Infection page de demarrageRésolu/Fermé

Question

Bonjour,
DEpuis le 25 novembre, j'ai des soucis. J'ai subi une attaque que j'ai traité avec malwarebyte, ccleaner et un outil appelé genproc utilisant une palette de ressources (navilog, etc..). Tout semble avoir été nettoyé, sauf que ma page de demarrage d'IE continue à être modifié vers un pseudo site dont voici la capture d'écran:
http://picasaweb.google.fr/lh/photo/FFeEbacd-NmkBltoFBVZxg

Je pensais m'en sortir seul, mais y'a pas moyen de me débarrasser de cette saloperie, malgrés sbybot (qui ne trouve rien). De plus Kapersky m'indique toute une ribambelle de messages d'alerte de processus PID dont le numero change à chaque ouverture de IE qui cherche à modifier les cles de registre ou je sais pas trop quoi.Exemple :
http://picasaweb.google.fr/lh/photo/iLuAPqHm8nFqt2KI70tJLA

 Commme je découvre ce genre de souci, je ne sais plus ou donner de la tête. La machine ne semble pas ralenti, juste le surf, mais depuis deux jours j'ai suivi les conseils de la toile et j'utilise Firefox, plus rapide, je n'ai plus ces soucis de message Kapersky à chaque ouverture de page. Bon, je dois avouer que j'ai un peu les boules là, j'ai peur d'être espionner, y'a un truc qui est arrivé à passer kapersky (surement à cause d'une mauvaise manip de la part d'un utilisateur de l'ordi), alors je vous demande humblement de l'aide.
Je tourne sous windows Xp familliale pack 3, IE jusqu'à peut, et antivirus KApersky
Voici un rapport Hijackthis des fois que...

PS : j'ai essayer de fixer sans succés les lignes 09 marquées "no name" et ExplorerSecurity, mais elles reviennent sans cesse


Merci par avance de l'attention porté à ce post
Cordialement






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:12, on 30/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WebMediaViewer\hpmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\WLAN Card Utilities\Center.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\Fichiers communs\AOL\1169876785\ee\aolsoftware.exe
C:\Program Files\WebMediaViewer\hpmom.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Bertrand\Bureau\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Browser Toolbar - {2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E} - C:\Program Files\WebMediaViewer\browseul.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Program Files\WebMediaViewer\hpmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/27.44/uploader2.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.photoweb.fr/moncompte/Account/LogOn?ReturnUrl=%2ftransfert
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {68C1822F-F5C7-4404-A73F-03C10E0E94DA} (telechargement-photoweb) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

ric025 · Answer

Salut!

Important! Désactive ton antivirus / antispyware résident / TeaTimer de Spybot (si présent et actif)

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

Lance l'installation du programme en exécutant le fichier téléchargé.
Double-clique maintenant sur le raccourci de Toolbar-S&D.
Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.


Poste alors le rapport généré. Rapport qui se trouve également ici: C:\TB.txt

A++

g!rly · Answer

salut, 

Télécharges OTMoveIt3 (de Old_Timer) sur ton Bureau.

http://oldtimer.geekstogo.com/OTMoveIt3.exe

En mode sans échec:

Double cliques sur "OTMoveIt3.exe" pour ouvrir le prg .
Puis copies ce qui se trouve en citation ci-dessous,


:Processes
explorer.exe

:Reg
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]

:Files
C:\Program Files\WebMediaViewer
c:\program files\google

:Commands
[emptytemp]
[start explorer]
[Reboot]

et colles le dans le cadre de gauche de OTMoveIt3 :
Paste Instructions for items to be moved.
(ne touche à rien d'autre !)

-> cliques sur MoveIt! pour lancer la suppression.
-> laisses travailler l'outil ...

( Note : ton bureau va disparaitre puis réapparaitre, c'est normal .)

-> une fois finis , un petite fenêtre s'ouvre : cliques sur " Yes " .

Ton PC va redémarrer de lui même ...

-->Postes le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
( " xxxx2008_xxxxxx.log " où les "x" correspondent au jour et à l'heure de l'utilisation ). 

@+

lardechois2 · Answer

Voici le rapport ToolBar SD,
Merci pour votre aide, c'est gave ?


  -----------\  ToolBar S&D 1.2.5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU          6300  @ 1.86GHz )
   BIOS : BIOS Date: 11/20/06 11:07:02 Ver: 08.00.10
   USER : Bertrand ( Administrator )
   BOOT : Normal boot
   Antivirus : Kaspersky Anti-Virus 7.0.1.325 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:51 Go)
   D:\ (CD or DVD)
   E:\ (USB) - FAT - Total:247 Mo (Free:0 Go)

   "C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
   Option : [1] ( 01/12/2008|18:21 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"
   "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Local Page"="C:\windows\system32\blank.htm"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 01/12/2008|18:22 - Option : [1]

   -----------\  Fin du rapport a 18:22:06,14

g!rly · Answer

y a rien dans le rapport, passe ot_move it 3 comme je te l´ai indiqué :)
@+

lardechois2 · Answer

Voilà le rapport ot_movie, merci Girly 

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}\ not found.
========== FILES ==========
C:\Program Files\WebMediaViewer moved successfully.
c:\program files\Google\Toolbar for Firefox moved successfully.
c:\program files\Google\Installers moved successfully.
c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462 moved successfully.
c:\program files\Google\GoogleToolbarNotifier moved successfully.
c:\program files\Google\Google Earth\xml moved successfully.
c:\program files\Google\Google Earthes\zw.country moved successfully.
c:\program files\Google\Google Earthes\zm.country moved successfully.
c:\program files\Google\Google Earthes\zh-hant.locale moved successfully.
c:\program files\Google\Google Earthes\za.country moved successfully.
c:\program files\Google\Google Earthes\yt.country moved successfully.
c:\program files\Google\Google Earthes\ye.country moved successfully.
c:\program files\Google\Google Earthes\ws.country moved successfully.
c:\program files\Google\Google Earthes\wf.country moved successfully.
c:\program files\Google\Google Earthes\vu.country moved successfully.
c:\program files\Google\Google Earthes\vn.country moved successfully.
c:\program files\Google\Google Earthes\vi.country moved successfully.
c:\program files\Google\Google Earthes\vg.country moved successfully.
c:\program files\Google\Google Earthes\ve.country moved successfully.
c:\program files\Google\Google Earthes\vc.country moved successfully.
c:\program files\Google\Google Earthes\va.country moved successfully.
c:\program files\Google\Google Earthes\uz.country moved successfully.
c:\program files\Google\Google Earthes\uy.country moved successfully.
c:\program files\Google\Google Earthes\us.country moved successfully.
c:\program files\Google\Google Earthes\um.country moved successfully.
c:\program files\Google\Google Earthes\ug.country moved successfully.
c:\program files\Google\Google Earthes\ua.country moved successfully.
c:\program files\Google\Google Earthes	z.country moved successfully.
c:\program files\Google\Google Earthes	w.country moved successfully.
c:\program files\Google\Google Earthes	v.country moved successfully.
c:\program files\Google\Google Earthes	t.country moved successfully.
c:\program files\Google\Google Earthes	r.country moved successfully.
c:\program files\Google\Google Earthes	o.country moved successfully.
c:\program files\Google\Google Earthes	n.country moved successfully.
c:\program files\Google\Google Earthes	m.country moved successfully.
c:\program files\Google\Google Earthes	l.country moved successfully.
c:\program files\Google\Google Earthes	k.country moved successfully.
c:\program files\Google\Google Earthes	j.country moved successfully.
c:\program files\Google\Google Earthes	h.country moved successfully.
c:\program files\Google\Google Earthes	g.country moved successfully.
c:\program files\Google\Google Earthes	f.country moved successfully.
c:\program files\Google\Google Earthes	d.country moved successfully.
c:\program files\Google\Google Earthes	c.country moved successfully.
c:\program files\Google\Google Earthes\sz.country moved successfully.
c:\program files\Google\Google Earthes\sy.country moved successfully.
c:\program files\Google\Google Earthes\sv.country moved successfully.
c:\program files\Google\Google Earthes\st.country moved successfully.
c:\program files\Google\Google Earthes\sr.country moved successfully.
c:\program files\Google\Google Earthes\so.country moved successfully.
c:\program files\Google\Google Earthes\sn.country moved successfully.
c:\program files\Google\Google Earthes\sm.country moved successfully.
c:\program files\Google\Google Earthes\sl.country moved successfully.
c:\program files\Google\Google Earthes\sk.country moved successfully.
c:\program files\Google\Google Earthes\sj.country moved successfully.
c:\program files\Google\Google Earthes\si.country moved successfully.
c:\program files\Google\Google Earthes\shapes moved successfully.
c:\program files\Google\Google Earthes\sh.country moved successfully.
c:\program files\Google\Google Earthes\sg.country moved successfully.
c:\program files\Google\Google Earthes\se.country moved successfully.
c:\program files\Google\Google Earthes\sd.country moved successfully.
c:\program files\Google\Google Earthes\sc.country moved successfully.
c:\program files\Google\Google Earthes\sb.country moved successfully.
c:\program files\Google\Google Earthes\sa.country moved successfully.
c:\program files\Google\Google Earthesw.country moved successfully.
c:\program files\Google\Google Earthesu.locale moved successfully.
c:\program files\Google\Google Earthesu.country moved successfully.
c:\program files\Google\Google Earthess.country moved successfully.
c:\program files\Google\Google Eartheso.country moved successfully.
c:\program files\Google\Google Earthese.country moved successfully.
c:\program files\Google\Google Earthes\qa.country moved successfully.
c:\program files\Google\Google Earthes\py.country moved successfully.
c:\program files\Google\Google Earthes\pw.country moved successfully.
c:\program files\Google\Google Earthes\pushpin moved successfully.
c:\program files\Google\Google Earthes\pt.country moved successfully.
c:\program files\Google\Google Earthes\ps.country moved successfully.
c:\program files\Google\Google Earthes\pr.country moved successfully.
c:\program files\Google\Google Earthes\pn.country moved successfully.
c:\program files\Google\Google Earthes\pm.country moved successfully.
c:\program files\Google\Google Earthes\pl.country moved successfully.
c:\program files\Google\Google Earthes\pk.country moved successfully.
c:\program files\Google\Google Earthes\ph.country moved successfully.
c:\program files\Google\Google Earthes\pg.country moved successfully.
c:\program files\Google\Google Earthes\pf.country moved successfully.
c:\program files\Google\Google Earthes\pe.country moved successfully.
c:\program files\Google\Google Earthes\paddle moved successfully.
c:\program files\Google\Google Earthes\pa.country moved successfully.
c:\program files\Google\Google Earthes\om.country moved successfully.
c:\program files\Google\Google Earthes
z.country moved successfully.
c:\program files\Google\Google Earthes
u.country moved successfully.
c:\program files\Google\Google Earthes
r.country moved successfully.
c:\program files\Google\Google Earthes
p.country moved successfully.
c:\program files\Google\Google Earthes
o.country moved successfully.
c:\program files\Google\Google Earthes
l.country moved successfully.
c:\program files\Google\Google Earthes
i.country moved successfully.
c:\program files\Google\Google Earthes
g.country moved successfully.
c:\program files\Google\Google Earthes
f.country moved successfully.
c:\program files\Google\Google Earthes
e.country moved successfully.
c:\program files\Google\Google Earthes
c.country moved successfully.
c:\program files\Google\Google Earthes
a.country moved successfully.
c:\program files\Google\Google Earthes\mz.country moved successfully.
c:\program files\Google\Google Earthes\my.country moved successfully.
c:\program files\Google\Google Earthes\mx.country moved successfully.
c:\program files\Google\Google Earthes\mw.country moved successfully.
c:\program files\Google\Google Earthes\mv.country moved successfully.
c:\program files\Google\Google Earthes\mu.country moved successfully.
c:\program files\Google\Google Earthes\mt.country moved successfully.
c:\program files\Google\Google Earthes\ms.country moved successfully.
c:\program files\Google\Google Earthes\mr.country moved successfully.
c:\program files\Google\Google Earthes\mq.country moved successfully.
c:\program files\Google\Google Earthes\mp.country moved successfully.
c:\program files\Google\Google Earthes\mo.country moved successfully.
c:\program files\Google\Google Earthes\mn.country moved successfully.
c:\program files\Google\Google Earthes\mm.country moved successfully.
c:\program files\Google\Google Earthes\ml.country moved successfully.
c:\program files\Google\Google Earthes\mk.country moved successfully.
c:\program files\Google\Google Earthes\mh.country moved successfully.
c:\program files\Google\Google Earthes\mg.country moved successfully.
c:\program files\Google\Google Earthes\me.country moved successfully.
c:\program files\Google\Google Earthes\md.country moved successfully.
c:\program files\Google\Google Earthes\mc.country moved successfully.
c:\program files\Google\Google Earthes\ma.country moved successfully.
c:\program files\Google\Google Earthes\ly.country moved successfully.
c:\program files\Google\Google Earthes\lv.country moved successfully.
c:\program files\Google\Google Earthes\lu.country moved successfully.
c:\program files\Google\Google Earthes\lt.country moved successfully.
c:\program files\Google\Google Earthes\ls.country moved successfully.
c:\program files\Google\Google Earthes\lr.country moved successfully.
c:\program files\Google\Google Earthes\lk.country moved successfully.
c:\program files\Google\Google Earthes\li.country moved successfully.
c:\program files\Google\Google Earthes\lc.country moved successfully.
c:\program files\Google\Google Earthes\lb.country moved successfully.
c:\program files\Google\Google Earthes\la.country moved successfully.
c:\program files\Google\Google Earthes\kz.country moved successfully.
c:\program files\Google\Google Earthes\ky.country moved successfully.
c:\program files\Google\Google Earthes\kw.country moved successfully.
c:\program files\Google\Google Earthes\kr.country moved successfully.
c:\program files\Google\Google Earthes\kp.country moved successfully.
c:\program files\Google\Google Earthes\ko.locale moved successfully.
c:\program files\Google\Google Earthes\kn.country moved successfully.
c:\program files\Google\Google Earthes\km.country moved successfully.
c:\program files\Google\Google Earthes\ki.country moved successfully.
c:\program files\Google\Google Earthes\kh.country moved successfully.
c:\program files\Google\Google Earthes\kg.country moved successfully.
c:\program files\Google\Google Earthes\ke.country moved successfully.
c:\program files\Google\Google Earthes\jp.country moved successfully.
c:\program files\Google\Google Earthes\jo.country moved successfully.
c:\program files\Google\Google Earthes\jm.country moved successfully.
c:\program files\Google\Google Earthes\je.country moved successfully.
c:\program files\Google\Google Earthes\it.country moved successfully.
c:\program files\Google\Google Earthes\is.country moved successfully.
c:\program files\Google\Google Earthes\ir.country moved successfully.
c:\program files\Google\Google Earthes\iq.country moved successfully.
c:\program files\Google\Google Earthes\io.country moved successfully.
c:\program files\Google\Google Earthes\in.country moved successfully.
c:\program files\Google\Google Earthes\im.country moved successfully.
c:\program files\Google\Google Earthes\il.country moved successfully.
c:\program files\Google\Google Earthes\ie.country moved successfully.
c:\program files\Google\Google Earthes\id.country moved successfully.
c:\program files\Google\Google Earthes\hu.country moved successfully.
c:\program files\Google\Google Earthes\ht.country moved successfully.
c:\program files\Google\Google Earthes\hr.country moved successfully.
c:\program files\Google\Google Earthes\hn.country moved successfully.
c:\program files\Google\Google Earthes\hm.country moved successfully.
c:\program files\Google\Google Earthes\hk.country moved successfully.
c:\program files\Google\Google Earthes\gy.country moved successfully.
c:\program files\Google\Google Earthes\gw.country moved successfully.
c:\program files\Google\Google Earthes\gu.country moved successfully.
c:\program files\Google\Google Earthes\gt.country moved successfully.
c:\program files\Google\Google Earthes\gs.country moved successfully.
c:\program files\Google\Google Earthes\gr.country moved successfully.
c:\program files\Google\Google Earthes\gq.country moved successfully.
c:\program files\Google\Google Earthes\gp.country moved successfully.
c:\program files\Google\Google Earthes\gn.country moved successfully.
c:\program files\Google\Google Earthes\gm.country moved successfully.
c:\program files\Google\Google Earthes\gl.country moved successfully.
c:\program files\Google\Google Earthes\gi.country moved successfully.
c:\program files\Google\Google Earthes\gh.country moved successfully.
c:\program files\Google\Google Earthes\gg.country moved successfully.
c:\program files\Google\Google Earthes\gf.country moved successfully.
c:\program files\Google\Google Earthes\ge.country moved successfully.
c:\program files\Google\Google Earthes\gd.country moved successfully.
c:\program files\Google\Google Earthes\gb.country moved successfully.
c:\program files\Google\Google Earthes\ga.country moved successfully.
c:\program files\Google\Google Earthes\fr.country moved successfully.
c:\program files\Google\Google Earthes\fo.country moved successfully.
c:\program files\Google\Google Earthes\fm.country moved successfully.
c:\program files\Google\Google Earthes\flightsim\planet moved successfully.
c:\program files\Google\Google Earthes\flightsim\keyboard moved successfully.
c:\program files\Google\Google Earthes\flightsim\hud moved successfully.
c:\program files\Google\Google Earthes\flightsim\controller moved successfully.
c:\program files\Google\Google Earthes\flightsim\aircraft moved successfully.
c:\program files\Google\Google Earthes\flightsim moved successfully.
c:\program files\Google\Google Earthes\fk.country moved successfully.
c:\program files\Google\Google Earthes\fj.country moved successfully.
c:\program files\Google\Google Earthes\fi.country moved successfully.
c:\program files\Google\Google Earthes\et.country moved successfully.
c:\program files\Google\Google Earthes\es.country moved successfully.
c:\program files\Google\Google Earthes\er.country moved successfully.
c:\program files\Google\Google Earthes\eh.country moved successfully.
c:\program files\Google\Google Earthes\eg.country moved successfully.
c:\program files\Google\Google Earthes\ee.country moved successfully.
c:\program files\Google\Google Earthes\ec.country moved successfully.
c:\program files\Google\Google Earthes\dz.country moved successfully.
c:\program files\Google\Google Earthes\do.country moved successfully.
c:\program files\Google\Google Earthes\dm.country moved successfully.
c:\program files\Google\Google Earthes\dk.country moved successfully.
c:\program files\Google\Google Earthes\dj.country moved successfully.
c:\program files\Google\Google Earthes\de.country moved successfully.
c:\program files\Google\Google Earthes\cz.country moved successfully.
c:\program files\Google\Google Earthes\cy.country moved successfully.
c:\program files\Google\Google Earthes\cx.country moved successfully.
c:\program files\Google\Google Earthes\cv.country moved successfully.
c:\program files\Google\Google Earthes\cu.country moved successfully.
c:\program files\Google\Google Earthes\cr.country moved successfully.
c:\program files\Google\Google Earthes\co.country moved successfully.
c:\program files\Google\Google Earthes\cn.country moved successfully.
c:\program files\Google\Google Earthes\cm.country moved successfully.
c:\program files\Google\Google Earthes\cl.country moved successfully.
c:\program files\Google\Google Earthes\ck.country moved successfully.
c:\program files\Google\Google Earthes\ci.country moved successfully.
c:\program files\Google\Google Earthes\ch.country moved successfully.
c:\program files\Google\Google Earthes\cg.country moved successfully.
c:\program files\Google\Google Earthes\cf.country moved successfully.
c:\program files\Google\Google Earthes\cd.country moved successfully.
c:\program files\Google\Google Earthes\cc.country moved successfully.
c:\program files\Google\Google Earthes\ca.country moved successfully.
c:\program files\Google\Google Earthes\bz.country moved successfully.
c:\program files\Google\Google Earthes\by.country moved successfully.
c:\program files\Google\Google Earthes\bw.country moved successfully.
c:\program files\Google\Google Earthes\bv.country moved successfully.
c:\program files\Google\Google Earthes\bt.country moved successfully.
c:\program files\Google\Google Earthes\bs.country moved successfully.
c:\program files\Google\Google Earthes\br.country moved successfully.
c:\program files\Google\Google Earthes\bo.country moved successfully.
c:\program files\Google\Google Earthes\bn.country moved successfully.
c:\program files\Google\Google Earthes\bm.country moved successfully.
c:\program files\Google\Google Earthes\bj.country moved successfully.
c:\program files\Google\Google Earthes\bi.country moved successfully.
c:\program files\Google\Google Earthes\bh.country moved successfully.
c:\program files\Google\Google Earthes\bg.country moved successfully.
c:\program files\Google\Google Earthes\bf.country moved successfully.
c:\program files\Google\Google Earthes\be.country moved successfully.
c:\program files\Google\Google Earthes\bd.country moved successfully.
c:\program files\Google\Google Earthes\bb.country moved successfully.
c:\program files\Google\Google Earthes\ba.country moved successfully.
c:\program files\Google\Google Earthes\az.country moved successfully.
c:\program files\Google\Google Earthes\ax.country moved successfully.
c:\program files\Google\Google Earthes\aw.country moved successfully.
c:\program files\Google\Google Earthes\au.country moved successfully.
c:\program files\Google\Google Earthes\at.country moved successfully.
c:\program files\Google\Google Earthes\as.country moved successfully.
c:\program files\Google\Google Earthes\ar.locale moved successfully.
c:\program files\Google\Google Earthes\ar.country moved successfully.
c:\program files\Google\Google Earthes\aq.country moved successfully.
c:\program files\Google\Google Earthes\ao.country moved successfully.
c:\program files\Google\Google Earthes\an.country moved successfully.
c:\program files\Google\Google Earthes\am.country moved successfully.
c:\program files\Google\Google Earthes\al.country moved successfully.
c:\program files\Google\Google Earthes\ai.country moved successfully.
c:\program files\Google\Google Earthes\ag.country moved successfully.
c:\program files\Google\Google Earthes\af.country moved successfully.
c:\program files\Google\Google Earthes\ae.country moved successfully.
c:\program files\Google\Google Earthes\ad.country moved successfully.
c:\program files\Google\Google Earthes moved successfully.
c:\program files\Google\Google Earth\lang moved successfully.
c:\program files\Google\Google Earth\kvw moved successfully.
c:\program files\Google\Google Earth\alchemy\optimizations moved successfully.
c:\program files\Google\Google Earth\alchemy\ogl moved successfully.
c:\program files\Google\Google Earth\alchemy\dx moved successfully.
c:\program files\Google\Google Earth\alchemy moved successfully.
c:\program files\Google\Google Earth moved successfully.
c:\program files\Google\Common\Google Updater moved successfully.
c:\program files\Google\Common moved successfully.
c:\program files\Google moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 12012008_183811

g!rly · Answer

post un nouveau rapport hijack this stp

@+

ric025 · Answer

Bien vu G!rly!

Bonne continuation.

A++ ;))

lardechois2 · Answer

Oups, désolé j'aurai pu y penser :) 
Bon, pour info, quand j'ouvre IE j'ai retrouvé ma page de démarrage, c'est cool (même si je n'ouvrirai plus IE de longtemps)

Voilà le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50:29, on 01/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\WLAN Card Utilities\Center.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\AOL\1169876785\ee\aolsoftware.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Bertrand\Bureau\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Browser Toolbar - {2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E} - C:\Program Files\WebMediaViewer\browseul.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Program Files\WebMediaViewer\hpmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/27.44/uploader2.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.photoweb.fr/moncompte/Account/LogOn?ReturnUrl=%2ftransfert
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {68C1822F-F5C7-4404-A73F-03C10E0E94DA} (telechargement-photoweb) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

lardechois2 · Answer

par contre, Kapersky me signale toujours ça :

01/12/2008 18:52:32	Processus C:\WINDOWS\system32\services.exe (PID: 1024): action création composition des bibliothèques système chargées au démarrage du système d'exploitation (clé HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ASNDIS5, valeurs ImagePath, données \??\C:\PROGRA~1\WLANCA~1\ASNDIS5.SYS) bloquée.

g!rly · Answer

peux tu passer ceci :

Fais un scan avec cet antispyware :

Telecharge malwarebytes + tutoriel :

-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

Puis click sur "rechercher".

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

g!rly · Answer

d´accord

a mon avis c´est un faux positif :

https://www.greatis.com/appdata/a/a/asndis5.sys.htm

https://www.broadcom.com/

http://www.prevx.com/filenames/103048015887488452-0/ASNDIS52ESYS.html

tu peux le faire analyser 

Vas sur le site https://virusscan.jotti.org/
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
C:\PROGRA~1\WLANCA~1\ASNDIS5.SYS
- Clic sur submit toujours en haut à droite
- Le scan va se lancer, ça va prendre un petit instant
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799

@+

g!rly · Answer

ca c le rapport pour Xinch.exe? ou bien ?

g!rly · Answer

personne ne trouve rien...

on dirait que ce driver enfin d´apres ce que j´ai pu lire est en relation avec la veille du system...

g!rly · Answer

de rien lardechois2

oui essaie de configurer kasperrsky peut être en étant moins parano :)

post un dernier rapport hijack this cependant pour enlever le superflu :)

@+

g!rly · Answer

ok

coche et fix :

O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll (file missing) 
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) 
O3 - Toolbar: Browser Toolbar - {2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E} - C:\Program Files\WebMediaViewer\browseul.dll (file missing) 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O16 - DPF: {104B0A37-AB99-4F06-8032-8BBDC3B77DDB} (Telechargement Control) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.fr/s/v/27.44/uploader2.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.photoweb.fr/moncompte/Account/LogOn?ReturnUrl=%2ftransfert
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {68C1822F-F5C7-4404-A73F-03C10E0E94DA} (telechargement-photoweb) - http://www4.photoweb.fr/telechargement/Photoweb_uploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab 

comment fixer :

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

puis

regarde ce tutorial pour mettre ta console java a jour :
 
https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/

ps : ne te trompes pas; sur la même page il y a aussi le tutoriel de flash...

un bonus :

spywareblaster :

http://www.brightfort.com/spywareblaster.html

c´est un resident, il suffit de le mettre a jour de temps en temps car la version gratuite ne le fait pas toute seul , une fois installé et mis a jour tu mets toutes les protections sur "enable"

tuto : https://www.malekal.com/tutorial-spywareblaster/

pourquoi ne pas surfer avec firefox? = plus sur,  tout en gardant ie 7.0 pour les mises a jour windows car impossible a effectuer sous firefox

http://www.mozilla-europe.org/fr/

plugins :ad block plus, no script ect

https://www.hugedomains.com/domain_profile.cfm?d=geckozone&e=org

pour supprimer les outils utilisés :

Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

@+

g!rly · Answer

d´accord très bien Bertrand :)
oui c´est claire que surfer avec le compte administrateur c´est pas le top.
bonne continuation a toi`
bye`
Julie`

Infection page de demarrage

16 réponses

Discussions similaires

Newsletters