Des cafards affamés !!! (moi aussi)

Chamallow -  
Bonjour,

J'ai moi aussi des problèmes de cafard qui grignotent l'écran sur mon PC (pro en plus...).
Scan effectué avec Panda, Spybot, Asquarred² free, bitdefender on-line.
Apparemment, d'après les autres posts, il n'existe pas de logiciel pour le supprimer. Hijackthis s'impose donc, c'est pourquoi je fais appel à vous.

Je prends un peu d'avance : je post un rapport HijackThis 2.0.2 et j'anticipe les éventuelle remarques en précisant que je ne suis pas le seul à utiliser ce poste (un qui plante le PC et un qui répare -_-)

Je vous remercie par avance de l'aide que vous pourrez m'apporter.
Bonne journée
Chamallow
_________________________________________________________________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:07:08, on 15/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmona.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\COMADIM\Bureau\scan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/PackageHtmlCab.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\dnpo0173e.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

--
End of file - 12390 bytes
Configuration: Windows XP à jour
Firefox 2.0.0.14
Antivirus et anti spyware à jour

18 réponses

  1.  ^^Marie^^
    Bonsoir,

    Juste en passant

    Pas sûre du tout que smitfraud ait fonctionné.
    D'ailleurs pourquoi ??

    1
    1. ^^Marie^^
      Salut

      Fais ce qui suit
      Stp

      · Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.(sur un des 2 liens)
      http://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe
      http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
      · Clique sur Recherche et laisse le scan se terminer.
      · Clique, sur Suppression pour finaliser.
      · Tu peux, si tu le souhaites, te servir des Options facultatives.
      · Clique sur Quitter, pour que le rapport puisse se créer.
      · Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

      Télécharge SmitfraudFix
      Utilitaire de S!Ri: Moe et balltrap34
      http://siri.urz.free.fr/Fix/SmitfraudFix.php
      et télécharge SmitfraudFix.exe.

      Regarde le tuto

      Exécute le en choisissant l’option 1,
      il va générer un rapport
      Copie/colle le sur le poste stp.

      +++

      1
      1. ^^Marie^^
        Afin de suivre la procédure correctement, je te conseille d'enregistrer la page en sélectionnant toutes les lignes puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement.
        Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous.
        Si un élément te paraît obscure, demande des explications avant de commencer la désinfection

        1) Redémarre en mode sans échec

        Regarde ici si besoin avant ici : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm
        Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8] (ou [F5] sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
        Sélectionner "Mode sans échec" et appuie sur [Entrée]
        Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre.

        Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut.

        2) SmitfraudFix de S!Ri, balltrap34 et moe31

        * Double clique sur Smitfraudfix.cmd
        * Sélectionne 2 pour supprimer les fichiers responsables de l'infection.

        A la question Voulez-vous nettoyer le registre ? répondre O (oui)
        afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.
        Le fix déterminera si le fichier wininet.dll est infecté.

        A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.
        * Redémarre en mode normal et poste le rapport ici

        N.B.: Cette étape élimine les fichiers infectieux détectés à l'étape #1
        Note L'option 2 de l'outil supprime le fond d'écran !

        3) Rapports

        Fais redémarrer ton PC et poste le rapport de SmitFraudFix et un nouveau rapport HijackThis stp.

        +++
        1
        3. Chamallow
          Analyse SmitFraudFix puis Réparation effectuée. Ci dessous le second rapport Hijack This

          ______________________________________________________________________
          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 10:31:17, on 15/05/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16640)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\SYSTEM32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\a-squared Free\a2service.exe
          C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
          C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
          C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
          C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
          C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
          C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
          c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
          C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
          C:\WINDOWS\system32\fxssvc.exe
          C:\WINDOWS\System32\igfxtray.exe
          C:\WINDOWS\System32\hkcmd.exe
          C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
          C:\WINDOWS\tppaldr.exe
          C:\WINDOWS\system32\rundll32.exe
          C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
          C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Microsoft ActiveSync\wcescomm.exe
          C:\WINDOWS\System32\svchost.exe
          C:\PROGRA~1\MI3AA1~1\rapimgr.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
          C:\WINDOWS\system32\wscntfy.exe
          C:\Documents and Settings\COMADIM\Bureau\scan.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
          O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
          O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
          O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
          O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
          O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
          O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
          O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
          O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/PackageHtmlCab.CAB
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
          O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
          O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
          O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\dnpo0173e.dll (file missing)
          O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
          O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
          O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
          O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
          O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
          O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
          O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
          O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
          O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
          O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
          O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
          O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
          O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
          O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
          O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
          O24 - Desktop Component 0: Privacy Protection - (no file)
          0
          1. Chamallow
            En fait SmitFraudFix ne l'as pas supprimé, mes petites bebetes sont toujours la.
            Et (à mon avis), il va falloir que je fixe la ligne :
            O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/PackageHtmlCab.CAB (je ne sait pas exactement ce que c'est mais ça n'a rien a faire sur un PC pro
            0
            3. Utilisateur anonyme
              il ne sagit pas de fixer pour le moment il faut d'abord desinfecter quel antivirus as-tu ?

              si tu n'as pas norton fait une analyse antivirus et supprime tous les virus.

              ensuite quand cela et terminer repost un log hijackthis

              0
              1. Chamallow
                J'utilise Panda. Apres le nettoyage de SmitFraudFix en mode sans echec, j'ai redemarré et Panda m'a directement supprimé WinIfix (ha quand meme il sert un peu). Nouveau scan en cours et logfile à suivre
                0
                1. Chamallow
                  Panda m'a aussi supprimé un SmitFraud dans un répertoire de firefox (reboot.exe)

                  Ci dessous le nouveau logfile HijackThis : (Panda étant activé, je me suis occupé manuellement du fichier Host)
                  ____________________________________________________________

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 15:22:20, on 15/05/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\SYSTEM32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\a-squared Free\a2service.exe
                  C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
                  C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
                  C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
                  c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
                  C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
                  C:\WINDOWS\system32\fxssvc.exe
                  C:\WINDOWS\System32\igfxtray.exe
                  C:\WINDOWS\System32\hkcmd.exe
                  C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
                  C:\WINDOWS\tppaldr.exe
                  C:\WINDOWS\system32\rundll32.exe
                  C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
                  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                  C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
                  C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
                  C:\Program Files\Mozilla Firefox\firefox.exe
                  C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
                  C:\Documents and Settings\COMADIM\Bureau\scan.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\psimreal.exe
                  C:\Program Files\Panda Security\Panda Internet Security 2008\avciman.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
                  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
                  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
                  O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
                  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                  O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
                  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
                  O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
                  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
                  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                  O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                  O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/PackageHtmlCab.CAB
                  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                  O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                  O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer = 208.67.220.220,208.67.222.222
                  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                  O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\dnpo0173e.dll (file missing)
                  O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
                  O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
                  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                  O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
                  O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
                  O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
                  O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
                  O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
                  O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
                  O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
                  O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
                  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                  O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
                  O24 - Desktop Component 0: Privacy Protection - (no file)
                  0
                  1. Utilisateur anonyme
                    AH !

                    tres bonne nouvelle tu n'as plus de virus !

                    par contre il est possible que tu ai toujours un ou plusieurs spywares,

                    j'ai vu que tu posseder spyware doctore, rien de tel contre cedux ci

                    fait une analyse et supprime les spywares!

                    Tu as aussi beaucoup de proccessus inutile au démarrage de ton pc, ainsi que lors de l'utilisation, mais je pense que puique c'est un ordi pro, tu ne peux rien faire
                    0
                    2. Chamallow
                      Merci beaucoup, je m'en occupe dès que j'y retourne.

                      Sujet résolu. (Je n'arrive pas à éditer).
                      0
                      1. Utilisateur anonyme
                        tu n'as plus de cafar ?
                        0
                        1. Chamallow
                          Scan effectué avec Psyware Doctor. Les cafards ont disparus. Les lignes ont éta fixées.
                          Je poste le dernier rapport Hijack This.

                          Et si par la meme occasion, quelqu'un pouvait me donner la procédure pour eliminer les processsus inutile en demarrage.

                          D'avance merci
                          _____________________________________________________________________________________

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 08:38:22, on 19/05/2008
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16640)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\csrss.exe
                          C:\WINDOWS\SYSTEM32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\a-squared Free\a2service.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
                          C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
                          C:\WINDOWS\System32\igfxtray.exe
                          C:\WINDOWS\System32\hkcmd.exe
                          C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
                          C:\WINDOWS\tppaldr.exe
                          C:\WINDOWS\system32\rundll32.exe
                          C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
                          C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                          C:\Program Files\QuickTime\qttask.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                          C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
                          C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
                          c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
                          C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
                          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                          C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
                          C:\WINDOWS\system32\fxssvc.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
                          C:\WINDOWS\System32\alg.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
                          C:\WINDOWS\system32\wuauclt.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
                          C:\Mozilla Firefox 3 Beta 5\firefox.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Documents and Settings\COMADIM\Bureau\scan.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\avciman.exe
                          C:\Program Files\Panda Security\Panda Internet Security 2008\psimreal.exe
                          C:\WINDOWS\System32\wbem\wmiprvse.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
                          O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
                          O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
                          O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
                          O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                          O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
                          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
                          O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                          O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                          O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
                          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                          O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer = 208.67.220.220,208.67.222.222
                          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                          O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\dnpo0173e.dll (file missing)
                          O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                          O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
                          O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
                          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                          O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
                          O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
                          O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
                          O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
                          O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
                          O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
                          O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
                          O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
                          O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                          O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                          O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                          O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                          O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
                          O24 - Desktop Component 0: Privacy Protection - (no file)
                          0
                          1. Chamallow
                            Re bonjour et encore merci
                            ___________________________________________________________

                            Rapport TCleaner :

                            -->- Recherche:

                            C:\Program Files\Mozilla Firefox\SmitFraudfix: trouvé !

                            ---------------------------------
                            -->- Suppression:

                            C:\Program Files\Mozilla Firefox\SmitFraudfix: supprimé !

                            _____________________________________________________

                            Rapport SmitFraud Fix :

                            SmitFraudFix v2.320

                            Rapport fait à 14:12:57,75, 19/05/2008
                            Executé à partir de C:\Mozilla Firefox 3 Beta 5\SmitfraudFix
                            OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                            Le type du système de fichiers est NTFS
                            Fix executé en mode normal

                            »»»»»»»»»»»»»»»»»»»»»»»» Process

                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\csrss.exe
                            C:\WINDOWS\SYSTEM32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\a-squared Free\a2service.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                            C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
                            C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
                            C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
                            C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
                            C:\WINDOWS\System32\igfxtray.exe
                            C:\WINDOWS\System32\hkcmd.exe
                            C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
                            C:\WINDOWS\tppaldr.exe
                            C:\WINDOWS\system32\rundll32.exe
                            C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
                            C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                            C:\Program Files\QuickTime\qttask.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                            C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                            C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
                            C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
                            c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
                            C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
                            C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                            C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
                            C:\WINDOWS\system32\fxssvc.exe
                            C:\WINDOWS\System32\alg.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\explorer.exe
                            C:\Mozilla Firefox 3 Beta 5\firefox.exe
                            C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
                            C:\WINDOWS\system32\wscntfy.exe
                            C:\WINDOWS\SYSTEM32\NOTEPAD.EXE
                            C:\WINDOWS\system32\cmd.exe
                            C:\WINDOWS\System32\wbem\wmiprvse.exe

                            »»»»»»»»»»»»»»»»»»»»»»»» hosts

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\COMADIM

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\COMADIM\Application Data

                            »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\COMADIM\Favoris

                            »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                            »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                            »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                            "Source"=""
                            "SubscribedURL"=""
                            "FriendlyName"="Privacy Protection"

                            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
                            "Source"="About:Home"
                            "SubscribedURL"="About:Home"
                            "FriendlyName"="Ma page d'accueil"

                            »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            IEDFix
                            Credits: Malware Analysis & Diagnostic
                            Code: S!Ri

                            »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            VACFix
                            Credits: Malware Analysis & Diagnostic
                            Code: S!Ri

                            »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            404Fix
                            Credits: Malware Analysis & Diagnostic
                            Code: S!Ri

                            »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            SrchSTS.exe by S!Ri
                            Search SharedTaskScheduler's .dll

                            »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                            "AppInit_DLLs"=""

                            »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                            "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

                            »»»»»»»»»»»»»»»»»»»»»»»» Rustock

                            »»»»»»»»»»»»»»»»»»»»»»»» DNS

                            Description: Intel(R) PRO/100 VE Network Connection - Miniport d'ordonnancement de paquets
                            DNS Server Search Order: 208.67.220.220
                            DNS Server Search Order: 208.67.222.222

                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: DhcpNameServer=192.168.1.1
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{EB0DF2DF-66A9-4137-A661-F908B199779A}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer=80.10.246.2,80.10.246.129
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{EB0DF2DF-66A9-4137-A661-F908B199779A}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: DhcpNameServer=192.168.1.1
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{EB0DF2DF-66A9-4137-A661-F908B199779A}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                            »»»»»»»»»»»»»»»»»»»»»»»» Fin

                            ______________________________________________________________

                            ++
                            0
                            1. Chamallow
                              Bonjour,

                              Réparation SmitFraudFix effectuée en mode sans echec. la réparation des fichiers infectés ne m'a pas été proposé mais au redémarrage, il n'y avait plus de fond d'écran (que j'avais rechangé entre temps).

                              Ci dessous, rapport SMITFRAUDFIX (la liste des host à été réduite volontairement).
                              ___________________________________________________________________________

                              SmitFraudFix v2.320

                              Rapport fait à 8:22:13,40, 20/05/2008
                              Executé à partir de C:\Documents and Settings\COMADIM\Bureau\SmitfraudFix
                              OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                              Le type du système de fichiers est NTFS
                              Fix executé en mode sans echec

                              »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              SrchSTS.exe by S!Ri
                              Search SharedTaskScheduler's .dll

                              »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                              »»»»»»»»»»»»»»»»»»»»»»»» hosts

                              127.0.0.1 007guard.com
                              127.0.0.1 www.007guard.com
                              127.0.0.1 008i.com
                              127.0.0.1 Beaucoup ont été enlevé. Ce sont les entrées ajoutées par Spybot
                              127.0.0.1 zyban-zocor-levitra.com

                              »»»»»»»»»»»»»»»»»»»»»»»» VACFix

                              VACFix
                              Credits: Malware Analysis & Diagnostic
                              Code: S!Ri

                              »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

                              S!Ri's WS2Fix: LSP not Found.

                              »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                              GenericRenosFix by S!Ri

                              »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                              »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

                              IEDFix
                              Credits: Malware Analysis & Diagnostic
                              Code: S!Ri

                              »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

                              404Fix
                              Credits: Malware Analysis & Diagnostic
                              Code: S!Ri

                              »»»»»»»»»»»»»»»»»»»»»»»» DNS

                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: DhcpNameServer=192.168.1.1
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\..\{EB0DF2DF-66A9-4137-A661-F908B199779A}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer=80.10.246.2,80.10.246.129
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\..\{EB0DF2DF-66A9-4137-A661-F908B199779A}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: DhcpNameServer=192.168.1.1
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\..\{EB0DF2DF-66A9-4137-A661-F908B199779A}: DhcpNameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                              HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
                              HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                              HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222

                              »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

                              »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

                              »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                              Nettoyage terminé.

                              »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
                              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                              SrchSTS.exe by S!Ri
                              Search SharedTaskScheduler's .dll

                              »»»»»»»»»»»»»»»»»»»»»»»» Fin


                              Ci dessous, Rapport HijackThis
                              _______________________________________________________________________________

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 08:55:46, on 20/05/2008
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16640)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\SYSTEM32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\a-squared Free\a2service.exe
                              C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                              C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
                              C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
                              C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
                              C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
                              C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
                              C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
                              C:\WINDOWS\Explorer.EXE
                              c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
                              C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
                              C:\WINDOWS\System32\igfxtray.exe
                              C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                              C:\WINDOWS\System32\hkcmd.exe
                              C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
                              C:\WINDOWS\tppaldr.exe
                              C:\WINDOWS\system32\rundll32.exe
                              C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
                              C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                              C:\Program Files\QuickTime\qttask.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                              C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                              C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
                              C:\WINDOWS\system32\fxssvc.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
                              C:\Mozilla Firefox 3 Beta 5\firefox.exe
                              C:\Documents and Settings\COMADIM\Bureau\HiJackThis.exe
                              C:\WINDOWS\system32\wscntfy.exe

                              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                              O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
                              O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
                              O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
                              O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
                              O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
                              O4 - HKLM\..\Run: [GW Port Controller] C:\Program Files\Samsung\SmarThru\PORTCTRL.EXE
                              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
                              O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
                              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                              O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                              O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                              O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                              O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
                              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                              O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                              O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                              O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{00BCC71A-E750-4143-BFB4-24B92181B0CB}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{20F80FAE-7742-47E8-B5DE-AD10B51981EA}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{3730FEB2-707C-4B86-9349-CC31CD971220}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{5268F041-8090-4EF8-9F3D-021885124427}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{67485070-31C1-4FFE-8485-17C349E7AE5B}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{72D76C66-2A0F-4C55-8100-96742427059C}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{D88C7D81-3A8B-46BA-A6E8-D9C6FC6BF0AD}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{D9401419-37FB-43CB-9315-834A01D1EC3C}: NameServer = 208.67.220.220,208.67.222.222
                              O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
                              O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\dnpo0173e.dll (file missing)
                              O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                              O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
                              O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
                              O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                              O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
                              O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
                              O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
                              O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
                              O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
                              O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
                              O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
                              O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
                              O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                              O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                              O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                              O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                              O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                              O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
                              0