Infecté par antivirus 2009

t'a pourtant AVG installé
c'est certainement un spyware qui t'a infecté

ces processus on l'air louches, essaye de les supprimes:
•C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
•C:\Documents and Settings\Nadya\Bureau\coucou.exe.exe

Merci beaucoup pour ta réponse!

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
c'est une application qui était installée il y a longtemps (en même temps que l'installation d'Ad-Aware...Je dois la supprimer quand même!? En fait, quand j'ai essayé de scanner l'ordi avec Ad-Aware, ca disait que l'opération devait être interrompue à cause d'un fichier dll et d'envoyer un rapport à ad-aware..Ca peut avoir un rapport? (je ne connais rien là-dedans, je dis ca comme ça)

C:\Documents and Settings\Nadya\Bureau\coucou.exe.exe
C'est le hijack this qui a été renommé. Dans le lien suivant, on disait de renommer le fichier...Je dois le supprimer quand même?
https://kerio.probb.fr/t62-comment-utiliser-et-comprendre-hijackthis

Finalement, si c'est un spyware, je m'en débarrasse comment?
C'est vraiment déplaisant d'avoir un million de fenêtres qui ouvrent toutes seules tout le temps!

Une fille un peu découragée!

c'est pas necessaire de supprimer ces lignes mais ...

tu pourrais essayer de faire un scan avec un anti spyware

à la rigueur, la solution de formatage est toujours disponible :p

bon courage

Salut Kaboom13,

un simple scan avec un antispyware ne suffit pas

fais ceci:

télécharge smitfraudfix de S!Ri, balltrap34 et moe31

En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 1
cela vas générer un rapport.

Copie/colle le rapport sur le forum stp.

A plus

zor

Merci Zor!
Voici le rapport que ca génère:

SmitFraudFix v2.381

Rapport fait à 9:33:44,67, 2008-12-04
Executé à partir de C:\Documents and Settings\Nadya\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Nadya\Bureau\SmitfraudFix\Policies.exe
C:\Documents and Settings\Nadya\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nadya

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Nadya\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nadya\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Nadya\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32\leheliyo.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32\leheliyo.dll"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="avgrsstx.dll C:\\WINDOWS\\system32\\gobifose.dll c:\\windows\\system32\\leheliyo.dll"
"LoadAppInit_DLLs"=dword:00000001

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 142.169.1.16
DNS Server Search Order: 199.84.242.22

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3C2F5C32-6BFD-43B0-9C83-23A16B4863C4}: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3C2F5C32-6BFD-43B0-9C83-23A16B4863C4}: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3C2F5C32-6BFD-43B0-9C83-23A16B4863C4}: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=142.169.1.16 199.84.242.22

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

okay, tu peux passer à l'option 2

colle le rapport Smitfraudfix , plus le rapport d'un nouveau scan Hijackthis

A plus

Zor

Après l'option 2 (c'était par contre impossible d'ouvrir mon ordi sans échec, je ne pouvais pas monter la flèche), voici le rapport:

SmitFraudFix v2.381

Rapport fait à 10:59:29,32, 2008-12-04
Executé à partir de C:\Documents and Settings\Nadya\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32\burolage.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32\burolage.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 142.169.1.16
DNS Server Search Order: 199.84.242.22

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3C2F5C32-6BFD-43B0-9C83-23A16B4863C4}: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3C2F5C32-6BFD-43B0-9C83-23A16B4863C4}: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3C2F5C32-6BFD-43B0-9C83-23A16B4863C4}: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=142.169.1.16 199.84.242.22
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=142.169.1.16 199.84.242.22

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32\burolage.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="c:\windows\system32\burolage.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Et voici le nouveau rapport de hijack this:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:08:59, on 2008-12-04
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Documents and Settings\Nadya\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Nadya\Bureau\coucou.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9ec2edf7-86ab-426f-b67c-6b0d90669933} - C:\WINDOWS\system32\honumopi.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\PROGRAMMES\qttask.exe" -atboottime
O4 - HKLM\..\Run: [kafipijefa] Rundll32.exe "C:\WINDOWS\system32\mefupojo.dll",s
O4 - HKLM\..\Run: [784e9b8f] rundll32.exe "C:\WINDOWS\system32\fulefoze.dll",b
O4 - HKLM\..\Run: [CPM7b7da813] Rundll32.exe "c:\windows\system32\burolage.dll",a
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [kafipijefa] Rundll32.exe "C:\WINDOWS\system32\mefupojo.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1223695359359&h=6747ab5bf40679864877327b81820489/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll C:\WINDOWS\system32\gobifose.dll c:\windows\system32\burolage.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\burolage.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\burolage.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe

Je vais pleurer!!!
Après une journée sans apparition de fenêtre intempestives, voilà que ca recommence...J'ai pensé que pour vous aider à m'aider, remettre un rapport hijack this pourrait être utile

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:58:56, on 2008-12-05
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Documents and Settings\Nadya\Bureau\Raccourcis\SmitfraudFix\Policies.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Nadya\Bureau\coucou.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9ec2edf7-86ab-426f-b67c-6b0d90669933} - C:\WINDOWS\system32\honumopi.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\PROGRAMMES\qttask.exe" -atboottime
O4 - HKLM\..\Run: [kafipijefa] Rundll32.exe "C:\WINDOWS\system32\mefupojo.dll",s
O4 - HKLM\..\Run: [784e9b8f] rundll32.exe "C:\WINDOWS\system32\bayonaru.dll",b
O4 - HKLM\..\Run: [CPM7b7da813] Rundll32.exe "c:\windows\system32\yeyapoyu.dll",a
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [kafipijefa] Rundll32.exe "C:\WINDOWS\system32\mefupojo.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1223695359359&h=6747ab5bf40679864877327b81820489/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll C:\WINDOWS\system32\gobifose.dll c:\windows\system32\yeyapoyu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yeyapoyu.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yeyapoyu.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe

Salut,

désolé pour avoir tardé à répondre: j'ai trop de trucs à faire pour le moment

Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

et:

télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

* Double-clique dessus pour lancer l'installation
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré (C:\lopR.txt)

A plus

Zor

Voici le rapport du premier lien donné (Navilog)

Search Navipromo version 3.6.9 commencé le 2008-12-05 à 13:57:12,64

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Nadya"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans "C:\WINDOWS" ***

*** Recherche dossiers dans "C:\Program Files" ***

*** Recherche dossiers dans "C:\Documents and Settings\All Users.WINDOWS\menudm~1\progra~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\All Users.WINDOWS\menudm~1" ***

*** Recherche dossiers dans "c:\docume~1\alluse~1.win\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Nadya\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\magiknet\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\MAGIKN~1.NAD\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\Nadia\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\super\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Nadya\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\magiknet\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\MAGIKN~1.NAD\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\Nadia\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\super\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Nadya\menudm~1\progra~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\magiknet\menudm~1\progra~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\MAGIKN~1.NAD\menudm~1\progra~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\Nadia\menudm~1\progra~1" ***

*** Recherche dossiers dans "C:\DOCUME~1\super\menudm~1\progra~1" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Nadya\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\magiknet\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\MAGIKN~1.NAD\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Nadia\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\super\locals~1\applic~1" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

* Dans "C:\Documents and Settings\Nadya\locals~1\applic~1" :

* Dans "C:\DOCUME~1\magiknet\locals~1\applic~1" :

* Dans "C:\DOCUME~1\MAGIKN~1.NAD\locals~1\applic~1" :

* Dans "C:\DOCUME~1\Nadia\locals~1\applic~1" :

* Dans "C:\DOCUME~1\super\locals~1\applic~1" :

3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

*** Analyse terminée le 2008-12-05 à 14:15:05,25 ***

Et maintenant, le résultat de lop:

--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 1.70GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Nadya ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
C:\ (Local Disk) - NTFS - Total:30 Go (Free:7 Go)
D:\ (Local Disk) - NTFS - Total:44 Go (Free:3 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( 2008-12-05|14:18 )

--------------------\\ Listing des dossiers dans APPLIC~1

[2007-03-01|11:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Acronis
[2007-09-15|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[2007-10-04|10:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
[2008-01-09|10:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[2008-01-09|10:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[2008-01-06|15:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[2007-11-27|19:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[2007-07-09|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[2008-02-10|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
[2008-02-23|22:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[2008-08-24|02:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[2007-10-10|20:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[2006-09-21|08:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[2007-09-13|13:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\VMware
[2006-07-26|15:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[2008-04-01|09:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[2008-03-15|12:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[2008-11-19|14:02] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
[2008-11-15|13:24] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple
[2008-11-15|13:25] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
[2008-09-16|07:46] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\avg8
[2008-10-09|08:12] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Azureus
[2008-09-16|07:23] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Lavasoft
[2008-10-24|09:34] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
[2008-10-25|13:10] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft
[2008-09-15|15:19] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
[2008-09-16|20:41] C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller

[2005-12-23|10:09] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[2008-09-15|12:48] C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Microsoft

[2007-10-03|12:04] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[2007-04-23|09:33] C:\DOCUME~1\LOCALS~1\APPLIC~1\VMware

[2008-09-15|12:48] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft

[2006-03-07|09:36] C:\DOCUME~1\magiknet\APPLIC~1\Adobe
[2006-06-14|14:42] C:\DOCUME~1\magiknet\APPLIC~1\AdobeUM
[2007-03-30|10:15] C:\DOCUME~1\magiknet\APPLIC~1\DameWare Development
[2006-03-29|11:23] C:\DOCUME~1\magiknet\APPLIC~1\GlobalSCAPE
[2006-01-13|12:42] C:\DOCUME~1\magiknet\APPLIC~1\Google
[2005-12-23|10:31] C:\DOCUME~1\magiknet\APPLIC~1\Help
[2005-12-23|10:24] C:\DOCUME~1\magiknet\APPLIC~1\Identities
[2007-09-13|13:18] C:\DOCUME~1\magiknet\APPLIC~1\Lavasoft
[2006-01-30|08:13] C:\DOCUME~1\magiknet\APPLIC~1\Macromedia
[2007-06-05|13:23] C:\DOCUME~1\magiknet\APPLIC~1\Microsoft
[2006-01-24|13:01] C:\DOCUME~1\magiknet\APPLIC~1\Mozilla
[2007-07-09|06:58] C:\DOCUME~1\magiknet\APPLIC~1\OpenOffice.org2
[2005-12-27|11:38] C:\DOCUME~1\magiknet\APPLIC~1\Sun
[2006-09-21|08:30] C:\DOCUME~1\magiknet\APPLIC~1\Symantec
[2007-09-13|12:38] C:\DOCUME~1\magiknet\APPLIC~1\VMware

[2008-09-16|07:00] C:\DOCUME~1\MAGIKN~1.NAD\APPLIC~1\Identities
[2008-09-19|13:14] C:\DOCUME~1\MAGIKN~1.NAD\APPLIC~1\Microsoft

[2008-08-02|11:52] C:\DOCUME~1\Nadia\APPLIC~1\Adobe
[2008-05-10|00:07] C:\DOCUME~1\Nadia\APPLIC~1\AdobeUM
[2008-01-06|19:42] C:\DOCUME~1\Nadia\APPLIC~1\Ahead
[2008-01-09|11:03] C:\DOCUME~1\Nadia\APPLIC~1\Apple Computer
[2008-08-25|05:05] C:\DOCUME~1\Nadia\APPLIC~1\Azureus
[2008-01-24|20:15] C:\DOCUME~1\Nadia\APPLIC~1\Help
[2008-03-15|12:29] C:\DOCUME~1\Nadia\APPLIC~1\Identities
[2007-11-10|13:12] C:\DOCUME~1\Nadia\APPLIC~1\InfraRecorder
[2008-06-17|16:22] C:\DOCUME~1\Nadia\APPLIC~1\LimeWire
[2007-11-03|19:15] C:\DOCUME~1\Nadia\APPLIC~1\Macromedia
[2008-05-10|00:13] C:\DOCUME~1\Nadia\APPLIC~1\Microsoft
[2007-09-14|23:01] C:\DOCUME~1\Nadia\APPLIC~1\Mozilla
[2007-10-04|22:29] C:\DOCUME~1\Nadia\APPLIC~1\Nero
[2008-08-20|10:53] C:\DOCUME~1\Nadia\APPLIC~1\OpenOffice.org2
[2008-03-17|18:19] C:\DOCUME~1\Nadia\APPLIC~1\Real
[2007-09-21|22:01] C:\DOCUME~1\Nadia\APPLIC~1\Sun
[2008-05-01|19:45] C:\DOCUME~1\Nadia\APPLIC~1\vlc
[2008-03-15|12:29] C:\DOCUME~1\Nadia\APPLIC~1\Zylom

[2008-11-19|14:00] C:\DOCUME~1\Nadya\APPLIC~1\Adobe
[2008-09-24|17:01] C:\DOCUME~1\Nadya\APPLIC~1\AdobeUM
[2008-12-03|11:12] C:\DOCUME~1\Nadya\APPLIC~1\Azureus
[2008-11-19|14:02] C:\DOCUME~1\Nadya\APPLIC~1\bayardKids.08AE7BFC096D057FBA48C7E4F898C35F7FA11BBA.1
[2008-11-19|19:40] C:\DOCUME~1\Nadya\APPLIC~1\Help
[2008-09-15|09:27] C:\DOCUME~1\Nadya\APPLIC~1\Identities
[2008-10-27|20:29] C:\DOCUME~1\Nadya\APPLIC~1\LimeWire
[2008-09-16|07:13] C:\DOCUME~1\Nadya\APPLIC~1\Macromedia
[2008-10-07|12:43] C:\DOCUME~1\Nadya\APPLIC~1\Microsoft
[2008-10-20|13:20] C:\DOCUME~1\Nadya\APPLIC~1\Sun
[2008-10-10|20:54] C:\DOCUME~1\Nadya\APPLIC~1\vlc

[2007-07-11|16:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[2008-09-15|12:48] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft

[2006-02-02|14:37] C:\DOCUME~1\super\APPLIC~1\Adobe
[2006-12-21|13:42] C:\DOCUME~1\super\APPLIC~1\Google
[2006-02-02|14:37] C:\DOCUME~1\super\APPLIC~1\Identities
[2006-03-16|09:23] C:\DOCUME~1\super\APPLIC~1\Macromedia
[2006-02-02|14:37] C:\DOCUME~1\super\APPLIC~1\Microsoft
[2006-03-16|09:22] C:\DOCUME~1\super\APPLIC~1\Mozilla
[2007-05-29|14:05] C:\DOCUME~1\super\APPLIC~1\Sun

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[2008-12-05 10:05][--ah-----] C:\WINDOWS\tasks\SA.DAT
[2001-08-28 07:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[2005-12-23|11:30] C:\Program Files\Adobe
[2008-01-24|20:42] C:\Program Files\Agfa
[2008-09-15|15:13] C:\Program Files\Ahead
[2008-11-15|13:24] C:\Program Files\Apple Software Update
[2007-09-13|14:34] C:\Program Files\ATI Technologies
[2008-09-16|07:46] C:\Program Files\AVG
[2008-12-03|12:10] C:\Program Files\Azureus
[2008-11-19|14:02] C:\Program Files\bayardKids
[2006-10-17|18:28] C:\Program Files\BeTwin
[2008-07-04|20:57] C:\Program Files\Boonty
[2008-07-04|20:57] C:\Program Files\BoontyGames
[2005-12-23|10:30] C:\Program Files\CA
[2005-12-23|10:05] C:\Program Files\ComPlus Applications
[2008-07-17|22:21] C:\Program Files\Cribbage
[2008-11-19|14:02] C:\Program Files\Fichiers communs
[2007-09-13|14:59] C:\Program Files\InstallShield Installation Information
[2007-03-07|14:24] C:\Program Files\Intel
[2008-10-16|09:02] C:\Program Files\Internet Explorer
[2008-10-10|22:24] C:\Program Files\Java
[2008-09-16|07:23] C:\Program Files\Lavasoft
[2008-11-18|13:00] C:\Program Files\Les Logiciels Scripto
[2007-09-14|20:25] C:\Program Files\Lexmark 730 Series
[2008-12-01|07:55] C:\Program Files\Lx_cats
[2008-09-18|14:48] C:\Program Files\Messenger
[2008-09-16|20:49] C:\Program Files\Messenger Plus! Live
[2008-04-02|02:02] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2005-12-23|10:10] C:\Program Files\microsoft frontpage
[2008-09-19|12:59] C:\Program Files\Microsoft Office
[2008-09-19|12:59] C:\Program Files\Microsoft Visual Studio
[2008-09-20|22:53] C:\Program Files\Microsoft Works
[2006-09-21|13:05] C:\Program Files\Microsoft.NET
[2008-09-16|22:23] C:\Program Files\Movie Maker
[2008-06-19|09:07] C:\Program Files\Mozilla Firefox
[2005-12-23|10:05] C:\Program Files\MSN
[2005-12-23|10:04] C:\Program Files\MSN Gaming Zone
[2006-11-20|07:56] C:\Program Files\MSXML 4.0
[2008-12-05|14:15] C:\Program Files\Navilog1
[2008-09-16|22:15] C:\Program Files\NetMeeting
[2008-01-22|23:16] C:\Program Files\NetMeter
[2005-12-23|13:23] C:\Program Files\OpenOffice.org 2.0
[2008-09-16|22:15] C:\Program Files\Outlook Express
[2008-11-15|13:19] C:\Program Files\QuickTime
[2008-03-17|18:15] C:\Program Files\Real
[2007-09-13|14:59] C:\Program Files\Realtek AC97
[2005-12-23|10:08] C:\Program Files\Services en ligne
[2008-07-17|21:50] C:\Program Files\Stratoware
[2008-07-17|22:28] C:\Program Files\Ultimate Cribbage
[2007-03-12|15:23] C:\Program Files\Uninstall Information
[2008-05-01|19:38] C:\Program Files\VideoLAN
[2007-09-16|08:52] C:\Program Files\Winamp
[2008-04-01|09:35] C:\Program Files\Windows Live
[2007-12-11|22:35] C:\Program Files\Windows Media Connect 2
[2008-09-16|22:25] C:\Program Files\Windows Media Player
[2008-09-16|22:15] C:\Program Files\Windows NT
[2008-09-15|15:11] C:\Program Files\WindowsUpdate
[2005-12-23|13:17] C:\Program Files\WinRAR
[2005-12-23|10:10] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[2008-05-09|08:43] C:\Program Files\Fichiers communs\Adobe
[2008-11-19|14:02] C:\Program Files\Fichiers communs\Adobe AIR
[2008-01-24|20:42] C:\Program Files\Fichiers communs\Agfa
[2007-12-21|12:05] C:\Program Files\Fichiers communs\Ahead
[2008-11-15|13:25] C:\Program Files\Fichiers communs\Apple
[2007-09-13|13:26] C:\Program Files\Fichiers communs\Designer
[2007-09-13|14:59] C:\Program Files\Fichiers communs\InstallShield
[2007-09-13|13:58] C:\Program Files\Fichiers communs\Intuit
[2005-12-23|13:21] C:\Program Files\Fichiers communs\Java
[2008-02-10|22:40] C:\Program Files\Fichiers communs\Kodak
[2008-09-19|13:00] C:\Program Files\Fichiers communs\Microsoft Shared
[2005-12-23|10:06] C:\Program Files\Fichiers communs\MSSoap
[2005-12-23|03:49] C:\Program Files\Fichiers communs\ODBC
[2008-03-09|22:31] C:\Program Files\Fichiers communs\PC SOFT
[2008-03-17|18:16] C:\Program Files\Fichiers communs\Real
[2005-12-23|10:06] C:\Program Files\Fichiers communs\Services
[2005-12-23|03:49] C:\Program Files\Fichiers communs\SpeechEngines
[2007-09-13|14:31] C:\Program Files\Fichiers communs\Symantec Shared
[2008-09-16|22:15] C:\Program Files\Fichiers communs\System
[2008-09-16|20:43] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[2008-09-16|07:23] C:\Program Files\Fichiers communs\Wise Installation Wizard
[2008-03-17|18:16] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 38 Processes )

iexplore.exe ~ [PID:1276]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\Nadya\Cookies\nadya@partypoker[2].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-05 14:24:30
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 533

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:667][D:22]-> C:\DOCUME~1\Nadya\LOCALS~1\Temp
[F:162][D:0]-> C:\DOCUME~1\Nadya\Cookies
[F:1787][D:8]-> C:\DOCUME~1\Nadya\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 2008-12-05|14:26 - Option : [1]

--------------------\\ Fin du rapport a 14:26:59

Depuis ce matin, il n'y a pas trop de fenêtres qui ouvrent...
Nous sommes sur la bonne voie je pense.
Je vais faire quoi avec tous ces programmes une fois que le problème sera réglé? Je les désinstalle? (je pose la question tout de suite pour ne pas prendre trop de ton temps en posant ma question plus tard hih)

Merci!
A plus

Salut,

pour ces logiciels de désinfection, il existe une application qui permettra de les effacer. Pas de problème.

1) télécharge CCleaner (logiciel à conserver pour effacer les cookies, les fichiers temporaires, désinstaller des programmes ou nettoyer ta base de registre)

on y va

vas sur ce lien
https://www.malekal.com/tutoriel-ccleaner/

Regarde bien le mode d'emploi pour l'installer, c'est facile mais surtout, à un moment il va te demander d'installer la "yahoo toolbar": décoche cette fonction, cette toolbar n'est pas utile

Une fois installé, va sur le pinceau (Nettoyeur) et clique "lancer le nettoyage". Confirmer. Cela peut prendre du temps.
================================================================
2) Télécharge superantispyware
http://www.commentcamarche.net/telecharger/telecharger 34055294 superantispyware

Tu trouveras le tutorial ici (en format pdf)
http://sd-1.archive-host.com/membres/up/191126192737749487/TutoSUPERAntiSpywareaideetexplication.pdf

très important:
a) fais les mises à jour du logiciel (check for updates)
b) lance l'analyse en mode sans échec
Démarrage en mode sans échec
c) fais un scan complet (perform complete scan)

Colle le rapport d'analyse (viewer log scan)
======================================================================
3) colle un nouveau rapport Hijackthis

A plus

Zor

Re-bonjour!

J'ai installe CCleaner sans problème!
J'ai installé aussi superantispyware mais je suis incapable d'aller au mode sans échec. En fait, en faisant F8, je finis par arriver à la page mais impossible de déplacer le curseur pour sélectionner mode sans échec...
Je n'ai pas mis en marche superantispyware, je vais attendre d'avoir votre avis à savoir si je le fais scanner en mode normal ou s"il; y a une autre façon d'aller en mode sans échec..

Ha et aujourd'hui, la page antivirus 2009 a recommencé à apparaitre à tout moment et l'ordinateur est bien lent (ca allait mieux hier hihihi).

J'attends vos instructions pour ne pas faire d'erreur!

Merci

okay, fais-le alors en mode sans échec alors...

N'oublie de refaire une mise à jour du logiciel, avant de faire l'analyse.

A plus

Zor

Voici le rapport de superantispyware:

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 12/07/2008 at 09:45 AM

Application Version : 4.22.1014

Core Rules Database Version : 3665
Trace Rules Database Version: 1645

Scan type : Complete Scan
Total Scan Time : 00:43:42

Memory items scanned : 369
Memory threats detected : 0
Registry items scanned : 4675
Registry threats detected : 13
File items scanned : 22795
File threats detected : 269

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}\InprocServer32
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\NIWEBAZI.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler#{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#SSODL
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}

Adware.Vundo Variant/Rel
HKLM\SOFTWARE\Microsoft\contim
HKLM\SOFTWARE\Microsoft\contim#SysShell
HKLM\SOFTWARE\Microsoft\rdfa
HKLM\SOFTWARE\Microsoft\rdfa#F
HKLM\SOFTWARE\Microsoft\rdfa#N

Trojan.Fake-Alert/Trace
HKU\S-1-5-21-1454471165-2052111302-1801674531-1003\SOFTWARE\Microsoft\fias4013

Adware.Tracking Cookie
fl01.ct2.comclick.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
fl01.ct2.comclick.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
fl01.ct2.comclick.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.mediaplex.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.imrworldwide.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.imrworldwide.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.xiti.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.doubleclick.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.weborama.fr [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.weborama.fr [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracker.affistats.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.bluestreak.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
www.smartadserver.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
www.smartadserver.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
www.smartadserver.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.tradedoubler.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
tracking.publicidees.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.advertstream.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.fastclick.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.yourmedia.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.estat.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
weba.cdiscount.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.hitbox.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.ehg-wysetechnologyinc.hitbox.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.reduxads.valuead.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.reduxads.valuead.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.burstnet.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.burstnet.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.reduxads.valuead.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.reduxads.valuead.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.casalemedia.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.tacoda.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.atdmt.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.adcentriconline.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.vitamine.networldmedia.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.ehg-yellowpages.hitbox.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
.statcounter.com [ C:\Documents and Settings\magiknet\Application Data\Mozilla\Firefox\Profiles\74bi61sx.default\cookies.txt ]
C:\Documents and Settings\magiknet\Cookies\magiknet@ads.mytelus[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@adv.surinter[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@ads.bleublancrouge[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@xiti[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@adopt.hbmediapro[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@ad.cibleclick[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@ads.ookla[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@tribalfusion[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@advertstream[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@fl01.ct2.comclick[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@tracker.affistats[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@vitamine.networldmedia[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@track.effiliation[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@acronis.122.2o7[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@questionmarket[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@www.meteomedia[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@bluestreak[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@hitbox[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@windowsmedia[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@microsoftwlmessengermkt.112.2o7[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@adcentriconline[2].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@servedby.advertising[1].txt
C:\Documents and Settings\magiknet\Cookies\magiknet@tracking.publicidees[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@lotsofads.smilingtraffic[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-telecomitalia.hitbox[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@partners.webmasterplan[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.revsci[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.widgetbucks[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@aimfar.solution.weborama[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@aupaysdusexe[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@sexologie-magazine[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ad.cibleclick[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@tracking.publicidees[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@homedepotca.122.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adserve.atedra[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@servedby.onlinemediadiva[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adserver.aol[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@mediaresponder[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.pointroll[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@partygaming.122.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@track.effiliation[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@revenue[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@partypoker[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@members.fortunecity[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@advertising[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@statse.webtrendslive[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.le-bon-casino[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@imrworldwide[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.addfreestats[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@amazonsearsca.122.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adcentriconline[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.lucidmedia[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-archambaultdotca.hitbox[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@xiti[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@smartadserver[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@himedia.112.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@zedo[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@vitamine.networldmedia[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@atwola[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@apmebf[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@searchmobile.solution.weborama[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@canadapost.112.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.gamesbannernet[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.stardoll[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@cetelem.solution.weborama[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@canoe.112.2o7[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@myroitracking[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads2.nexmedia[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-corusentertainment.hitbox[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@guigoz.solution.weborama[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@rotator.adjuggler[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@casalemedia[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@eas.apm.emediate[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@005.free-counters.co[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@angleinteractive.directtrack[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ad.caradisiac[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@hc2.humanclick[3].txt
C:\Documents and Settings\Nadia\Cookies\nadia@hc2.humanclick[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@sales.liveperson[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@specificclick[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@sales.liveperson[3].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.burstnet[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.usenext[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.networldmedia[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@teletoon.112.2o7[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@clickarrows[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@webpresseaccount.ads.streamtheworld[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adfarm1.adition[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@publishers.clickbooth[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@serving-sys[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-yellowpages.hitbox[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@clickintext[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@anad.tacoda[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@kontera[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-dig.hitbox[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@usenext[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@hitbox[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.googleadservices[3].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adopt.euroclick[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@directtrack[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.psychomedia.qc[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@psychomedia.qc[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@tradedoubler[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@trafficmp[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@server.cpmstar[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.realtechnetwork[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@click-fr[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@wmvmedialease[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@stats.canalblog[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@mybannermaker[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@bs.serving-sys[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-mybc.hitbox[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.boonty[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@marketlive.122.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@bluestreak[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adviva[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.canalblog[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@yourmedia[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@doubleclick[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-bellcanada.hitbox[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@networldmedia[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.warnerbros[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@airmilesrewardprogram.112.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.meteomedia[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@banner.reciperewards[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@overture[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@interclick[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-bestbuy.hitbox[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@hornymatches[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adv.surinter[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@realmedia[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ad.wedoo[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@aolfr.122.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@tribalfusion[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@fortunecity[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@fastclick[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@comeinmyworld.solution.weborama[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.stats.casio[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.cibleclick[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.clicksor[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@m1.webstats.motigo[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@wrigley.122.2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@yieldmanager[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@questionmarket[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www4.addfreestats[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@advertstream[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www.w3counter[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-warnerbrothers.hitbox[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@tracker.affistats[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@stat.onestat[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@media6degrees[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@www3.addfreestats[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@2o7[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@680.stats.misstrends[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ad.ieurop[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ad.yieldmanager[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@adbrite[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.addynamix[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.allotraffic[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ads.monster[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@chitika[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@clickbank[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@e-2dj6wjlyumdjcbo.stats.esomniture[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@ehg-css.hitbox[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@fl01.ct2.comclick[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@hypertracker[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@media.adrevolver[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@rencontrexpress.sexy.easyrencontre[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@revsci[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@tacoda[2].txt
C:\Documents and Settings\Nadia\Cookies\nadia@weborama[1].txt
C:\Documents and Settings\Nadia\Cookies\nadia@webstat.yamaha[2].txt

Adware.Vundo Variant/DRM
C:\WINDOWS\SYSTEM32\BAYONARU.DLL
C:\WINDOWS\SYSTEM32\BUROLAGE.DLL
C:\WINDOWS\SYSTEM32\DEWULALE.DLL
C:\WINDOWS\SYSTEM32\FIGEPEVO.DLL
C:\WINDOWS\SYSTEM32\FULEFOZE.DLL
C:\WINDOWS\SYSTEM32\HAFURIVE.DLL
C:\WINDOWS\SYSTEM32\SAPOVIRI.DLL
C:\WINDOWS\SYSTEM32\WALIKAHE.DLL
C:\WINDOWS\SYSTEM32\YEFANOPA.DLL
C:\WINDOWS\SYSTEM32\YEYAPOYU.DLL

Adware.Vundo Variant/HAL
C:\WINDOWS\SYSTEM32\GIWOHIDE.DLL

Je reviens mettre l'autre rapport dans une minute!

Le voici:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:05, on 2008-12-07
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Nadya\Bureau\coucou.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?hl=fr&gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9ec2edf7-86ab-426f-b67c-6b0d90669933} - C:\WINDOWS\system32\jurevewa.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\PROGRAMMES\qttask.exe" -atboottime
O4 - HKLM\..\Run: [kafipijefa] Rundll32.exe "C:\WINDOWS\system32\putayila.dll",s
O4 - HKLM\..\Run: [CPM7b7da813] Rundll32.exe "c:\windows\system32\ruhegozi.dll",a
O4 - HKLM\..\Run: [784e9b8f] rundll32.exe "C:\WINDOWS\system32\tugojogu.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [kafipijefa] Rundll32.exe "C:\WINDOWS\system32\putayila.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1223695359359&h=6747ab5bf40679864877327b81820489/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll C:\WINDOWS\system32\woyawizi.dll c:\windows\system32\ruhegozi.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\ruhegozi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\ruhegozi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe

Salut,

1) je pense que tu n'as pas traité l'ordinateur avec CCleaner. Je m'étonne de voir autant de cookies dans le scan avec Superantispyware.

2) je souhaiterais le rapport suivant de superantispyware:
dans le menu principal du logiciel, vas dans "preference" puis "statistics/logs"
copie le dernier rapport ici

A plus

Zor

Re-salut,

quoiqu'il en soit , tu as une infection Vundo.

Applique ceci

* Télécharger ComboFix (par sUBs) sur le Bureau.
* Double-cliquer combofix.exe.
* Il est vivement recommandé d'installer la Console de récupération !.
* Appuyer sur la touche Y (Yes) pour démarrer le scan.
* Le rapport sera crée dans: C:\Combofix.txt.
* Refaire un rapport HijackThis, et fixer les lignes correspondantes comme indiqué plus haut.

Le tutoriel officiel et le lieu de téléchargement se trouvent à cette adresse :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

A plus

Zor

Pourtant, j'avais bel et bien fait un CCleaner....J'ai ptêtre oublié une étape!
M'enfin, après ton premier message, j'ai refait un CCleaner et un superantispyware dont voici le rapport:

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 12/07/2008 at 05:07 PM

Application Version : 4.22.1014

Core Rules Database Version : 3665
Trace Rules Database Version: 1645

Scan type : Complete Scan
Total Scan Time : 01:09:42

Memory items scanned : 409
Memory threats detected : 0
Registry items scanned : 4673
Registry threats detected : 13
File items scanned : 22820
File threats detected : 2

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}\InprocServer32
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\RUHEGOZI.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler#{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#SSODL
HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}

Adware.Tracking Cookie
C:\Documents and Settings\Nadya\Cookies\nadya@atdmt[2].txt

Adware.Vundo Variant/Rel
HKLM\SOFTWARE\Microsoft\contim
HKLM\SOFTWARE\Microsoft\contim#SysShell
HKLM\SOFTWARE\Microsoft\rdfa
HKLM\SOFTWARE\Microsoft\rdfa#F
HKLM\SOFTWARE\Microsoft\rdfa#N

Trojan.Fake-Alert/Trace
HKU\S-1-5-21-1454471165-2052111302-1801674531-1003\SOFTWARE\Microsoft\fias4013

Je repars pour faire le combofix et je te reviens avec le rapport!
Merci encore de me donner de ton temps

parfait, j'attends le rapport combofix

a plus

Zor

Bon voici le rapport Combofix. Désolée pour le délai...

ComboFix 08-12-09.03 - Nadya 2008-12-10 10:53:51.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.233 [GMT -5:00]
Lancé depuis: c:\documents and settings\Nadya\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Nadya\Bureau\WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\Windows Live\Messenger\msimg32.dll
c:\windows\system32\adazelaj.ini
c:\windows\system32\dahogemu.dll
c:\windows\system32\dorebobo.dll
c:\windows\system32\edihowig.ini
c:\windows\system32\egojolah.ini
c:\windows\system32\ejedufev.ini
c:\windows\system32\evirufah.ini
c:\windows\system32\ezofeluf.ini
c:\windows\system32\fiyobubi.dll
c:\windows\system32\fosutozi.dll
c:\windows\system32\hafafava.dll
c:\windows\system32\ibuboyif.ini
c:\windows\system32\irivopas.ini
c:\windows\system32\izotusof.ini
c:\windows\system32\jalezada.dll
c:\windows\system32\jasosise.dll
c:\windows\system32\oboberod.ini
c:\windows\system32\sugedaji.dll
c:\windows\system32\tmp.reg
c:\windows\system32\uduyavuy.ini
c:\windows\system32\ugojogut.ini
c:\windows\system32\ukogagub.ini
c:\windows\system32\umegohad.ini
c:\windows\system32\uranoyab.ini
c:\windows\system32\vefudeje.dll
c:\windows\system32\vuzuzeye.dll
c:\windows\system32\yuvayudu.dll

----- BITS: Il y a peut-être des sites infectés -----

hxxp://77.74.48.105
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-11-10 au 2008-12-10 ))))))))))))))))))))))))))))))))))))
.

2008-12-06 09:29 . 2008-12-06 09:29 <REP> d-------- c:\program files\SUPERAntiSpyware
2008-12-06 09:29 . 2008-12-06 09:29 <REP> d-------- c:\documents and settings\Nadya\Application Data\SUPERAntiSpyware.com
2008-12-06 09:29 . 2008-12-06 09:29 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-12-06 09:23 . 2008-12-06 09:23 <REP> d-------- c:\program files\CCleaner
2008-12-05 14:18 . 2008-12-05 14:26 <REP> d-------- C:\Lop SD
2008-12-05 13:55 . 2008-12-05 14:15 <REP> d-------- c:\program files\Navilog1
2008-12-03 12:23 . 2005-08-27 02:38 1,435,272 --a------ c:\windows\system32\Flash.ocx
2008-12-03 12:23 . 2003-11-19 13:59 512,688 --a------ c:\windows\system32\XceedCry.dll
2008-12-03 12:23 . 2004-05-11 09:56 423,784 --a------ c:\windows\system32\XceedBkp.dll
2008-12-03 12:23 . 2004-02-05 20:53 389,120 --a------ c:\windows\system32\ACTSKN43.OCX
2008-12-03 12:23 . 2004-01-09 10:54 188,416 --a------ c:\windows\system32\actsplash.ocx
2008-12-03 12:23 . 2004-03-08 23:00 131,856 --a------ c:\windows\system32\MSADODC.ocx
2008-12-03 12:23 . 2001-03-28 22:02 89,088 --a------ c:\windows\system32\ProgressBar4.ocx
2008-12-03 12:23 . 1999-01-26 19:36 11,012 --a------ c:\windows\system32\threadapi.tlb
2008-11-19 14:02 . 2008-11-19 14:02 <REP> d-------- c:\program files\Fichiers communs\Adobe AIR
2008-11-19 14:02 . 2008-11-19 14:02 <REP> d-------- c:\program files\bayardKids
2008-11-19 14:02 . 2008-11-19 14:02 <REP> d-------- c:\documents and settings\Nadya\Application Data\bayardKids.08AE7BFC096D057FBA48C7E4F898C35F7FA11BBA.1
2008-11-17 20:09 . 2008-11-17 20:10 <REP> d-------- C:\lecto3ecycledemo
2008-11-17 19:37 . 2008-11-18 13:00 <REP> d-------- c:\program files\Les Logiciels Scripto
2008-11-17 19:37 . 2008-11-17 19:37 4,145 --a------ c:\windows\ST6UNST.001
2008-11-17 19:37 . 2008-11-18 13:00 37 --a------ C:\_tmpWriting.001
2008-11-17 19:36 . 2006-03-17 08:06 7,055,539 --------- c:\windows\w32Files.cab
2008-11-17 19:36 . 2008-11-17 19:37 74,752 --a------ c:\windows\ST6UNST.EXE
2008-11-17 19:36 . 2008-11-17 19:37 27,648 --------- c:\windows\Setup1.exe
2008-11-17 19:36 . 2008-11-17 19:36 4,190 --a------ c:\windows\ST6UNST.000
2008-11-17 19:33 . 2008-11-17 19:35 <REP> d-------- C:\primo3ecycledemo
2008-11-17 19:27 . 2008-11-17 19:27 <REP> d-------- C:\Linguaprimaireword
2008-11-15 13:25 . 2008-11-15 13:25 <REP> d-------- c:\program files\Fichiers communs\Apple
2008-11-15 13:25 . 2008-11-15 13:25 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer
2008-11-15 13:24 . 2008-11-15 13:24 <REP> d-------- c:\program files\Apple Software Update
2008-11-15 13:24 . 2008-11-15 13:24 <REP> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2008-11-12 09:11 . 2008-09-04 12:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 09:11 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 00:34 --------- d-----w c:\program files\Lx_cats
2008-12-08 15:26 65,129 --sha-w c:\windows\system32\fumupofo.dll
2008-12-06 14:28 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-12-03 17:10 --------- d-----w c:\program files\Azureus
2008-12-03 16:12 --------- d-----w c:\documents and settings\Nadya\Application Data\Azureus
2008-11-18 18:00 37 ----a-w c:\program files\_tmpWriting.001
2008-11-15 18:19 --------- d-----w c:\program files\QuickTime
2008-10-28 01:29 --------- d-----w c:\documents and settings\Nadya\Application Data\LimeWire
2008-10-24 14:34 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Messenger Plus!
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-11 03:24 --------- d-----w c:\program files\Java
2008-10-11 01:54 --------- d-----w c:\documents and settings\Nadya\Application Data\vlc
2008-09-16 12:47 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll
1999-04-16 09:28 151,552 ----a-r c:\windows\inf\Agfa\message.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2002-10-15 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2002-10-15 114688]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"LXCFCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 73728]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SoundMan"="SOUNDMAN.EXE" [2002-08-15 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Nadia\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.0.lnk - c:\program files\OpenOffice.org 2.0\program\quickstart.exe [2005-12-14 61440]

c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-09-15 25214]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 15:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll c:\windows\system32\ruhegozi.dll c:\windows\system32\yawiziga.dll c:\windows\system32\bidifetu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"d:\\PROGRAMMES\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-09-16 97928]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-11-17 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-11-17 55024]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-09-16 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-09-16 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-09-16 76040]
S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{9ec2edf7-86ab-426f-b67c-6b0d90669933} - c:\windows\system32\zazuporo.dll
HKLM-Run-QuickTime Task - d:\programmes\qttask.exe
HKLM-Run-kafipijefa - c:\windows\system32\kolokilu.dll
HKLM-Run-CPM7b7da813 - c:\windows\system32\bidifetu.dll

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-10 10:59:29
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCFCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(532)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Heure de fin: 2008-12-10 11:03:40 - La machine a redémarré [Nadya]
ComboFix-quarantined-files.txt 2008-12-10 16:03:30

Avant-CF: 6 685 396 992 octets libres
Après-CF: 7,378,984,960 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn

199 --- E O F --- 2008-11-13 14:17:18

Je refais un hijackthis à l'instant!