Virus redirection google

bjr

poste ton rapport hijack stp

pour voir...

a+

c'est fait
mais j'ai toujours le même problème avec google
voici le nouveau rapport :

----------------- FindyKill V4.705 ------------------

* User : Pomel - POMEL-E3110153F
* executed from : C:\Program Files\FindyKill
* Update on 17/11/08 par Chiquitine29
* Start at 19:40:49 the 23/11/2008
* Windows XP - Internet Explorer 7.0.5730.11

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

»»»» Supression files in C:\WINDOWS

»»»» Supression files in C:\WINDOWS\Prefetch

Deleted ! - C:\WINDOWS\prefetch\O4PATCH.EXE-17659A4A.pf

»»»» Supression files in C:\WINDOWS\system32

»»»» Supression files in C:\WINDOWS\system32\drivers

»»»» Supression files in C:\Documents and Settings\Pomel\Application Data

»»»» Supression files in C:\DOCUME~1\Pomel\LOCALS~1\Temp

»»»» Supression files in C:\Documents and Settings\Pomel\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA

--------------- [ States / Restarting of services ] ----------------

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe

E: - Lecteur amovible

+- deleting files :

--------------- [ Registry / Mountpoint2 ] ----------------

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a880ff0-12d3-11dd-a0fe-00173f6314e5}\Shell\AutoRun\command

--------------- [ Searching Cracks / Keygen ] ----------------

C:\Documents and Settings\Pomel\Mes documents\NC applications\Adobe Photoshop CS3 Extended + Patch FR\Adobe Photoshop CS3 Extended + Patch FR\Crack
C:\Documents and Settings\Pomel\Mes documents\NC applications\Adobe Photoshop CS3 Extended + Patch FR\Adobe Photoshop CS3 Extended + Patch FR\Crack\Comment cracker.txt
C:\Documents and Settings\Pomel\Mes documents\NC applications\Adobe Photoshop CS3 Extended + Patch FR\Adobe Photoshop CS3 Extended + Patch FR\Crack\Photoshop.exe
C:\Documents and Settings\Pomel\Mes documents\NC applications\Macromedia Studio 8 FR (Dreamweaver 8 - Fireworks 8 - Flash 8) + Kegen\Macromedia Studio 8.0 - Keygen.exe

---------------- ! End of report ! ------------------

Grrrrrr
C'est horrible ce truc
...
tu as une autre idée ?

pfiou !
ça y est, google remarche !

merci beaucoup pour ton aide ! vraiment merci merci merci !!

ah zut, j'y ai bien cru pourtant :o)

Voici le rapport :
ComboFix 08-11-22.02 - Pomel 2008-11-23 21:17:20.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.254 [GMT 1:00]

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Pomel\real.txt
c:\windows\IE4 Error Log.txt
c:\windows\system32\%%% %%^ %^%^^ %%^^ ^ ^ ^%%^ ^% ^ ^.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-23 au 2008-11-23 ))))))))))))))))))))))))))))))))))))
.

2008-11-23 19:21 . 2008-11-23 19:45 <REP> d-------- c:\program files\FindyKill
2008-11-23 15:14 . 2008-11-23 15:28 3,580 --a------ c:\windows\system32\tmp.reg
2008-11-23 11:45 . 2008-11-23 11:45 <REP> d-------- C:\_OTMoveIt
2008-11-23 11:21 . 2008-11-23 11:21 <REP> d-------- c:\program files\Trend Micro
2008-11-20 17:30 . 2008-11-20 17:30 260 --a------ c:\windows\_delis32.ini
2008-11-19 09:09 . 2008-11-20 09:04 <REP> d-------- c:\documents and settings\Pomel\Application Data\skypePM
2008-11-19 09:09 . 2008-11-19 09:09 56 --ah----- c:\windows\system32\ezsidmv.dat
2008-11-19 09:07 . 2008-11-19 09:07 <REP> d-------- c:\documents and settings\All Users\Application Data\Skype
2008-11-18 22:05 . 2008-11-19 09:00 73,728 --a------ c:\windows\system32\TDSSxfum.dll
2008-11-18 22:05 . 2008-11-19 09:00 31,232 --a------ c:\windows\system32\TDSSriqp.dll
2008-11-18 22:05 . 2008-11-19 09:00 29,696 --a------ c:\windows\system32\TDSSbrsr.dll
2008-11-18 22:05 . 2008-11-23 19:48 2,348 --a------ c:\windows\system32\TDSSlxwp.dll
2008-11-18 22:05 . 2008-11-19 09:00 527 --a------ c:\windows\system32\TDSSosvd.dat
2008-11-18 22:04 . 2008-11-19 09:00 60,416 --a------ c:\windows\system32\drivers\TDSSmqlt.sys
2008-11-18 22:04 . 2008-11-19 09:00 35,840 --a------ c:\windows\system32\TDSSoiqh.dll
2008-11-10 11:12 . 2008-11-10 11:12 <REP> d-------- c:\program files\Microsoft ActiveSync
2008-11-10 11:11 . 2008-11-10 11:11 <REP> d-------- c:\program files\Ressources Windows Mobile
2008-11-06 13:55 . 2008-11-06 13:55 <REP> d-------- c:\program files\Infogrames

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 17:16 --------- d-----w c:\documents and settings\Pomel\Application Data\FileZilla
2008-11-22 22:43 --------- d-----w c:\program files\DAEMON Tools
2008-11-20 16:35 --------- d-----w c:\program files\Logitech
2008-11-20 16:32 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-20 16:32 --------- d-----w c:\program files\Macromedia
2008-11-20 16:31 --------- d-----w c:\program files\Fichiers communs\Macromedia
2008-11-20 16:31 --------- d-----w c:\program files\Fichiers communs\Logitech
2008-11-06 12:41 --------- d-----w c:\documents and settings\Pomel\Application Data\uTorrent
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys
2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-26 08:11 826,368 ----a-w c:\windows\system32\wininet.dll
2008-01-26 17:26 15,397 ----a-w c:\program files\settings.dat
2007-12-14 22:43 641,236 ----a-w c:\documents and settings\Pomel\Application Data\mdbu.bin
2007-01-24 18:13 278,528 ----a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-04-24 327680]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2003-03-26 684032]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2003-05-01 180316]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"EPSON Stylus Photo RX700 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9IE.EXE" [2004-11-10 98304]
"D-Link AirPlus G"="c:\program files\D-Link\AirPlus G\AirGCFG.exe" [2004-07-09 1249280]
"F5D9050"="c:\program files\Belkin\F5D9050\Belkinwcui.exe" [2006-07-20 1617920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-28 c:\windows\system32\Ati2mdxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2003-03-24 389181]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Pomel\\Mes documents\\NC applications\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\FileZilla Client\\filezilla.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-14 110160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-14 20560]
R3 StreamSurge;StreamSurge Driver (miniport);c:\windows\system32\DRIVERS\ss.sys [2008-01-09 19968]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;c:\windows\system32\Drivers\WBSD.SYS [2007-01-24 26240]
S1 aiptektp;HyperPen;c:\windows\system32\DRIVERS\aiptektp.sys [2007-12-06 22272]
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-07-25 191656]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d81fe4f3-dbbb-11db-9f2b-00173f6314e5}]
\Shell\AutoRun\command - ie.exe
\Shell\explore\Command - ie.exe
\Shell\open\Command - ie.exe

*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'

2008-11-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-ANIWZCS2Service - c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe.old
HKLM-Run-AGRSMMSG - AGRSMMSG.exe.old
HKLM-Run-atwtusb - atwtusb.exe.. beta.old
Notify-WgaLogon - (no file)

.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Pomel\Application Data\Mozilla\Firefox\Profiles\ppouh7pb.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF -: plugin - c:\documents and settings\Pomel\Application Data\Mozilla\Firefox\Profiles\ppouh7pb.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 21:22:51
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????9?6?2?7??????? ?pTB???????????????B? ??????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSmqlt.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(972)
c:\windows\system32\rsaenh.dll

- - - - - - - > 'lsass.exe'(1028)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
Heure de fin: 2008-11-23 21:25:11
ComboFix-quarantined-files.txt 2008-11-23 20:24:22

Avant-CF: 13,806,215,168 octets libres
Après-CF: 13,795,258,368 octets libres

162 --- E O F --- 2008-11-14 15:00:02

qu'est-ce qu'il reste à faire ?