMaxx"="C:\Program Files\SpyMaxx\SpyMaxx.exe" [ ]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  "DisableTaskMgr"= 1 (0x1)
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
  "DisableTaskMgr"= 1 (0x1)
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  Notification Packages REG_MULTI_SZ scecli scecli scecli
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^AOL 9.0 Icône AOL.lnk]
  path=C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\AOL 9.0 Icône AOL.lnk
  backup=C:\WINDOWS\pss\AOL 9.0 Icône AOL.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^hp psc 1000 series.lnk]
  path=C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\hp psc 1000 series.lnk
  backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]
  path=C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk
  backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
  path=C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
  backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Rappels du Calendrier Microsoft Works.lnk]
  path=C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\Rappels du Calendrier Microsoft Works.lnk
  backup=C:\WINDOWS\pss\Rappels du Calendrier Microsoft Works.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
  path=C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
  backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
  C:\PROGRA~1\FICHIE~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
  C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
  --a------ 2004-08-20 01:09 15360 C:\WINDOWS\system32\ctfmon.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ImInstaller_IncrediMail]
  C:\DOCUME~1\RICHAR~1\LOCALS~1\Temp\ImInstaller\IncrediMail\incredimail_install
  [1].exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
  C:\WINDOWS\system32\dumprep 0 -k
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
  C:\Documents and Settings\Richard SZYNKOLEWSKI\Mes documents\\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
  C:\Program Files\Logitech\Video\ISStart.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
  C:\Program Files\Logitech\Video\ManifestEngine.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
  C:\Program Files\Logitech\Video\ISStart.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
  C:\Program Files\Logitech\Video\LogiTray.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
  C:\Program Files\Microsoft Works\WksSb.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyStartUp10.0]
  C:\Program Files\Microsoft Money\System\Activation.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
  C:\Program Files\MSN Apps\Updater\[u]0[/u]1.02.3000.1001\fr\msnappau.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\navapp]
  C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
  --a--c--- 2001-08-23 18:47 86016 C:\WINDOWS\system32\pctspk.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
  --a------ 2008-03-27 15:21 385024 C:\Program Files\QuickTime\qttask.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
  C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
  C:\Program Files\Microsoft Works\wkfud.exe
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  "C:\\WINDOWS\\system32\\fxsclnt.exe"=
  "C:\\Program Files\\eMule\\emule.exe"=
  "C:\\WINDOWS\\system32\\sessmgr.exe"=
  "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
  "%windir%\\system32\\sessmgr.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Zapu\\Zapu\\wDivi.exe"=
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
  "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
  "500:UDP"= 500:UDP:@xpsp2res.dll,-22017
  
  R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-07-11 06:04]
  R3 WBFIRDMA;Winbond Infrared Device Driver;C:\WINDOWS\system32\DRIVERS\wbfirdma.sys [2002-03-07 15:12]
  S3 alcan5ln;SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);C:\WINDOWS\system32\DRIVERS\alcan5ln.sys [2003-12-08 12:53]
  S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 07:58]
  S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
  
  .
  **************************************************************************
  
  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-04-02 00:27:47
  Windows 5.1.2600 Service Pack 2 NTFS
  
  Balayage processus cach‚s ...
  
  Balayage cach‚ autostart entries ...
  
  Balayage des fichiers cach‚s ...
  
  C:\WINDOWS\updatetc.exe 30208 bytes
  C:\WINDOWS\180ax.exe 24832 bytes
  C:\WINDOWS\2020search.dll 11520 bytes
  C:\WINDOWS\2020search2.dll 16896 bytes
  C:\WINDOWS\swin32.dll 22016 bytes
  C:\WINDOWS\bjam.dll 19968 bytes
  C:\WINDOWS\bokja.exe 29952 bytes
  
  Scan termin‚ avec succŠs
  Les fichiers cach‚s: 7
  
  **************************************************************************
  .
  ------------------------ Other Running Processes ------------------------
  .
  C:\Program Files\Ahead\InCD\InCDsrv.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\sbwltbxa.exe
  C:\WINDOWS\System32\CbEvtSvc.exe
  C:\WINDOWS\System32\FTRTSVC.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\System32\tcpsvcs.exe
  C:\WINDOWS\System32\snmp.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
  .
  **************************************************************************
  .
  Temps d'accomplissement: 2008-04-02 0:33:00 - machine was rebooted
  ComboFix-quarantined-files.txt 2008-04-01 22:32:47
  Pre-Run: 15,987,843,072 octets libres
  Post-Run: 15,920,812,032 octets libres
  .
  2008-03-12 19:42:17 --- E O F ---
  
  0
Réponse 3 / 9
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041

fais tout le reste:

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

-------------------------------------

scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

______________________
recolle un nouveau rapport hijackthis
0
1. richou57 Messages postés 7 Statut Membre
  
  Bonjour jpljpl,
  
  YOUPI !! LES TROJANS SONT PARTIS !!! !!! !!!
  
  Bravo pour tes conseils simples et précis facilement exploitable. Les liens que tu m'a adressés sont agréables et faciles à comprendre, surtout le blog de Jean-Claude. Par cette expérience, j'ai appris enormément de choses sur le fonctionnement de mon ordinateur. Et au départ , ce n'était pas du tout évident.....
  
  Et merci encore pour ta disponibilité et d'avoir partagé tes connaissances dans ce domaine.
  
  Avec Anti-Malware , le scan a analysé 79699 éléments , 102 étaient infectés, tous ont été supprimés.Je colle le rapport.
  
  J'ai refait un rapport Hijackthis,version française , collé egalement
  
  Bonne journée richou57
  
  Logfile of HijackThis v1.99.1
  Scan saved at 09:43:59, on 02/04/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Ahead\InCD\InCDsrv.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\System32\FTRTSVC.exe
  C:\Program Files\Ahead\InCD\InCD.exe
  C:\WINDOWS\System32\khooker.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\WINDOWS\System32\tcpsvcs.exe
  C:\WINDOWS\System32\snmp.exe
  C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\System32\svchost.exe
  C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
  C:\PROGRA~1\Wanadoo\ComComp.exe
  C:\PROGRA~1\Wanadoo\Toaster.exe
  C:\PROGRA~1\Wanadoo\Inactivity.exe
  C:\PROGRA~1\Wanadoo\PollingModule.exe
  C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
  C:\PROGRA~1\Wanadoo\Watch.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7180
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
  R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {6edee3b8-1dd2-11b2-9859-d1277bc576ea} - C:\WINDOWS\fgdupkvs.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
  O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
  O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
  O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
  O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
  O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
  O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -scheduler
  O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe
  O4 - HKCU\..\Run: [Microsoft Works Update Detection] ???\WkDetect.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [Felix] C:\Program Files\ScreenMates\Felix.exe
  O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\DOCUME~1\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - (no file)
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\shdocvw.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
  O16 - DPF: {1B3E3251-658E-4F03-8881-68302FE3CE9E} - http://www.friend.fr/friend/FLight2005-01.xms
  O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.fr.aol.com/molbin/shared/mcinsctl/fr/4,0,0,84/mcinsctl.cab
  O16 - DPF: {5CA8D349-C6E7-11D4-8166-009027DF3BB2} (France Telecom MDDK ActiveX Control) - http://accueil.ava.serveur-ava.com/stkid_data/ocx/mDKid.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
  O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://charon777.free.fr/plugins/hardwaredetection_2_0_4_10.cab
  O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.fr.aol.com/molbin/shared/mcgdmgr/fr/1,0,0,21/mcgdmgr.cab
  O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
  O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
  O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  
  ___________________________
  
  Malwarebytes' Anti-Malware 1.10
  Version de la base de données: 581
  
  Type de recherche: Examen complet (C:\|)
  Eléments examinés: 79699
  Temps écoulé: 33 minute(s), 38 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 22
  Valeur(s) du Registre infectée(s): 1
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 22
  Fichier(s) infecté(s): 57
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d} (Adware.123Mania) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{622cc208-b014-4fe0-801b-874a5e5e403a} (Adware.123Mania) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9c5b2f29-1f46-4639-a6b4-828942301d3e} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\Typelib\{50ccd00a-66b6-4d95-aaef-8ee959498f92} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000250-0320-4dd4-be4f-7566d2314352} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{13197ace-6851-45c3-a7ff-c281324d5489} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4e1075f4-eec4-4a86-add7-cd5f52858c31} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5dafd089-24b1-4c5e-bd42-8ca72550717b} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5fa6752a-c4a0-4222-88c2-928ae5ab4966} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{965a592f-8efa-4250-8630-7960230792f1} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765728274} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fc3a74e5-f281-4f10-ae1e-733078684f3c} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\SpyMaxx (Rogue.SpyMaxx) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\WinIFixer.com (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\Software\xflock (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\Software\PostInstallC (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  
  Valeur(s) du Registre infectée(s):
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyMaxx (Rogue.SpyMaxx) -> Quarantined and deleted successfully.
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  C:\Program Files\180searchassistant (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\180solutions (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\zango (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\seekmo (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\180search assistant (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\stc (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Program Files\Sysmnt (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\FLEOK (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\XPdefender\logs (Rogue.XPDefender) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Autorun (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\BrowserObjects (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Packages (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Autorun\HKCU (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Autorun\HKLM (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Autorun\StartMenuAllUsers (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Autorun\StartMenuCurrentUser (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Autorun\HKCU\RunOnce (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\WinIFixer.com\WinIFixer\Quarantine\Autorun\HKLM\RunOnce (Rogue.WinIFixer) -> Quarantined and deleted successfully.
  
  Fichier(s) infecté(s):
  C:\System Volume Information\_restore{5F520B1C-AE86-45CF-9664-34A1F2EC0529}\RP241\A0020755.exe (Rogue.XPDefender) -> Quarantined and deleted successfully.
  C:\Program Files\180searchassistant\saap.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\180searchassistant\sac.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\180solutions\sais.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\zango\zango.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\seekmo\seekmohook.dll (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\180search assistant\180sa.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\180search assistant\sau.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
  C:\Program Files\stc\csv5p070.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Program Files\Sysmnt\Ssmgr.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\FLEOK\180ax.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\Documents and Settings\LocalService.AUTORITE NT.000\Application Data\XPdefender\logs\1206826851.log (Rogue.XPDefender) -> Quarantined and deleted successfully.
  C:\WINDOWS\avifile32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\avisynthex32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\aviwrap32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\bjam.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\bokja.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\browserad.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\cdsm32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\changeurl_30.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\didduid.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\msa64chk.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\msapasrc.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\mspphe.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\123messenger.per (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\mssvr.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\ntnut.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\saiemod.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\salm.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\shdocpe.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\shdocpl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\stcloader.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\swin32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\updatetc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\voiceip.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\winsb.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\MSIXU.DLL (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\MSNSA32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\ntnut32.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\shdocpe.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\SIPSPI32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\WER8274.DLL (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\Installer\id53.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\180ax.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\2020search.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\2020search2.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\apphelp32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\asferror32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\asycfilt32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\athprxy32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\ati2dvaa32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\ati2dvag32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\audiosrv32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\autodisc32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
  C:\WINDOWS\licencia.txt (Malware.Trace) -> Quarantined and deleted successfully.
  C:\WINDOWS\telefonos.txt (Malware.Trace) -> Quarantined and deleted successfully.
  C:\WINDOWS\textos.txt (Malware.Trace) -> Quarantined and deleted successfully.
  
  0
Réponse 4 / 9
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041

relance hijackthis , faire do a systeme scan only puis selectionner ces lignes et faire fix cheked:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: (no name) - {6edee3b8-1dd2-11b2-9859-d1277bc576ea} - C:\WINDOWS\fgdupkvs.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] ???\WkDetect.exe

O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O16 - DPF: {1B3E3251-658E-4F03-8881-68302FE3CE9E} - http://www.friend.fr/friend/FLight2005-01.xms
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.fr.aol.com/molbin/shared/mcinsctl/fr/4,0,0,84/mcinsctl.cab
O16 - DPF: {5CA8D349-C6E7-11D4-8166-009027DF3BB2} (France Telecom MDDK ActiveX Control) - http://accueil.ava.serveur-ava.com/stkid_data/ocx/mDKid.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://charon777.free.fr/plugins/hardwaredetection_2_0_4_10.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.fr.aol.com/molbin/shared/mcgdmgr/fr/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab

_________________

télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :
C:\WINDOWS\fgdupkvs.dll
C:\Program Files\WinIFixer\WinIFixer.exe

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

______________________
vire ce qui est dans movedfiles en allant dans poste de travail puis C puis OTMOVIT

C:\_OTMoveIt\MovedFiles

____________________

colle le rapport d'un scan en ligne
avec un des suivants:
(désactiver avast si besoin le temps du scan)

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

_______________________
recoller hijackthis et dire les soucis actuels
0
1. richou57 Messages postés 7 Statut Membre
  
  slt jlpjlp,
  
  concernant OTMovelt, sur la gauche de la fenetre , il y a deux cadres : Paste Standart List et Paste Custom List , je choisi lequel ?
  
  J'ai copié/collé la citation dans Paste Standart ,puis j'ai cliqué sur movelt ! ....rien ??? j'ai du fermer car l'indication "ne réponds pas" s'est affiché ??....
  
  dans Paste Custom... egalement rien ???? @plus
  
  0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 5 / 9
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041

sur la partie du haut
0
1. richou57 Messages postés 7 Statut Membre
  
  j'ai toujours "ce programme ne répond pas" quand je clique sur "Movelt!" ??
  
  0
Réponse 6 / 9
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041

ok

_________________

pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

_____________

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
C:\WINDOWS\fgdupkvs.dll
C:\Program Files\WinIFixer\WinIFixer.exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000250-0320-4dd4-be4f-7566d2314352}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13197ace-6851-45c3-a7ff-c281324d5489}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e1075f4-eec4-4a86-add7-cd5f52858c31}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5dafd089-24b1-4c5e-bd42-8ca72550717b}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5fa6752a-c4a0-4222-88c2-928ae5ab4966}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{622cc208-b014-4fe0-801b-874a5e5e403a}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6edee3b8-1dd2-11b2-9859-d1277bc576ea}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{965a592f-8efa-4250-8630-7960230792f1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9c5b2f29-1f46-4639-a6b4-828942301d3e}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765728274}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fc3a74e5-f281-4f10-ae1e-733078684f3c}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb}]

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

________
0
1. richou57 Messages postés 7 Statut Membre
  
  Fichier journal de BitDefender
  Produit : BitDefender Total Security 2008
  Version : BitDefender UIScanner V.11
  Date du journal : 01:08:08 03/04/2008
  Chemin du journal : C:\Documents and Settings\All Users.WINDOWS\Application Data\Bitdefender\Desktop\Profiles\Logs\quick_scan\1207177688_1_00.xml
  
  Analyse des chemins :Chemin0000: C:\WINDOWS
  Chemin0001: C:\Program Files
  
  Options d’analyse :Analyse contre les virus : Oui
  Détecter les adwares : Oui
  Analyse contre les spywares : Oui
  Analyse des applications : Oui
  Détecter les numéroteurs : Oui
  Analyse contre les Rootkits : Non
  
  Options de sélection de cible :Analyse les clés du registre : Non
  Analyse des cookies : Non
  Analyser le secteur de boot : Non
  Analyse des processus mémoire : Non
  Analyser les archives : Non
  Analyser les fichiers enpaquetés : Oui
  Analyser les emails : Oui
  Analyser tous les fichiers : Oui
  Analyse heuristique : Oui
  Extensions analysées :
  Extensions exclues :
  
  Traitement cibleAction par défaut pour les objets infectés : Désinfecter
  Action par défaut pour les objets suspects : Aucun
  Action par défaut pour les objets camouflés : Aucun
  
  Résumé de l'analyseNombre de signatures de virus : 1087585
  Plugins archives : 41
  Plug-ins messagerie : 6
  Plugins d'analyse : 12
  Plugins archives : 41
  Plug-ins système : 4
  Plug-ins décompression : 7
  
  Résumé de l'analyse généraleEléments analysés : 121986
  Eléments infectés : 0
  Eléments suspects : 0
  Eléments résolus : 0
  Virus individuels trouvés : 0
  Répertoires analysés : 2439
  Secteur de boot analysés : 0
  Archives analysés : 807
  Erreurs I/O : 15
  Temps d'analyse : 00:00:56:46
  Fichiers par seconde : 35
  
  Résumé des processus analysésAnalysé(s) : 0
  Infecté(s) : 0
  
  Résumé des clés de registre analyséesAnalysé(s) : 0
  Infecté(s) : 0
  
  Résumé des cookies analysésAnalysé(s) : 0
  Infecté(s) : 0
  
  Problèmes non résolus :Nom de l'objet Nom de la menace Etat final
  
  Problèmes résolusNom de l'objet Nom de la menace Etat final
  
  Objets non scannés :Nom de l'objet Raison Etat final
  
  0
Réponse 7 / 9
mannigan Messages postés 12 Statut Membre

Bon bin juste pour remercier jlpjlp car grâce à ce post j'ai pu résoudre mes problème alors encore une fois un très grand merci !!!!
0
Réponse 8 / 9
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041

parfait meme si cela fait longtemps

pour protéger gratos ton ordi

securite

mettre un antivirus

AVAST en français ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions:

MALWAREBYTE + SPYBOT +
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

--------
un pare feu :
celui de Windows ou mieux KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou comodo

https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
zonealarm

-----------

CCLEANER pour effacer les traces de surf
0
Réponse 9 / 9
mannigan Messages postés 12 Statut Membre

Comme quoi c'est bien utile de ne pas effacer les messages. Pour la protection c'est bon je suis paré maintenant. De mon côté j'avais justement juste un Vundo qui m'ouvrait IE en continu même déconnecté et il a drôlement bien résisté le salopiaud mais bon je l'ai eut tout est bien qui finit bien donc.
0

TrojanDowloader XS

9 réponses

Discussions similaires

Newsletters