SVP AIDEZ MOI MON PC EST INFECTé

slt

pour defensa regarde ici

https://forum.malekal.com/viewtopic.php?f=56&t=3439
_____________________

relance hijakchtis , fais do a system scan only, selectionne ces lignes et fais fix cheked:

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
_____________________

analyse ce fichier sur virus total et si infécté tu le rajoute dans la citation otmovit: https://www.virustotal.com/gui/
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe

________________

télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :
C:\Program Files\Defenza
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb126\SearchSettings.dll
C:\Program Files\Defenza\pcd-as.exe

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

_________________
vire spyware doctor car tu as déjà windows defender , spybot, et l'antiespion de bitdefender ce qui fait beaucoup!

___________________

télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

___________

colle un rapport avec smitfraud fix option 1

http://siri.urz.free.fr/Fix/SmitfraudFix.php

tout d abord merci il ma fallut du temps; rapport de otmovit ::: File/Folder C:\Program Files\Defenza not found.
C:\Program Files\Search Settings\kb126\temp moved successfully.
C:\Program Files\Search Settings\kb126\res moved successfully.
C:\Program Files\Search Settings\kb126 moved successfully.
C:\Program Files\Search Settings moved successfully.
File/Folder C:\Program Files\Search Settings\kb126\SearchSettings.dll not found.
File/Folder C:\Program Files\Defenza\pcd-as.exe C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe not found.

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04092008_181730
RAPPORT DE COMBOFIX:::::::::::ComboFix 08-04-08.10 - kader 2008-04-09 18:24:23.1 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1576 [GMT 2:00]
Endroit: C:\Users\kader\Desktop\Combo-Fix.exe
.
TimedOut: Windir.dat

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Conditions générales.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Confidentialité.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Désinstaller.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Website.url
C:\Users\mirou\AppData\Local\uckygvdr.dat
C:\Users\mirou\AppData\Local\uckygvdr.exe
C:\Users\mirou\AppData\Local\uckygvdr_nav.dat
C:\Users\mirou\AppData\Local\uckygvdr_navps.dat
C:\Users\mirou\AppData\Roaming\MessengerSkinner
C:\Users\mirou\AppData\Roaming\MessengerSkinner\Userdata\pack1.cab
C:\Users\mirou\Desktop\internetgamebox.lnk

.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-09 to 2008-04-09 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-09 16:12 --------- d---a-w C:\ProgramData\TEMP
2008-04-09 16:12 --------- d-----w C:\Program Files\Spyware Doctor
2008-04-09 15:52 --------- d-----w C:\Program Files\OFFICE One v7
2008-04-09 15:46 --------- d-----w C:\Program Files\MediaCoder
2008-04-09 15:45 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-04-09 15:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 15:42 --------- d-----w C:\Program Files\FinalBurner
2008-04-09 15:42 --------- d-----w C:\Program Files\DivX
2008-04-09 02:55 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-04-09 01:40 691,545 ----a-w C:\Windows\unins000.exe
2008-04-09 01:40 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-09 00:49 --------- d-----w C:\ProgramData\Google Updater
2008-04-09 00:01 --------- d-----w C:\Program Files\Lavasoft
2008-04-08 23:16 --------- d-----w C:\Program Files\ATI Technologies
2008-04-08 23:15 --------- d-----w C:\Program Files\Elaborate Bytes
2008-04-08 23:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-08 23:07 45,056 ----a-w C:\Windows\System32\acovcnt.exe
2008-04-08 16:55 --------- d-----w C:\Program Files\LimeWire
2008-04-08 13:24 --------- d-----w C:\Program Files\Java
2008-04-08 11:20 --------- d-----w C:\ProgramData\BitDefender
2008-04-08 11:18 --------- d-----w C:\Program Files\Common Files\BitDefender
2008-04-08 11:17 --------- d-----w C:\Program Files\BitDefender
2008-04-07 22:42 --------- d-----w C:\Program Files\StuffPlug3
2008-04-07 19:30 --------- d-----w C:\Program Files\Kaspersky Lab
2008-04-07 19:09 --------- d-----w C:\Program Files\free-downloads.net
2008-04-07 19:09 --------- d-----w C:\Program Files\Conduit
2008-04-07 18:46 --------- d-----w C:\ProgramData\Kaspersky Lab Setup Files
2008-04-07 12:22 --------- d-----w C:\Program Files\Free Easy Burner
2008-04-05 10:31 --------- d-----w C:\Program Files\Smallvideosoft
2008-04-05 10:26 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-04-05 10:26 --------- d-----w C:\Program Files\AVS4YOU
2008-04-05 10:25 --------- d-----w C:\Program Files\adslTV
2008-04-04 17:47 --------- d-----w C:\Program Files\Xilisoft
2008-04-04 13:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-04-04 10:49 --------- d-----w C:\Users\mirou\AppData\Roaming\OFFICEOne7
2008-04-03 19:01 --------- d-----w C:\ProgramData\AVS4YOU
2008-04-03 18:36 --------- d-----w C:\Program Files\Common Files\GeoVid
2008-04-01 14:39 --------- d-----w C:\Program Files\QuickTime
2008-04-01 14:39 --------- d-----w C:\Program Files\iTunes
2008-04-01 14:39 --------- d-----w C:\Program Files\Google
2008-03-31 13:49 --------- d-----w C:\Program Files\MP3Gain
2008-03-30 18:19 --------- d-----w C:\ProgramData\Messenger Plus!
2008-03-29 18:22 --------- d-----w C:\Program Files\MyFree Codec
2008-03-29 18:20 --------- d-----w C:\Program Files\Samsung
2008-03-29 18:20 --------- d-----w C:\Program Files\MarkAny
2008-03-29 15:59 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-29 14:34 --------- d-----w C:\Users\mirou\AppData\Roaming\vlc
2008-03-28 16:21 --------- d-----w C:\Program Files\Safari
2008-03-28 16:19 --------- d-----w C:\Program Files\iPod
2008-03-26 03:15 --------- d-----w C:\Users\mirou\AppData\Roaming\U3
2008-03-26 02:05 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-24 21:23 --------- d-----w C:\Program Files\MatchWare
2008-03-24 20:03 --------- d-----w C:\Users\mirou\AppData\Roaming\Nero
2008-03-24 16:59 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-03-24 16:10 --------- d-----w C:\Program Files\MSBuild
2008-03-24 16:10 --------- d-----w C:\Program Files\Microsoft Works
2008-03-24 16:07 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-24 16:02 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-03-24 15:28 --------- d-----w C:\Program Files\Common Files\Nero
2008-03-24 15:21 --------- d-----w C:\ProgramData\Nero
2008-03-24 00:03 --------- d-----w C:\Users\mirou\AppData\Roaming\TuneUp Software
2008-03-23 14:59 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-03-23 14:54 306,432 ----a-w C:\Windows\System32\TuneUpDefragService.exe
2008-03-21 18:36 --------- d-----w C:\Program Files\e-anim
2008-03-17 12:53 --------- d-----w C:\ProgramData\WLInstaller
2008-03-16 13:22 --------- d-----w C:\Program Files\PhotoFiltre Studio
2008-03-15 15:26 --------- d-----w C:\Program Files\Picasa2
2008-03-15 14:53 --------- d-----w C:\Program Files\PhotoFiltre
2008-03-15 14:33 --------- d-----w C:\Program Files\Studio-Scrap
2008-03-15 14:32 --------- d-----w C:\Users\mirou\AppData\Roaming\Studio-Scrap
2008-03-15 13:55 --------- d-----w C:\Program Files\Tracker Software
2008-03-13 12:01 --------- d-----w C:\Program Files\WinHTTrack
2008-03-13 02:15 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-13 02:15 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-03-13 02:08 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-03-13 02:08 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-03-13 02:08 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-03-13 02:08 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-03-13 02:08 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-03-13 02:02 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-03-13 02:02 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-03-13 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-03-13 02:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-03-12 16:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-11 20:44 --------- d-----w C:\Program Files\Alcohol Soft
2008-02-26 18:01 --------- d-----w C:\Program Files\Inventel
2008-02-23 01:06 --------- d-----w C:\Program Files\TVAnts
2008-02-23 01:05 --------- d-----w C:\Program Files\SatelliteTVforPC
2008-02-23 01:00 --------- d-----w C:\Program Files\PC Accelerate
2008-02-23 00:59 --------- d-----w C:\ProgramData\eSellerate
2008-02-23 00:59 --------- d-----w C:\Program Files\Common Files\eSellerate
2008-02-23 00:47 --------- d-----w C:\Program Files\Replay Converter
2008-02-23 00:45 --------- d-----w C:\Program Files\VirtualDJ
2008-02-22 00:18 --------- d-----w C:\Program Files\DVDFab Platinum 4
2008-02-22 00:14 --------- d-----w C:\Program Files\ElcomSoft
2008-02-21 23:59 --------- d-----w C:\Program Files\IDA
2008-02-21 23:54 --------- d-----w C:\Program Files\SuperLogix
2008-02-21 02:20 --------- d-----w C:\Program Files\Easiestutils
2008-02-21 02:05 200,704 ----a-w C:\Windows\System32\nsr58C1.tmp
2008-02-21 02:05 1,044,480 ----a-w C:\Windows\System32\nsl5852.tmp
2006-05-03 10:06 163,328 --sh--r C:\Windows\System32\flvDX.dll
2005-08-24 22:10 174,592 --sha-w C:\Windows\System32\ncfpsys.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 23:27 815104]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-02-16 17:45 360448]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 10:25 1828136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Spybot - Search & Destroy"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2005-05-31 01:04 4393096]
"Lexmark 1200 Series Uninstall"="" []
"MSNFix"="C:\Users\kader\Desktop\MSNFix\MSNFix.bat /pass2" [ ]
"GrpConv"="grpconv -o" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Outil de mise à jour Google.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Outil de mise à jour Google.lnk
backup=C:\Windows\pss\Outil de mise à jour Google.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitDefender Antiphishing Helper]
--a------ 2007-10-09 15:46 61440 C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2008-03-15 17:13 1836544 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RestartNeroSetup]
C:\Users\kader\Desktop\nero\Installation\Setupx.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Password Protect USB 3.6.1"=C:\Windows\system32\ncfpsys.exe
"ASUS Camera ScreenSaver"=C:\Windows\ASScrProlog.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SMSTray"=C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{626A4C5E-D9B0-427F-9A36-65EAECDF51A9}"= UDP:4662:LPHANT
"{81C57B69-7EEA-4EBE-8790-3302EDC61C7B}"= TCP:4672:LPHANT2
"{7FAEAADA-FD91-4AF6-B1AD-695C88667EC8}"= UDP:C:\Program Files\lphant\eLePhantClient.exe:lphant
"{540E054D-4791-44BD-A7E2-C885042B8A04}"= TCP:C:\Program Files\lphant\eLePhantClient.exe:lphant
"TCP Query User{936B446D-0D63-4859-BC54-8E97D32BBF8B}C:\\program files\\lphant\\elephantclient.exe"= UDP:C:\program files\lphant\elephantclient.exe:lphant Client
"UDP Query User{0B874E1D-E796-4607-BE06-C89C93477E84}C:\\program files\\lphant\\elephantclient.exe"= TCP:C:\program files\lphant\elephantclient.exe:lphant Client
"{03C1E629-2B33-47B1-B53E-A46E9FBE78E2}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{DBADDE4E-55D0-4F74-8A57-ECF91E5ABD80}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{166ACAB8-B741-4C52-A4B3-770D731488AA}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{F9748E1A-7C99-4284-B2AE-1FD1FB0CCE4C}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{9C34DEF2-2E8A-4AA5-87F3-F7ECD4BCD5E5}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{BF135AFF-1123-4F0A-96E5-B9435FA2C72B}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{A3171276-B81B-4617-8336-B985AE666BA4}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{88594D48-5A5E-431B-9D30-EACF1BB450AA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"TCP Query User{B54C2741-C518-4605-94D6-02315AE74A61}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{20070461-65C0-42B7-A918-ADC007537A0E}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{392E68E3-C8E4-4417-A205-8B3C57AB6137}C:\\program files\\videolan\\vlc\\vlc.exe"= UDP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{2F8F5656-18A8-42CB-BFD6-9331A8504CA1}C:\\program files\\videolan\\vlc\\vlc.exe"= TCP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{BF63338C-5131-4E94-9EAD-07F48A37F9E3}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{EF983016-E802-4667-94B2-29F57408BFF8}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{4674E56B-86BE-435F-A9C5-A8BCFB154E40}C:\\program files\\pando networks\\pando\\pando.exe"= C:\program files\pando networks\pando\pando.exe:pando
"TCP Query User{76843D20-AE5D-4B27-94BA-187B644D3AA7}C:\\program files\\pando networks\\pando\\pando.exe"= RA4=LocalSubnet:LocalSubnet|C:\program files\pando networks\pando\pando.exe:pando
"TCP Query User{A00C1A24-E63C-402B-A9D3-23DAC5888201}C:\\program files\\pando networks\\pando\\pando.exe"= C:\program files\pando networks\pando\pando.exe:pando
"UDP Query User{FC27D876-FE65-41BE-AB3C-75BB04107CF5}C:\\program files\\pando networks\\pando\\pando.exe"= RA4=LocalSubnet:LocalSubnet|C:\program files\pando networks\pando\pando.exe:pando
"{C1864D0A-AC91-42B3-9C26-A51747FE7AEC}"= UDP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
"{4D274531-A2DE-46C5-90A5-895193C7F605}"= TCP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
"{3B301C66-E314-4EFE-9766-0694CA43E7B3}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{6C2F00EC-C76B-4676-A5A5-EF6FA0EA36C5}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
"{AA164D05-F808-403A-853B-67498B02D518}"= UDP:56379:Pando P2P TCP Listening Port
"{37FD76D3-C1BD-41A6-8781-14A7ED57DC7C}"= TCP:56379:Pando P2P UDP Listening Port
"TCP Query User{070D4680-1559-4BA6-BD1A-B7FE595B6E97}C:\\users\\kader\\appdata\\local\\temp\\rar$ex10.891\\cryptload_1.0.4\\routerclient.exe"= UDP:C:\users\kader\appdata\local\temp\rar$ex10.891\cryptload_1.0.4\routerclient.exe:routerclient.exe
"UDP Query User{1B7C7309-9438-4071-86D4-79E46EFBA61B}C:\\users\\kader\\appdata\\local\\temp\\rar$ex10.891\\cryptload_1.0.4\\routerclient.exe"= TCP:C:\users\kader\appdata\local\temp\rar$ex10.891\cryptload_1.0.4\routerclient.exe:routerclient.exe
"TCP Query User{D7CD2555-38AB-491D-98CE-79C335B0FBAE}C:\\users\\kader\\appdata\\roaming\\jlc's software\\internet tv\\update.exe"= UDP:C:\users\kader\appdata\roaming\jlc's software\internet tv\update.exe:update.exe
"UDP Query User{74A2DBE5-37AF-4450-A502-25ABFDEFB7F8}C:\\users\\kader\\appdata\\roaming\\jlc's software\\internet tv\\update.exe"= TCP:C:\users\kader\appdata\roaming\jlc's software\internet tv\update.exe:update.exe
"{6CD601FF-965E-4725-B805-374C3C96E81F}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{F70F6EA4-BF3D-498D-956D-7636D7EE9079}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{990A4D0F-0DD9-4754-9BC2-694B0C1BAE01}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\Personal Firewall\ioloFW.exe:iolo Firewall®
"{76D4BD1B-0ADA-43D8-832C-55D606ED23A3}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\Personal Firewall\ioloFW.exe:iolo Firewall®
"{3C2D0285-5C65-4E9B-8249-4CA0161E1BEB}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{51B23680-9173-4EF0-887C-0E4744291658}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\ioloAV.exe:iolo AntiVirus®
"{88EBC447-BFD0-4381-90EE-C8755850F9CE}"= UDP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{B2A4A7F3-2445-48B6-8E9E-CCF76DCBC76A}"= TCP:C:\Program Files\iolo\System Mechanic Professional 7\AntiVirus\iAVEmailScanner.exe:iolo AntiVirus® Email Protection
"{D5495441-4FFB-4039-B19D-33964DADA734}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6560C9F9-91E1-4BBB-8A84-0312A7BC6730}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{2445382D-255C-4556-9A14-D8CE870F830A}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{69F96B65-514D-40DA-95BC-CF333F6C890C}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{94CDD280-C4E1-4DC4-B7D7-92814EEBBDC2}"= UDP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"{370B59A9-FBAB-4AA1-B743-18718E1F0F09}"= TCP:C:\Windows\System32\muzapp.exe:MUZ AOD APP player
"TCP Query User{93BA8A02-7B89-44B2-9AC2-A52CB87E52A8}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{8C8B7786-0F78-45FC-A710-236BFE7E56EE}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{C9381EC4-7EE0-4ED0-9BAA-FFB0B86F9526}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{0DBC1280-F501-4603-BE12-9DC66AD061E2}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DisabledInterfaces"= {73EB23E6-C574-4700-A6C0-A629EEAAD4D2},{D2EA8F3D-BD76-4AB8-8F3B-BA5D44F1881A}

R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-03-01 03:04]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\bdfndisf.sys [2008-01-25 15:40]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2008-01-03 21:35]
S1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [2007-09-20 14:12]
S2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe []
S2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2006-11-02 11:45]
S3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-06 17:04]
S3 StMp3Rec;Pilote de périphérique de la restauration de lecteur;C:\Windows\system32\Drivers\StMp3Rec.sys [2005-08-26 11:22]
S3 SynMini;USB2.0 1.3M Web Cam;C:\Windows\system32\Drivers\SynMini.sys [2006-04-19 02:04]
S3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\Windows\system32\Drivers\SynScan.sys [2006-04-19 02:04]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-03-23 16:54]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
bdx REG_MULTI_SZ scan

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d123ea9-a68b-11dc-8503-001d607deb18}]
\shell\AutoRun\command - H:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aee715a2-a2b1-11dc-80a0-001d607deb18}]
\shell\AutoRun\command - E:\InstallAll.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-04 15:15:00 C:\Windows\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-04-04 13:27:02 C:\Windows\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-04-08 21:38:19 C:\Windows\Tasks\User_Feed_Synchronization-{21DC5361-7888-47BE-A484-1E957CB3BFF4}.job"
- C:\Windows\system32\msfeedssync.exe
"2008-04-09 14:20:00 C:\Windows\Tasks\User_Feed_Synchronization-{2F93FEA3-FDC8-4532-9AF0-BB059CD9DFB2}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 18:27:18
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-09 18:27:53
ComboFix-quarantined-files.txt 2008-04-09 16:27:48
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
.
2008-04-09 14:20:43 --- E O F ---
rapport de smitfraudfix :::::::: SmitFraudFix v2.310

Scan done at 18:30:41,86, 09/04/2008
Run from C:\Windows\System32\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\kader

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\kader\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~3\\GOEC62~1.DLL"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros AR5006EG Wireless Network Adapter
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{D2EA8F3D-BD76-4AB8-8F3B-BA5D44F1881A}: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End
voila tout merci

télécharger sur le bureau
Navilog.zip
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

= Double-Clic navilog1.zip
= Extraire tout sur le bureau
= Double-Clic navilog1 qui est sur le bureau
= Appuyer sur une touche jusqu' arriver aux options
= Choisir option 1

un rapport : fixnavi.txt dans C : va se creer
le copier/coller dans ton prochain message.

rapport : fixnavi.txt :::::::::::::::: Search Navipromo version 3.5.2 commencé le 09/04/2008 à 19:25:09,38

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "kader"

Mise à jour le 29.03.2008 à 22h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6000
Internet Explorer : 7.0.6000.16609
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans C:\Windows ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\ProgramData ***

*** Recherche dossiers dans C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***

*** Recherche dossiers dans ***

*** Recherche dossiers dans C:\Users\kader\AppData\Local\virtualstore\Program Files ***

*** Recherche dossiers dans C:\Users\kader\AppData\Roaming ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\Windows\system32 *

* Recherche dans C:\Users\kader\AppData\Local\Microsoft *

* Recherche dans C:\Users\kader\AppData\Local\virtualstore\windows\system32 *

* Recherche dans C:\Users\kader\AppData\Local *

* Recherche dans "C:\Users\mirou\AppData\Local" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans C:\Windows\system32 :

* Dans C:\Users\kader\AppData\Local\Microsoft :

* Dans C:\Users\kader\AppData\Local\virtualstore\windows\system32 :

* Dans C:\Users\kader\AppData\Local :

ovnwzjq.dat trouvé !
ovnwzjq_nav.dat trouvé !
ovnwzjq_navps.dat trouvé !

* Dans "C:\Users\mirou\AppData\Local" :

3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

*** Analyse terminée le 09/04/2008 à 19:35:02,33 ***

relance navilog et choisi l'option 2 pour nettoyer
_____
recolle un hijackhtis et dis tes soucis actuels