Win32:Swizzor [Trj] vilain garçon !! Fermé

Question

Bonjour, cela fait plusieurs mois que Win32:Swizzor [Trj] se déclare avec Avast! et se balade malgré si je le supprime ou même au scan au démarrage. Et quand je supprime il revient. 

J'ai fait un test avec Virus Total pour vérifier si c'était un virus et non pas une fabulation de Avast (si c'était un gen)

le résultat du test est ici : http://www.virustotal.com/fr/analisis/8968502025ee81376996d2d21551a9ac

50 % des antivirus le trouve menaçant mais j'en suis persuadé qu'il l'ai car quand je regarde le chemin où se trouve le virus je vais dans le dossier mais celui-ci est vide. Donc il se sauve, monsieur. 


Si vous avez des idées allez-y j'ai essayé Avast Cleanner aussi. 

Merci d'avance et à bientôt !!

verni29 · Answer

Bonjour,

Télécharge et installe HijackThis .
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

Choisir « Download Hijackthis Installer »
Après l'installation, un raccourci sera crée sur le bureau. Double-clique dessus pour le lancer ( si sous Vista -->  Click droit et executer en tant qu’administrateur )

Choisir l'option Do a system scan and save a logfile.
Le rapport va s'ouvrir. Tu copies/colles le contenu de ce rapport dans ton prochain message

A+

Utilisateur anonyme · Answer

Salut,

Pour suivre merci

anthonice · Answer

Merci de votre aide voici le rapport HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:22:26, on 21/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\lxcrcoms.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spnpinst.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Microsoft Windows Update] nqcwzod.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [Hold option boob bin] C:\Documents and Settings\All Users\Application Data\ford does hold option\Flap hole.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] nqcwzod.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [bird enc] C:\DOCUME~1\cecile\APPLIC~1\MOREWA~1\wipe vc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Filter hijack: text/html - {C6F62B7A-5450-4A2F-8687-6CEEC3AEB055} - C:\WINDOWS\system32\controlkids2.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcr_device -   - C:\WINDOWS\System32\lxcrcoms.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe

verni29 · Answer

Télécharge LopS&D. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 

Installe le logiciel. 
Une icône va apparaitre sur le bureau. Double clique dessus pour lancer le logiciel 
Tu choisis la langue et l'option 1 pour effectuer la recherche. 

A la fin de la recherche, un rapport LopR.txt apparait. Il se trouve en C:\LopR.txt. 
Tu posteras ce rapport dans le prochain message.

A+

verni29 · Answer

OK, A+

anthonice · Answer

Voici le rapport de LopS&D : 


   --------------------\  Lop S&D 4.2.3-4   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free :                 Intel(R) Celeron(R) CPU 2.53GHz )
   Phoenix ROM BIOS PLUS Version 1.10 A08
   USER : cecile ( Administrator )
   BOOT : Normal boot

   "C:\Lop SD" ( MAJ : 23-08-2008|10:35 )
   Option : [1] ( sam. 23/08/2008|14:32 )
 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [06/11/2007|23:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
   [06/11/2007|23:57] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [25/03/2008|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [07/11/2007|00:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [18/11/2007|18:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [25/12/2007|01:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Corel
   [06/11/2007|23:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [29/03/2008|21:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
   [07/11/2007|00:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FaxCtr
   [17/07/2008|13:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option
   [13/07/2008|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [22/08/2008|21:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [03/02/2008|16:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [28/04/2008|21:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
   [15/04/2008|19:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [18/11/2007|19:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [17/07/2008|13:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MP3 FILM ELSE PURE
   [03/02/2008|16:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [03/05/2008|12:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [07/11/2007|01:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [07/11/2007|01:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [10/02/2008|21:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [30/03/2008|17:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

   [01/07/2008|14:44] C:\DOCUME~1\anthony\APPLIC~1\Adobe
   [15/03/2008|16:37] C:\DOCUME~1\anthony\APPLIC~1\ArcSoft
   [26/03/2008|19:12] C:\DOCUME~1\anthony\APPLIC~1\DAEMON Tools
   [06/11/2007|23:44] C:\DOCUME~1\anthony\APPLIC~1\desktop.ini
   [05/07/2008|19:21] C:\DOCUME~1\anthony\APPLIC~1\dvdcss
   [06/07/2008|16:18] C:\DOCUME~1\anthony\APPLIC~1\FileZilla
   [20/04/2008|16:02] C:\DOCUME~1\anthony\APPLIC~1\flightgear.org
   [20/04/2008|16:02] C:\DOCUME~1\anthony\APPLIC~1\fltk.org
   [30/01/2008|17:07] C:\DOCUME~1\anthony\APPLIC~1\Google
   [26/06/2008|14:54] C:\DOCUME~1\anthony\APPLIC~1\Help
   [30/01/2008|16:40] C:\DOCUME~1\anthony\APPLIC~1\Identities
   [01/06/2008|20:47] C:\DOCUME~1\anthony\APPLIC~1\LimeWire
   [04/02/2008|16:23] C:\DOCUME~1\anthony\APPLIC~1\LogProtect
   [30/01/2008|17:08] C:\DOCUME~1\anthony\APPLIC~1\Macromedia
   [08/05/2008|09:41] C:\DOCUME~1\anthony\APPLIC~1\Microsoft
   [30/01/2008|16:46] C:\DOCUME~1\anthony\APPLIC~1\more wait poke
   [04/06/2008|06:58] C:\DOCUME~1\anthony\APPLIC~1\Mozilla
   [07/07/2008|13:58] C:\DOCUME~1\anthony\APPLIC~1\Nokia Multimedia Player
   [05/04/2008|16:06] C:\DOCUME~1\anthony\APPLIC~1\Nvu
   [01/06/2008|20:45] C:\DOCUME~1\anthony\APPLIC~1\OpenOffice.org2
   [30/03/2008|13:50] C:\DOCUME~1\anthony\APPLIC~1\PC Suite
   [17/07/2008|14:26] C:\DOCUME~1\anthony\APPLIC~1\SecondLife
   [26/06/2008|10:47] C:\DOCUME~1\anthony\APPLIC~1\Shareaza
   [05/04/2008|15:51] C:\DOCUME~1\anthony\APPLIC~1\Sun
   [26/06/2008|15:18] C:\DOCUME~1\anthony\APPLIC~1	eamspeak2
   [03/05/2008|08:09] C:\DOCUME~1\anthony\APPLIC~1\vlc

   [04/07/2008|15:16] C:\DOCUME~1\cecile\APPLIC~1\Adobe
   [12/11/2007|10:57] C:\DOCUME~1\cecile\APPLIC~1\Apple Computer
   [23/12/2007|23:59] C:\DOCUME~1\cecile\APPLIC~1\ArcSoft
   [11/07/2008|11:52] C:\DOCUME~1\cecile\APPLIC~1\BitTorrent
   [30/04/2008|13:48] C:\DOCUME~1\cecile\APPLIC~1\Corel
   [10/11/2007|19:24] C:\DOCUME~1\cecile\APPLIC~1\CyberLink
   [26/03/2008|19:03] C:\DOCUME~1\cecile\APPLIC~1\DAEMON Tools
   [29/03/2008|21:55] C:\DOCUME~1\cecile\APPLIC~1\DataLayer
   [06/11/2007|23:44] C:\DOCUME~1\cecile\APPLIC~1\desktop.ini
   [23/08/2008|14:26] C:\DOCUME~1\cecile\APPLIC~1\DNA
   [12/05/2008|19:33] C:\DOCUME~1\cecile\APPLIC~1\FaxCtr
   [03/06/2008|20:51] C:\DOCUME~1\cecile\APPLIC~1\FileZilla
   [30/03/2008|18:29] C:\DOCUME~1\cecile\APPLIC~1\flightgear.org
   [03/02/2008|16:42] C:\DOCUME~1\cecile\APPLIC~1\Google
   [07/11/2007|23:08] C:\DOCUME~1\cecile\APPLIC~1\Identities
   [03/02/2008|15:43] C:\DOCUME~1\cecile\APPLIC~1\Lavasoft
   [04/05/2008|10:24] C:\DOCUME~1\cecile\APPLIC~1\Leadertech
   [17/06/2008|16:38] C:\DOCUME~1\cecile\APPLIC~1\LimeWire
   [03/02/2008|15:42] C:\DOCUME~1\cecile\APPLIC~1\LogProtect
   [07/11/2007|23:31] C:\DOCUME~1\cecile\APPLIC~1\Macromedia
   [04/05/2008|12:04] C:\DOCUME~1\cecile\APPLIC~1\Microsoft
   [20/08/2008|18:29] C:\DOCUME~1\cecile\APPLIC~1\more wait poke
   [03/06/2008|17:32] C:\DOCUME~1\cecile\APPLIC~1\Mozilla
   [29/03/2008|21:58] C:\DOCUME~1\cecile\APPLIC~1\Nokia
   [29/03/2008|22:10] C:\DOCUME~1\cecile\APPLIC~1\Nokia Multimedia Player
   [30/06/2008|15:23] C:\DOCUME~1\cecile\APPLIC~1\Nvu
   [19/06/2008|18:35] C:\DOCUME~1\cecile\APPLIC~1\OpenOffice.org2
   [29/03/2008|21:51] C:\DOCUME~1\cecile\APPLIC~1\PC Suite
   [23/07/2008|12:05] C:\DOCUME~1\cecile\APPLIC~1\SecondLife
   [06/07/2008|12:39] C:\DOCUME~1\cecile\APPLIC~1\Shareaza
   [24/12/2007|00:46] C:\DOCUME~1\cecile\APPLIC~1\Sun
   [03/06/2008|16:54] C:\DOCUME~1\cecile\APPLIC~1\Talkback
   [05/06/2008|15:45] C:\DOCUME~1\cecile\APPLIC~1	eamspeak2
   [03/02/2008|22:03] C:\DOCUME~1\cecile\APPLIC~1\vlc

   [06/11/2007|23:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [07/11/2007|01:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [13/08/2008|15:08] C:\DOCUME~1\INVIT~1\APPLIC~1\Adobe
   [06/11/2007|23:44] C:\DOCUME~1\INVIT~1\APPLIC~1\desktop.ini
   [23/12/2007|15:41] C:\DOCUME~1\INVIT~1\APPLIC~1\FaxCtr
   [05/01/2008|10:02] C:\DOCUME~1\INVIT~1\APPLIC~1\Google
   [23/12/2007|15:41] C:\DOCUME~1\INVIT~1\APPLIC~1\Identities
   [30/03/2008|13:37] C:\DOCUME~1\INVIT~1\APPLIC~1\Macromedia
   [13/08/2008|14:06] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft
   [26/06/2008|13:49] C:\DOCUME~1\INVIT~1\APPLIC~1\Mozilla
   [13/08/2008|14:55] C:\DOCUME~1\INVIT~1\APPLIC~1\Nvu
   [30/03/2008|13:34] C:\DOCUME~1\INVIT~1\APPLIC~1\PC Suite
   [13/08/2008|14:38] C:\DOCUME~1\INVIT~1\APPLIC~1\Sun

   [20/04/2008|15:47] C:\DOCUME~1\jeremy\APPLIC~1\Adobe
   [06/11/2007|23:44] C:\DOCUME~1\jeremy\APPLIC~1\desktop.ini
   [07/11/2007|23:19] C:\DOCUME~1\jeremy\APPLIC~1\FaxCtr
   [20/04/2008|15:53] C:\DOCUME~1\jeremy\APPLIC~1\flightgear.org
   [20/04/2008|15:54] C:\DOCUME~1\jeremy\APPLIC~1\fltk.org
   [13/12/2007|17:47] C:\DOCUME~1\jeremy\APPLIC~1\Google
   [07/11/2007|23:19] C:\DOCUME~1\jeremy\APPLIC~1\Identities
   [13/12/2007|17:50] C:\DOCUME~1\jeremy\APPLIC~1\Macromedia
   [07/11/2007|23:19] C:\DOCUME~1\jeremy\APPLIC~1\Microsoft
   [17/07/2008|13:30] C:\DOCUME~1\jeremy\APPLIC~1\more wait poke
   [26/06/2008|12:34] C:\DOCUME~1\jeremy\APPLIC~1\Mozilla

   [26/06/2008|10:47] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [17/07/2008|13:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\more wait poke

   [06/11/2007|23:53] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [26/06/2008 12:41][--ah-----] C:\WINDOWS	asks\AC61159C910A8FC4.job
   [07/11/2007 00:04][--ah-----] C:\WINDOWS	asks\SA.DAT
   [28/08/2001 16:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   ( AC61159C910A8FC4.job )=( c:\docume~1\jeremy\applic~1\morewa~1\SectBoneMfcd.exe )

   --------------------\  Listing des dossiers dans C:\Program Files

   [01/07/2008|14:33] C:\Program Files\Adobe
   [18/11/2007|14:10] C:\Program Files\Alwil Software
   [07/11/2007|09:41] C:\Program Files\Analog Devices
   [24/05/2008|14:44] C:\Program Files\Audacity
   [13/07/2008|15:02] C:\Program Files\Audacity 1.3 Beta (Unicode)
   [11/07/2008|12:16] C:\Program Files\BitComet
   [08/07/2008|15:10] C:\Program Files\BitTorrent
   [02/12/2007|21:51] C:\Program Files\Bodom-Child - RaBBi
   [02/05/2008|21:47] C:\Program Files\Broadcom
   [30/06/2008|15:49] C:\Program Files\Chami
   [06/11/2007|23:51] C:\Program Files\ComPlus Applications
   [27/01/2008|21:35] C:\Program Files\Control Kids
   [30/04/2008|13:49] C:\Program Files\Corel
   [04/05/2008|10:07] C:\Program Files\CyberLink
   [26/03/2008|19:04] C:\Program Files\DAEMON Tools Lite
   [15/07/2008|15:33] C:\Program Files\Digital Line Detect
   [08/07/2008|15:01] C:\Program Files\DNA
   [07/06/2008|11:01] C:\Program Files\DVDVideoSoft
   [08/08/2008|20:23] C:\Program Files\eMule
   [13/07/2008|09:42] C:\Program Files\Fichiers communs
   [14/07/2008|20:06] C:\Program Files\FileZilla FTP Client
   [04/05/2008|10:29] C:\Program Files\FlightGear
   [07/11/2007|01:37] C:\Program Files\Free
   [30/06/2008|16:09] C:\Program Files\GIMP-2.0
   [23/07/2008|11:48] C:\Program Files\Google
   [07/06/2008|20:55] C:\Program Files\HomePlayer
   [18/11/2007|19:02] C:\Program Files\HP
   [15/07/2008|15:33] C:\Program Files\InstallShield Installation Information
   [14/07/2008|09:51] C:\Program Files\Internet Explorer
   [02/08/2008|14:26] C:\Program Files\JAP
   [16/07/2008|09:03] C:\Program Files\Java
   [03/02/2008|16:03] C:\Program Files\Lavasoft
   [05/02/2008|08:30] C:\Program Files\Lexmark 2400 Series
   [07/11/2007|00:39] C:\Program Files\Lexmark Fax Solutions
   [07/11/2007|00:44] C:\Program Files\Lexmark Toolbar
   [03/02/2008|16:27] C:\Program Files\LogProtect
   [23/08/2008|10:37] C:\Program Files\lx_cats
   [07/11/2007|09:35] C:\Program Files\messenger
   [04/06/2008|14:23] C:\Program Files\Messenger Plus! Live
   [06/11/2007|23:54] C:\Program Files\microsoft frontpage
   [04/05/2008|10:55] C:\Program Files\Microsoft Games
   [03/12/2007|21:22] C:\Program Files\Microsoft SQL Server Compact Edition
   [01/07/2008|19:00] C:\Program Files\Mindscape
   [10/02/2008|21:06] C:\Program Files\Moon Tycoon
   [21/06/2008|06:06] C:\Program Files\more wait poke
   [07/11/2007|01:08] C:\Program Files\movie maker
   [23/08/2008|14:17] C:\Program Files\Mozilla Firefox 3 Beta 5
   [06/11/2007|23:54] C:\Program Files\msn gaming zone
   [25/12/2007|12:34] C:\Program Files\MSXML 4.0
   [04/05/2008|10:09] C:\Program Files\NCH Swift Sound
   [07/11/2007|01:00] C:\Program Files\NetMeeting
   [29/03/2008|21:51] C:\Program Files\Nokia
   [05/04/2008|15:56] C:\Program Files\Nvu
   [14/06/2008|14:56] C:\Program Files\OpenOffice.org 2.3
   [14/06/2008|15:00] C:\Program Files\OpenOffice.org 2.4
   [07/11/2007|09:34] C:\Program Files\Outlook Express
   [30/06/2008|16:00] C:\Program Files\PhotoFiltre
   [20/08/2008|11:25] C:\Program Files\Pvm
   [07/11/2007|01:01] C:\Program Files\QuickTime
   [07/07/2008|14:07] C:\Program Files\RamBoost XP
   [20/08/2008|12:11] C:\Program Files\SecondLife
   [15/03/2008|13:16] C:\Program Files\Services en ligne
   [07/07/2008|14:15] C:\Program Files\Shareaza
   [03/02/2008|16:16] C:\Program Files\Spybot - Search & Destroy
   [05/06/2008|15:45] C:\Program Files\Teamspeak2_RC2
   [21/08/2008|15:21] C:\Program Files\Trend Micro
   [30/04/2008|13:51] C:\Program Files\Trojan Remover
   [30/06/2008|16:08] C:\Program Files\Ubisoft
   [07/11/2007|00:04] C:\Program Files\Uninstall Information
   [01/03/2008|23:03] C:\Program Files\USB Disk Win98 Driver
   [18/11/2007|19:31] C:\Program Files\VideoLAN
   [02/12/2007|21:05] C:\Program Files\Warp Engine Software
   [04/06/2008|14:22] C:\Program Files\Windows Live
   [07/05/2008|20:26] C:\Program Files\Windows Media Connect 2
   [07/05/2008|20:25] C:\Program Files\windows media player
   [07/11/2007|00:59] C:\Program Files\Windows NT
   [07/11/2007|00:12] C:\Program Files\WindowsUpdate
   [25/12/2007|17:35] C:\Program Files\WinRAR
   [06/11/2007|23:54] C:\Program Files\xerox
   [01/07/2008|19:05] C:\Program Files\Xvid
   [30/03/2008|17:08] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [01/07/2008|14:33] C:\Program Files\Fichiers communs\Adobe
   [07/06/2008|11:01] C:\Program Files\Fichiers communs\DVDVideoSoft
   [26/06/2008|10:20] C:\Program Files\Fichiers communs\InstallShield
   [23/12/2007|21:40] C:\Program Files\Fichiers communs\Java
   [07/11/2007|09:26] C:\Program Files\Fichiers communs\Microsoft Shared
   [06/11/2007|23:52] C:\Program Files\Fichiers communs\MSSoap
   [29/03/2008|21:51] C:\Program Files\Fichiers communs\Nokia
   [06/11/2007|23:53] C:\Program Files\Fichiers communs\ODBC
   [29/03/2008|21:51] C:\Program Files\Fichiers communs\PCSuite
   [06/11/2007|23:52] C:\Program Files\Fichiers communs\Services
   [07/11/2007|00:11] C:\Program Files\Fichiers communs\Softwin
   [06/11/2007|23:54] C:\Program Files\Fichiers communs\speechengines
   [07/11/2007|09:34] C:\Program Files\Fichiers communs\System
   [07/11/2007|09:25] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [03/02/2008|16:02] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 43 Processus )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option
   C:\DOCUME~1\anthony\APPLIC~1\morewa~1
   C:\DOCUME~1\cecile\APPLIC~1\morewa~1
   C:\DOCUME~1\jeremy\APPLIC~1\morewa~1
   C:\DOCUME~1\LOCALS~1\APPLIC~1\morewa~1
   C:\Program Files\morewa~1
   C:\DOCUME~1\cecile\Cookies\cecile@www.adserver5[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@www.adserver5[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@adin.bigpoint[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@bigpoint[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@fr1.seafight.bigpoint[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@banner.cotedazurpalace[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@cotedazurpalace[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@adopt.euroclick[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@adopt.euroclick[3].txt
   C:\DOCUME~1\cecile\Cookies\cecile@pacificpoker[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@pacificpoker[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@partygaming.122.2o7[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@partypoker[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@partypoker[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@fr1.seafight.bigpoint[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@32vegas[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@32vegas[3].txt
   C:\DOCUME~1\cecile\Cookies\cecile@banner.32vegas[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@banner.32vegas[3].txt
   C:\DOCUME~1\cecile\Cookies\cecile@www.32vegas[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@2xmoinscher[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@2xmoinscher[3].txt
   C:\DOCUME~1\cecile\Cookies\cecile@cc.2xmoinscher[2].txt
   C:\DOCUME~1\cecile\Cookies\cecile@www.2xmoinscher[1].txt
   C:\DOCUME~1\cecile\Cookies\cecile@888[1].txt
   C:\WINDOWS\Tasks\AC61159C910A8FC4.job
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "bird enc"="C:\DOCUME~1\cecile\APPLIC~1\MOREWA~1\wipe vc.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Hold option boob bin"="C:\Documents and Settings\All Users\Application Data\ford does hold option\Flap hole.exe"

   --------------------\  Verification du fichier Hosts

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
   127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
   127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

   -> 8810 [ 70 ## added by CiD ]

   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-08-23 14:33:54
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ALLUSE~1\Bureau\T‚l‚chargements arriv‚\Adobe Photoshop CS3 Premium French + Crack full.rar


   [F:1293][D:29]-> C:\DOCUME~1\cecile\LOCALS~1\Temp
   [F:379][D:0]-> C:\DOCUME~1\cecile\Cookies
   [F:1637][D:13]-> C:\DOCUME~1\cecile\LOCALS~1\TEMPOR~1\content.IE5

   --------------------\  Fin du rapport a 14:35:21

verni29 · Answer

Un e information sur comment on attrape cette infection.

On attrape ces pubs via justement des bannières de publicités sur des pages Webs ou en installant certains logiciels comme : 
* BitDownload 
* BitGrabber 
* BitRoll 
* MessengerPlus! 3 sous le nom de sponsors 
* Messenger Plus! Live sous le nom de sponsors 
* NetPumper 
* TorrentQ 
* Torrent101

1) Relance le logiciel LopS&D.
Choisis l'option 2 pour supprimer l'infection et réinitialiser le fichier Hosts.
A la fin du nettoyage, un rapport LopR.txt apparait. Il se trouve en C:\LopR.txt. Tu posteras ce rapport dans le prochain message.

Désinstalle LopS&D par la panneau de configuration et Ajout/Suppression de programmes.
Puis redémarre l'ordinateur.

2) Poste moi un nouveau rapport Hijackthis.

A+

TOTOF20 · Answer

je vien d'avoir le meme probleme depuis hier soir j'ai le trojan swizzor qui me gomfle donc si j'ai bien comris je le telecharge  apres option 1 pour le rapport que je poste ici ? et apres option pour  le supprimer et apres le desintaller c bien sa ?

verni29 · Answer

TOTOF20,

Il est préférable que tu ouvres ton propre sujet ( plutôt que de répondre dans une discussion en cours )
Chaque cas est différent et la personne qui te suivra t'indiquera les outils à utiliser.

Merci.

anthonice · Answer

Merci verni

Voici le rapport LopS&D : 


   --------------------\  Lop S&D 4.2.3-4   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free :                 Intel(R) Celeron(R) CPU 2.53GHz )
   Phoenix ROM BIOS PLUS Version 1.10 A08
   USER : cecile ( Administrator )
   BOOT : Normal boot

   "C:\Lop SD" ( MAJ : 23-08-2008|10:35 )
   Option : [2] ( jeu. 28/08/2008|11:18 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@www.adserver5[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@www.adserver5[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@adin.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@bigpoint[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@fr1.seafight.bigpoint[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@banner.cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@adopt.euroclick[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@adopt.euroclick[3].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@pacificpoker[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@pacificpoker[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@partygaming.122.2o7[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@partypoker[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@partypoker[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@32vegas[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@32vegas[3].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@banner.32vegas[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@banner.32vegas[3].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@www.32vegas[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@2xmoinscher[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@2xmoinscher[3].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@cc.2xmoinscher[2].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@www.2xmoinscher[1].txt
   Supprime! - C:\DOCUME~1\cecile\Cookies\cecile@888[1].txt
   Supprime! - C:\WINDOWS\Tasks\AC61159C910A8FC4.job 
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\ford does hold option
   Supprime! - C:\DOCUME~1\anthony\APPLIC~1\morewa~1
   Supprime! - C:\DOCUME~1\cecile\APPLIC~1\morewa~1
   Supprime! - C:\DOCUME~1\jeremy\APPLIC~1\morewa~1
   Supprime! - C:\DOCUME~1\LOCALS~1\APPLIC~1\morewa~1
   Supprime! - C:\Program Files\morewa~1
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [06/11/2007|23:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
   [06/11/2007|23:57] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [25/03/2008|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [07/11/2007|00:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [18/11/2007|18:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [25/12/2007|01:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Corel
   [06/11/2007|23:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [29/03/2008|21:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
   [07/11/2007|00:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FaxCtr
   [13/07/2008|15:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [28/08/2008|08:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [23/08/2008|15:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [28/04/2008|21:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
   [15/04/2008|19:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [18/11/2007|19:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [17/07/2008|13:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MP3 FILM ELSE PURE
   [24/08/2008|15:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [03/05/2008|12:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [07/11/2007|01:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [07/11/2007|01:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [10/02/2008|21:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [30/03/2008|17:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

   [01/07/2008|14:44] C:\DOCUME~1\anthony\APPLIC~1\Adobe
   [15/03/2008|16:37] C:\DOCUME~1\anthony\APPLIC~1\ArcSoft
   [26/03/2008|19:12] C:\DOCUME~1\anthony\APPLIC~1\DAEMON Tools
   [06/11/2007|23:44] C:\DOCUME~1\anthony\APPLIC~1\desktop.ini
   [05/07/2008|19:21] C:\DOCUME~1\anthony\APPLIC~1\dvdcss
   [06/07/2008|16:18] C:\DOCUME~1\anthony\APPLIC~1\FileZilla
   [20/04/2008|16:02] C:\DOCUME~1\anthony\APPLIC~1\flightgear.org
   [20/04/2008|16:02] C:\DOCUME~1\anthony\APPLIC~1\fltk.org
   [30/01/2008|17:07] C:\DOCUME~1\anthony\APPLIC~1\Google
   [26/06/2008|14:54] C:\DOCUME~1\anthony\APPLIC~1\Help
   [30/01/2008|16:40] C:\DOCUME~1\anthony\APPLIC~1\Identities
   [01/06/2008|20:47] C:\DOCUME~1\anthony\APPLIC~1\LimeWire
   [04/02/2008|16:23] C:\DOCUME~1\anthony\APPLIC~1\LogProtect
   [30/01/2008|17:08] C:\DOCUME~1\anthony\APPLIC~1\Macromedia
   [08/05/2008|09:41] C:\DOCUME~1\anthony\APPLIC~1\Microsoft
   [04/06/2008|06:58] C:\DOCUME~1\anthony\APPLIC~1\Mozilla
   [07/07/2008|13:58] C:\DOCUME~1\anthony\APPLIC~1\Nokia Multimedia Player
   [05/04/2008|16:06] C:\DOCUME~1\anthony\APPLIC~1\Nvu
   [01/06/2008|20:45] C:\DOCUME~1\anthony\APPLIC~1\OpenOffice.org2
   [30/03/2008|13:50] C:\DOCUME~1\anthony\APPLIC~1\PC Suite
   [17/07/2008|14:26] C:\DOCUME~1\anthony\APPLIC~1\SecondLife
   [26/06/2008|10:47] C:\DOCUME~1\anthony\APPLIC~1\Shareaza
   [05/04/2008|15:51] C:\DOCUME~1\anthony\APPLIC~1\Sun
   [26/06/2008|15:18] C:\DOCUME~1\anthony\APPLIC~1	eamspeak2
   [03/05/2008|08:09] C:\DOCUME~1\anthony\APPLIC~1\vlc

   [04/07/2008|15:16] C:\DOCUME~1\cecile\APPLIC~1\Adobe
   [12/11/2007|10:57] C:\DOCUME~1\cecile\APPLIC~1\Apple Computer
   [23/12/2007|23:59] C:\DOCUME~1\cecile\APPLIC~1\ArcSoft
   [11/07/2008|11:52] C:\DOCUME~1\cecile\APPLIC~1\BitTorrent
   [30/04/2008|13:48] C:\DOCUME~1\cecile\APPLIC~1\Corel
   [10/11/2007|19:24] C:\DOCUME~1\cecile\APPLIC~1\CyberLink
   [26/03/2008|19:03] C:\DOCUME~1\cecile\APPLIC~1\DAEMON Tools
   [29/03/2008|21:55] C:\DOCUME~1\cecile\APPLIC~1\DataLayer
   [06/11/2007|23:44] C:\DOCUME~1\cecile\APPLIC~1\desktop.ini
   [28/08/2008|11:16] C:\DOCUME~1\cecile\APPLIC~1\DNA
   [12/05/2008|19:33] C:\DOCUME~1\cecile\APPLIC~1\FaxCtr
   [03/06/2008|20:51] C:\DOCUME~1\cecile\APPLIC~1\FileZilla
   [30/03/2008|18:29] C:\DOCUME~1\cecile\APPLIC~1\flightgear.org
   [03/02/2008|16:42] C:\DOCUME~1\cecile\APPLIC~1\Google
   [07/11/2007|23:08] C:\DOCUME~1\cecile\APPLIC~1\Identities
   [03/02/2008|15:43] C:\DOCUME~1\cecile\APPLIC~1\Lavasoft
   [04/05/2008|10:24] C:\DOCUME~1\cecile\APPLIC~1\Leadertech
   [17/06/2008|16:38] C:\DOCUME~1\cecile\APPLIC~1\LimeWire
   [03/02/2008|15:42] C:\DOCUME~1\cecile\APPLIC~1\LogProtect
   [07/11/2007|23:31] C:\DOCUME~1\cecile\APPLIC~1\Macromedia
   [04/05/2008|12:04] C:\DOCUME~1\cecile\APPLIC~1\Microsoft
   [03/06/2008|17:32] C:\DOCUME~1\cecile\APPLIC~1\Mozilla
   [29/03/2008|21:58] C:\DOCUME~1\cecile\APPLIC~1\Nokia
   [29/03/2008|22:10] C:\DOCUME~1\cecile\APPLIC~1\Nokia Multimedia Player
   [30/06/2008|15:23] C:\DOCUME~1\cecile\APPLIC~1\Nvu
   [27/08/2008|09:05] C:\DOCUME~1\cecile\APPLIC~1\OpenOffice.org2
   [29/03/2008|21:51] C:\DOCUME~1\cecile\APPLIC~1\PC Suite
   [23/07/2008|12:05] C:\DOCUME~1\cecile\APPLIC~1\SecondLife
   [06/07/2008|12:39] C:\DOCUME~1\cecile\APPLIC~1\Shareaza
   [24/12/2007|00:46] C:\DOCUME~1\cecile\APPLIC~1\Sun
   [03/06/2008|16:54] C:\DOCUME~1\cecile\APPLIC~1\Talkback
   [05/06/2008|15:45] C:\DOCUME~1\cecile\APPLIC~1	eamspeak2
   [03/02/2008|22:03] C:\DOCUME~1\cecile\APPLIC~1\vlc

   [06/11/2007|23:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [07/11/2007|01:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [13/08/2008|15:08] C:\DOCUME~1\INVIT~1\APPLIC~1\Adobe
   [06/11/2007|23:44] C:\DOCUME~1\INVIT~1\APPLIC~1\desktop.ini
   [23/12/2007|15:41] C:\DOCUME~1\INVIT~1\APPLIC~1\FaxCtr
   [05/01/2008|10:02] C:\DOCUME~1\INVIT~1\APPLIC~1\Google
   [23/12/2007|15:41] C:\DOCUME~1\INVIT~1\APPLIC~1\Identities
   [30/03/2008|13:37] C:\DOCUME~1\INVIT~1\APPLIC~1\Macromedia
   [13/08/2008|14:06] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft
   [26/06/2008|13:49] C:\DOCUME~1\INVIT~1\APPLIC~1\Mozilla
   [13/08/2008|14:55] C:\DOCUME~1\INVIT~1\APPLIC~1\Nvu
   [30/03/2008|13:34] C:\DOCUME~1\INVIT~1\APPLIC~1\PC Suite
   [13/08/2008|14:38] C:\DOCUME~1\INVIT~1\APPLIC~1\Sun

   [20/04/2008|15:47] C:\DOCUME~1\jeremy\APPLIC~1\Adobe
   [06/11/2007|23:44] C:\DOCUME~1\jeremy\APPLIC~1\desktop.ini
   [07/11/2007|23:19] C:\DOCUME~1\jeremy\APPLIC~1\FaxCtr
   [20/04/2008|15:53] C:\DOCUME~1\jeremy\APPLIC~1\flightgear.org
   [20/04/2008|15:54] C:\DOCUME~1\jeremy\APPLIC~1\fltk.org
   [13/12/2007|17:47] C:\DOCUME~1\jeremy\APPLIC~1\Google
   [07/11/2007|23:19] C:\DOCUME~1\jeremy\APPLIC~1\Identities
   [13/12/2007|17:50] C:\DOCUME~1\jeremy\APPLIC~1\Macromedia
   [07/11/2007|23:19] C:\DOCUME~1\jeremy\APPLIC~1\Microsoft
   [26/06/2008|12:34] C:\DOCUME~1\jeremy\APPLIC~1\Mozilla

   [26/06/2008|10:47] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [06/11/2007|23:53] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [07/11/2007 00:04][--ah-----] C:\WINDOWS	asks\SA.DAT
   [28/08/2001 16:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [01/07/2008|14:33] C:\Program Files\Adobe
   [18/11/2007|14:10] C:\Program Files\Alwil Software
   [07/11/2007|09:41] C:\Program Files\Analog Devices
   [24/05/2008|14:44] C:\Program Files\Audacity
   [13/07/2008|15:02] C:\Program Files\Audacity 1.3 Beta (Unicode)
   [11/07/2008|12:16] C:\Program Files\BitComet
   [08/07/2008|15:10] C:\Program Files\BitTorrent
   [02/12/2007|21:51] C:\Program Files\Bodom-Child - RaBBi
   [02/05/2008|21:47] C:\Program Files\Broadcom
   [30/06/2008|15:49] C:\Program Files\Chami
   [06/11/2007|23:51] C:\Program Files\ComPlus Applications
   [27/01/2008|21:35] C:\Program Files\Control Kids
   [30/04/2008|13:49] C:\Program Files\Corel
   [04/05/2008|10:07] C:\Program Files\CyberLink
   [26/03/2008|19:04] C:\Program Files\DAEMON Tools Lite
   [15/07/2008|15:33] C:\Program Files\Digital Line Detect
   [08/07/2008|15:01] C:\Program Files\DNA
   [07/06/2008|11:01] C:\Program Files\DVDVideoSoft
   [23/08/2008|22:12] C:\Program Files\eMule
   [23/08/2008|15:26] C:\Program Files\Fichiers communs
   [14/07/2008|20:06] C:\Program Files\FileZilla FTP Client
   [04/05/2008|10:29] C:\Program Files\FlightGear
   [07/11/2007|01:37] C:\Program Files\Free
   [30/06/2008|16:09] C:\Program Files\GIMP-2.0
   [23/07/2008|11:48] C:\Program Files\Google
   [07/06/2008|20:55] C:\Program Files\HomePlayer
   [18/11/2007|19:02] C:\Program Files\HP
   [15/07/2008|15:33] C:\Program Files\InstallShield Installation Information
   [14/07/2008|09:51] C:\Program Files\Internet Explorer
   [02/08/2008|14:26] C:\Program Files\JAP
   [16/07/2008|09:03] C:\Program Files\Java
   [23/08/2008|15:26] C:\Program Files\Lavasoft
   [05/02/2008|08:30] C:\Program Files\Lexmark 2400 Series
   [07/11/2007|00:39] C:\Program Files\Lexmark Fax Solutions
   [07/11/2007|00:44] C:\Program Files\Lexmark Toolbar
   [03/02/2008|16:27] C:\Program Files\LogProtect
   [28/08/2008|08:46] C:\Program Files\lx_cats
   [07/11/2007|09:35] C:\Program Files\messenger
   [04/06/2008|14:23] C:\Program Files\Messenger Plus! Live
   [06/11/2007|23:54] C:\Program Files\microsoft frontpage
   [04/05/2008|10:55] C:\Program Files\Microsoft Games
   [03/12/2007|21:22] C:\Program Files\Microsoft SQL Server Compact Edition
   [01/07/2008|19:00] C:\Program Files\Mindscape
   [10/02/2008|21:06] C:\Program Files\Moon Tycoon
   [07/11/2007|01:08] C:\Program Files\movie maker
   [28/08/2008|08:57] C:\Program Files\Mozilla Firefox 3 Beta 5
   [06/11/2007|23:54] C:\Program Files\msn gaming zone
   [25/12/2007|12:34] C:\Program Files\MSXML 4.0
   [04/05/2008|10:09] C:\Program Files\NCH Swift Sound
   [07/11/2007|01:00] C:\Program Files\NetMeeting
   [29/03/2008|21:51] C:\Program Files\Nokia
   [05/04/2008|15:56] C:\Program Files\Nvu
   [14/06/2008|14:56] C:\Program Files\OpenOffice.org 2.3
   [14/06/2008|15:00] C:\Program Files\OpenOffice.org 2.4
   [07/11/2007|09:34] C:\Program Files\Outlook Express
   [30/06/2008|16:00] C:\Program Files\PhotoFiltre
   [20/08/2008|11:25] C:\Program Files\Pvm
   [07/11/2007|01:01] C:\Program Files\QuickTime
   [07/07/2008|14:07] C:\Program Files\RamBoost XP
   [20/08/2008|12:11] C:\Program Files\SecondLife
   [15/03/2008|13:16] C:\Program Files\Services en ligne
   [07/07/2008|14:15] C:\Program Files\Shareaza
   [24/08/2008|15:51] C:\Program Files\Spybot - Search & Destroy
   [05/06/2008|15:45] C:\Program Files\Teamspeak2_RC2
   [21/08/2008|15:21] C:\Program Files\Trend Micro
   [30/04/2008|13:51] C:\Program Files\Trojan Remover
   [30/06/2008|16:08] C:\Program Files\Ubisoft
   [07/11/2007|00:04] C:\Program Files\Uninstall Information
   [01/03/2008|23:03] C:\Program Files\USB Disk Win98 Driver
   [18/11/2007|19:31] C:\Program Files\VideoLAN
   [02/12/2007|21:05] C:\Program Files\Warp Engine Software
   [04/06/2008|14:22] C:\Program Files\Windows Live
   [07/05/2008|20:26] C:\Program Files\Windows Media Connect 2
   [07/05/2008|20:25] C:\Program Files\windows media player
   [07/11/2007|00:59] C:\Program Files\Windows NT
   [07/11/2007|00:12] C:\Program Files\WindowsUpdate
   [25/12/2007|17:35] C:\Program Files\WinRAR
   [06/11/2007|23:54] C:\Program Files\xerox
   [01/07/2008|19:05] C:\Program Files\Xvid
   [30/03/2008|17:08] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [01/07/2008|14:33] C:\Program Files\Fichiers communs\Adobe
   [07/06/2008|11:01] C:\Program Files\Fichiers communs\DVDVideoSoft
   [26/06/2008|10:20] C:\Program Files\Fichiers communs\InstallShield
   [23/12/2007|21:40] C:\Program Files\Fichiers communs\Java
   [07/11/2007|09:26] C:\Program Files\Fichiers communs\Microsoft Shared
   [06/11/2007|23:52] C:\Program Files\Fichiers communs\MSSoap
   [29/03/2008|21:51] C:\Program Files\Fichiers communs\Nokia
   [06/11/2007|23:53] C:\Program Files\Fichiers communs\ODBC
   [29/03/2008|21:51] C:\Program Files\Fichiers communs\PCSuite
   [06/11/2007|23:52] C:\Program Files\Fichiers communs\Services
   [07/11/2007|00:11] C:\Program Files\Fichiers communs\Softwin
   [06/11/2007|23:54] C:\Program Files\Fichiers communs\speechengines
   [07/11/2007|09:34] C:\Program Files\Fichiers communs\System
   [07/11/2007|09:25] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [23/08/2008|15:26] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 44 Processus )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-08-28 11:21:00
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ALLUSE~1\Bureau\T‚l‚chargements arriv‚\Adobe Photoshop CS3 Premium French + Crack full.rar


   [F:16][D:29]-> C:\DOCUME~1\cecile\LOCALS~1\Temp
   [F:355][D:0]-> C:\DOCUME~1\cecile\Cookies
   [F:2068][D:13]-> C:\DOCUME~1\cecile\LOCALS~1\TEMPOR~1\content.IE5

   --------------------\  Fin du rapport a 11:22:38


Voici le rapport HijackThis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:25:05, on 28/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\lxcrcoms.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\cecile\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Microsoft Windows Update] nqcwzod.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] nqcwzod.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Filter hijack: text/html - {C6F62B7A-5450-4A2F-8687-6CEEC3AEB055} - C:\WINDOWS\system32\controlkids2.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcr_device -   - C:\WINDOWS\System32\lxcrcoms.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe

verni29 · Answer

Je te conseille de noter ou d'imprimer ce texte car la désinfection va se faire en mode sans échec.
Autre astuce : Copie/colle le texte dans un fichier .txt que tu enregistres sur ton bureau.

Tu télécharges MalwareBytes. 
http://www.malwarebytes.org/mbam/program/mbam-setup.exe 

Tu l'installes. Choisis les options par défaut. 
A la fin de l’installation, il te sera demandé de mettre à jour MalwareBytes et de l’exécuter . 
Ne choisis que la mise à jour. Le logiciel sera lancé en mode sans échec. 

Tu relances l'ordinateur en mode sans échec ( touche F8 après redémarrage ). 
Tu choisis ton compte utilisateur. 

Pour lancer MalwareBytes, double-clique sur le raccourci du bureau. 

Dans l’onglet Recherche, sélectionne Exécuter un examen complet. 
Clique sur recherche. Tu ne sélectionnes que les disques durs de l’ordinateur. 
Clique sur lancer l’examen. 

A la fin de la recherche, Comme il est demandé, clique sur afficher les résultats de la recherche. 
Choisis alors Supprimer la selection pour nettoyer les infections. 
Tu postes le rapport dans ton prochain message.
Si tu ne le retrouves pas, ouvre MalwareBytes et regarde dans l’onglet Rapport/logs. Il y est.
Clique dessus et choisir ouvrir.

Le scan prend environ 50 mn.

A+

anthonice · Answer

Merci verni je ferai ça plustard car e vais partir.

verni29 · Answer

OK, A+

anthonice · Answer

Voici le rapport de Malwarebytes : (il n'y avait pas d'infection m'a-t-il signalé à la fin de scan)

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1102
Windows 5.1.2600 Service Pack 2

11:29:35 2/09/2008
mbam-log-09-02-2008 (11-29-35).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 160421
Temps écoulé: 1 hour(s), 51 minute(s), 15 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

verni29 · Answer

Bonjour, 

Tu peux faire une dernière vérifiaction avec un scan en ligne.

Tu vas sur le site de Kaspersky:
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Clique sur Demarrer Online-scanner ( en bas de page à droite ) pour commencer l'analyse.
Il te sera demandé d'installer un logiciel de Kaspersky, accepte.

A la fin de cette analyse, clique sur enregistrer le rapport.
Poste le contenu de ce rapport dans ton prochain message.

A+

anthonice · Answer

L'analyse a bugué à 59 % soit 4 h et quelques car elle vérifie tout et j'ai de très gros fichiers; elle avait trouvé 1 virus et un fichier suspect donc 2 problèmes, as-tu une autre solution ?

verni29 · Answer

1) Il faudrait analyser le fichier suivant nqcwzod.exe .
Pour cela, il faudrait connaitre sa localisation sur le PC.

C'est peut-être un fichier caché. fais apparaitre les dossiers et fichiers cachés.
Poste de travail --> outils --> options --> cocher " afficher les dossiers et fichiers cachés "

Lance une recherche sur le fichier que je t'ai indiqué.

Puis, Tu vas sur le site de VirusTotal et tu vas pouvoir analyser le fichier.
https://www.virustotal.com/gui/
Tu cliques sur parcourir pour sélectionner ce fichier sur ton disque dur.
Tu cliques ensuite sur envoyer le fichier.
Tu postes le rapport de l'analyse ( pour cela, tu sélectionnes la zone de résultat --> click droit --> copier )

2) Il serait bon de faire l'analyse avec un autre antivirus que avast.

télécharge la version d'évaluation de kaspersky :
https://www.kaspersky.fr/downloads?chapter=186498689

Installe cette version d'évaluation.
lance le scan avec cet antivirus. N'oublie pas de désactiver Avast.
poste le rapport du scan puis désinstalle la version que tu as installé.

A+

anthonice · Answer

dac, en gros je suis pas sorti de l'auberge ? je ferai sa plustard
merci vraiment verni pour ton aide

verni29 · Answer

citation : en gros je suis pas sorti de l'auberge

Non, au contraire. Le roblème des pages de pubs CID est réglé.
Il reste à vérifier si tu n'as pas d'autres virus sur ton PC.
On verra bien.

A+

anthonice · Answer

bah yen avait je ferai sa plustard car je passe au vol.

anthonice · Answer

J'ai recherché le fameux nqcwzod.exe mais aucun fichier de ce nom a été trouvé ? Bizard ^^
J'ai fait aussi un scan sur www.infecteoupas.com ou autrement dit pandasecurity et Kaspersky veut absolument que je désinstalle Avast même si il est désactivé (aujourd'hui Avast! a abboyé 2 fois à propos de Win32 Swizzor gen (petite impression de déjà vu ! ))

verni29 · Answer

Poste moi un nouveau rapport Hijackthis.
L'infection est peut-être revenu si tu as installé un logiciel.
regarde la liste indiquée dans le message 8 :
http://www.commentcamarche.net/forum/affich 7995879 win32 swizzor trj vilain garcon#8

A+

anthonice · Answer

Merci Verni encore

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:31:37, on 26/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\lxcrcoms.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe
C:\Documents and Settings\cecile\Bureau\HiJackThis.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Microsoft Windows Update] nqcwzod.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] nqcwzod.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Filter hijack: text/html - {C6F62B7A-5450-4A2F-8687-6CEEC3AEB055} - C:\WINDOWS\system32\controlkids2.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxcr_device -   - C:\WINDOWS\System32\lxcrcoms.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe

verni29 · Answer

Le rapport est propre.

Tu vas utiliser SDFix téléchargeable à :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Tu installes le logiciel.
Tu peux t’aider du tuto suivant :
https://www.malekal.com/slenfbot-still-an-other-irc-bot/ 

Il faut que tu redémarres en mode sans échec. 
Pour cela, tu redémarres ton ordinateur et tu appuies sur la touche F8.

A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Tu lances SDFix en double-cliquant sur RunThis.bat dans le dossier où tu as installé le logiciel.
T
on ordinateur va redémarrer. il te sera peut-être demander d'appuyer sur une touche pour redémarrer.
L'outil va continuer à travailler, c'est normal.

Une fois affiché Finished, appuie sur une touche pour finir l'exécution du logiciel.
Ton bureau devrait réapparaitre.

Ouvre le dossier de SDFix sur ton Bureau.
Copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum.

Avec un nouveau log HijackThis !

A+

anthonice · Answer

Merci 1000 fois Verni de ton aide 

Voici le rapport SDFix : 


[b]SDFix: Version 1.229 [/b]
Run by anthony on dim. 28/09/2008 at 20:56

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\MSNGR32.com - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 21:11:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:46,c0,0e,fb,d9,80,26,bd,17,1a,3c,29,1a,13,de,3d,a7,07,a8,09,52,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,28,92,38,5b,49,68,f1,6b,a0,35,47,49,cc,45,a2,39,2e,..
"khjeh"=hex:b7,d1,89,b3,15,46,bd,ae,05,b5,fc,41,a1,43,b9,c6,f8,df,3d,1f,e1,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:93,cb,19,85,5a,82,98,1c,6e,b8,9a,67,fe,9a,ef,69,5c,6e,9f,41,f3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:46,c0,0e,fb,d9,80,26,bd,17,1a,3c,29,1a,13,de,3d,a7,07,a8,09,52,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,28,92,38,5b,49,68,f1,6b,a0,35,47,49,cc,45,a2,39,2e,..
"khjeh"=hex:b7,d1,89,b3,15,46,bd,ae,05,b5,fc,41,a1,43,b9,c6,f8,df,3d,1f,e1,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:93,cb,19,85,5a,82,98,1c,6e,b8,9a,67,fe,9a,ef,69,5c,6e,9f,41,f3,..

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\anthony\Local Settings\Application Data\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : Boit@Look.lnk 1087 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"h"="h:*:Enabled:Microsoft Windows Update"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe"="C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe:*:Enabled:FreeCall"
"C:\Program Files\HomePlayer1.5\HomePlayer.exe"="C:\Program Files\HomePlayer1.5\HomePlayer.exe:*:Enabled:HomePlayer"
"C:\Program Files\HomePlayer1.5.3.1\HomePlayer.exe"="C:\Program Files\HomePlayer1.5.3.1\HomePlayer.exe:*:Enabled:HomePlayer"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\FlightGear\bin\win32\fgfs.exe"="C:\Program Files\FlightGear\bin\win32\fgfs.exe:*:Enabled:fgfs"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe"="C:\Program Files\Microsoft Games\Flight Simulator 9\fs9.exe:*:Enabled:Microsoft Flight Simulator"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\HomePlayer\HomePlayer.exe"="C:\Program Files\HomePlayer\HomePlayer.exe:*:Enabled:HomePlayer"
"C:\Tgl0beSCRIPT\mIRC.exe"="C:\Tgl0beSCRIPT\mIRC.exe:*:Enabled:mIRC"
"C:\wamp\bin\apache\apache2.2.8\bin\httpd.exe"="C:\wamp\bin\apache\apache2.2.8\bin\httpd.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\Shareaza\Shareaza.exe"="C:\Program Files\Shareaza\Shareaza.exe:*:Enabled:Shareaza Ultimate File Sharing"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\Program Files\SecondLife\SLVoice.exe"="C:\Program Files\SecondLife\SLVoice.exe:*:Enabled:SLVoice"
"C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe"="C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Microsoft Games\Flight Simulator 9\IBServ.exe"="C:\Program Files\Microsoft Games\Flight Simulator 9\IBServ.exe:*:Enabled:VAC"
"C:\Program Files\Microsoft Games\Flight Simulator 9\IBMegaServ.exe"="C:\Program Files\Microsoft Games\Flight Simulator 9\IBMegaServ.exe:*:Enabled:VAC"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"
"C:\Program Files\LeechFTP\Leechftp.exe"="C:\Program Files\LeechFTP\Leechftp.exe:*:Enabled:LeechFTP"
"C:\Program Files\MSN BackUp\MSNBackup.exe"="C:\Program Files\MSN BackUp\MSNBackup.exe:*:Enabled:MSN BackUp"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu  5 Jun 2008             0 ...HR --- "C:\Temp\GHJmX.tmp"
Thu  5 Jun 2008             0 ...HR --- "C:\Temp\HJUmW.tmp"
Thu 19 Aug 2004        60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Thu  5 Jun 2003        24,576 A..H. --- "C:\Program Files\RamBoost XP\StopRam.exe"
Mon 10 Mar 2008            88 ..SHR --- "C:\WINDOWS\system32\60DD08B0DB.sys"
Mon 10 Mar 2008         2,516 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sat  3 May 2008         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 18 Nov 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed  7 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0b94495512074d69b9e8ab1679d608d4\BIT9.tmp"
Wed  7 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2c94fdf84dc55e9a818c8222bafc1812\BIT1E.tmp"
Wed  7 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\56102acfc0bb685cc59421494156ad30\BIT1B.tmp"
Wed  7 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7dfe90ab9679753ce8e3ab64aba594fe\BITF.tmp"
Wed  7 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fc4064a7ce49878de7a430c59be1c819\BIT22.tmp"
Wed  7 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d2543d14ced0177a8154816e15636514\download\BIT2E.tmp"
Wed  7 Nov 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\da9428daf73da125c596ed070747be59\download\BIT35.tmp"

[b]Finished![/b]



Voici le rapport HijackThis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:16:13, on 28/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\lxcrcoms.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar	oolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Filter hijack: text/html - {C6F62B7A-5450-4A2F-8687-6CEEC3AEB055} - C:\WINDOWS\system32\controlkids2.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxcr_device -   - C:\WINDOWS\System32\lxcrcoms.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe

verni29 · Answer

Une dernière vérification.
Fais la partie 2 du message 18 :
http://www.commentcamarche.net/forum/affich 7995879 win32 swizzor trj vilain garcon#18

A+

anthonice · Answer

je ne peux pas, comme je te le disais il faut que je vire avast je l'ai fait la dernière fois et kaspersky m'a sorti un message d'erreur (que j'ai oublié ^^) aurait tu une autre idée ?

verni29 · Answer

Si je te demande de faire un scan en ligne, c'est simplement pour une dernière vérification de la présence de virus sur le PC.

On va donc le faire sur le site de BitDefender ( uniquement avec Internet Explorer ):
Suis le Tuto suivant. Pas de difficultés, si ce n'est que cela peut être assez long.
https://forum.pcastuces.com/default.asp

poste moi le rapport obtenu.

A+

anthonice · Answer

D'accord merci verni je te tiens au courrant.

Win32:Swizzor [Trj] vilain garçon !!

29 réponses

Discussions similaires