Eradiquer Koobface

Voilà c'est fait !

Bonjour,

Je n'arrive pas à télécharger VundoFix. En fait, tous les sites ou je peux télécharger des logiciels comme Ad-Remover, Trojan Remover ou Vundofix sont inaccessibles depuis mon PC. Je suppose que c'est dû à Kobbface.

J'ai réussi à télécharger Ad-Remover depuis mon laptop puis à le mettre sur ma clé USB, puis à le mettre sur mon PC et à l'utiliser. Pareil pour Trojan Remover, mais ce dernier n'a servi à rien.

Pour VundoFix, c'est impossible de le sauver sur le disque dur de mon laptop, et donc de le transférer sur mon PC par la suite.

Voici mon rapport AD-Remover, suivi d'un nouveau rapport HijackThis. Y a-t-il un autre logiciel qui me permettrait d'obtenir le résultat de VundoFix ?

Rapport AD-Remover


--------- Logfile of AD-Remover 1.0.6.8 by C_XX ---------

# START at: 20:41:59 | Mar 09/12/2008 ON Microsoft® Windows XP ™ v5.1.2600
# BOOT MODE: Normal

# OPTION: Scan
# EXECUTED FROM: C:\Documents and Settings\Gilles\Bureau\Ad-remover\AD-Remover.bat

# PC: GILLES-A3E029D1 | USER: Gilles ( Current user is an administrator )

# DRIVE(S): A:\
# Systemdrive: C:\ ()
# Internet Explorer v7.0.5730.13

--------- [ RUNNING PROCESSES: 50 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Belgacom\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------


+-----------------------| Boonty/Boonty Games Elements found..

"Boonty Games" (service)
.
"HKEY_CLASSES_ROOT\boontybox"
"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
"HKEY_LOCAL_MACHINE\Software\Classes\boontybox"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Boonty Games"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Boonty Games"
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Boonty Games"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Boonty Games"
.
[13/07/2006 09:21|d--------] C:\Program Files\Boonty
[13/08/2006 22:51|d--------] C:\Program Files\BoontyGames
[13/07/2006 02:10|d--------] C:\Program Files\Fichiers communs\BOONTY Shared
[13/07/2006 02:10|d--------] C:\Documents and Settings\All Users\Application Data\BOONTY

+-----------------------| Eorezo Elements found..

.

+-----------------------| Everest Poker Elements found..

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found..

"HKEY_CLASSES_ROOT\CLSID\{014da6c9-189f-421a-88cd-07cfe51cff10}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{014DA6C9-189F-421a-88CD-07CFE51CFF10}"
.

+-----------------------| Messenger Skinner Elements found..

.

+-----------------------| Sweetim Elements found..

.

+-----------------------| ADDED SCAN ..



+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\4g3wf0g5.default\prefs.js :

~~~~ Mozilla FireFox version [Unable to get version] ~~~~


+----------+


+---------------------------------------------------------------------------+

+--[HKEY_CURRENT_USER\..\Run]

CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
Skype REG_SZ "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
tbon REG_SZ C:\Program Files\TBONBin\tbon.exe /r
BitTorrent REG_SZ "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H/PC Connection Agent REG_SZ "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

+--[HKEY_LOCAL_MACHINE\..\Run]

SoundMan REG_SZ SOUNDMAN.EXE
NVRaidService REG_SZ C:\WINDOWS\system32\nvraidservice.exe
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
SW20 REG_SZ C:\WINDOWS\system32\sw20.exe
SW24 REG_SZ C:\WINDOWS\system32\sw24.exe
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
CoolSwitch REG_SZ C:\WINDOWS\system32\taskswitch.exe
BackgroundSwitcher REG_SZ C:\WINDOWS\system32\bgswitch.exe
FastUser REG_SZ C:\WINDOWS\system32\fast.exe
OpwareSE2 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
SemanticInsight REG_SZ C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
AppleSyncNotifier REG_SZ C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
Belgacom REG_SZ "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"

+--[HKEY_USERS\.DEFAULT\..\Run]

CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.blue-army.com/home/

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://go.microsoft.com/fwlink/?LinkId=69157

+---------------------------------------------------------------------------+

- "C:\AD-report-09.12.2008.log" (6500 octets)

[ END at: 20:43:19 | 09/12/2008 ] - [ Time elapsed: 79.7 seconds ]

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 155 lines ]
+---------------------------------------------------------------------------+

___________________________________________________________________________________________

Deuxième rapport HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 20:57:38, on 09/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Belgacom\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Belgacom\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\system32\notepad.exe
G:\Virus\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.bluearmy.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [BackgroundSwitcher] C:\WINDOWS\system32\bgswitch.exe
O4 - HKLM\..\Run: [FastUser] C:\WINDOWS\system32\fast.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://belgacom.extrafilm.be/ImageUploader4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - https://www.afternic.com/domains/errorsafe.com
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp01.photoprintit.de/microsite/defaults/activex/IPSUploader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe" -z (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SupportSoft Sprocket Service (belgacom) (sprtsvc_belgacom) - SupportSoft, Inc. - C:\Program Files\Belgacom\bin\sprtsvc.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Fichiers communs\Supportsoft\bin\ssrc.exe

essaye une desinfection en ligne
https://www.kaspersky.fr/downloads
il en existe d'autre
http://www.kaspersky.com/kos/eng/partner/71365/kavwebscan.html
il faut autoriser l'installation de l'activeX
pour les navigateur Internet Explorer et Firefox : https://www.trendmicro.com/en_us/forHome/products/housecall.html
http://www.secuser.com/outils/antivirus_installation.htm

on va regarder autre chose
--> Télécharge FindyKill sur ton bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

--> Lance l'installation avec les paramètres par defaut

--> Double-clique sur le raccourci FindyKill sur ton bureau

--> Au menu principal, choisis l'option 1 (Recherche)

--> Poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

Bonjour,

Merci à vous deux pour votre aide.

Par erreur, j'ai lancé deux fois HiJackThis. La première fois, j'ai retrouvé tous les éléments mentionnés par Chimay8. La seconde, il n'y avait plus que O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

Voici les rapports FindyKill et Toolbar-S&D :

Rapport FindyKill :



----------------- FindyKill V4.709 ------------------

* User : Gilles - GILLES-A3E029D1
* executed from : C:\Program Files\FindyKill
* Update on 10/12/08 par Chiquitine29
* Start at 12:44:51 the 12/12/2008
* Windows XP - Internet Explorer 7.0.5730.13


((((((((((((((( *** deleting *** ))))))))))))))))))


--------------- [ Active Processes ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe

--------------- [ Infected files / folders ] ----------------


»»»» Supression files in C:


»»»» Supression files in C:\WINDOWS


»»»» Supression files in C:\WINDOWS\Prefetch


»»»» Supression files in C:\WINDOWS\system32


»»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming


»»»» Supression files in C:\WINDOWS\system32\drivers


»»»» Supression files in C:\Documents and Settings\Gilles\Application Data


»»»» Supression files in C:\DOCUME~1\Gilles\LOCALS~1\Temp


»»»» Supression files in C:\Documents and Settings\Gilles\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{146BC6C3-7B64-43DE-A4C3-F91A57D1FBDE}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{1AB20AA8-5DB3-48F2-BB6F-DB83B61DFB64}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{4CB0EB64-5247-441F-AFBD-4DB831F6745A}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{73F95080-271A-46F2-B646-1A9E4A9BCF77}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{782084DB-9B64-4504-AD76-54CA84992CA9}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{98CC9206-C167-42DD-8727-B641B7BE2B9F}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{D0B1550D-CB98-4B2F-B642-95087DA2298C}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{DD94327E-B64A-407E-ACCB-22629F3603F5}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{E0B2B649-5A0D-4EA5-B79F-A29CC07AEFE1}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{F21151F7-9985-4DC9-9B64-F5E30811934E}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{F3E2CEF9-AB64-47C7-9FD9-8837518136A4}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Temporary Internet Files\Content.IE5\NS6NMRAJ\9NFZCAFURJ41CAV8WFOACAVYRSXRCAIOR73DCAYGMZ7HCA13ZJJBCA2MK6VQCADKPYU9CA8YKLGXCACR0TPACA9T4QDECA7GVYWXCA5DKL28CAOOY49RCA3U2IB1CAIGR17JCAMXDNH9CAORM2YNCA4G8GYI.jpg
Deleted ! - C:\Documents and Settings\Nathalie\Local Settings\Temporary Internet Files\Content.IE5\09IFP6Z3\4A1FD67B643C9B084F87E4F8CC34[1].jpg
Deleted ! - C:\Documents and Settings\Nathalie\Local Settings\Temporary Internet Files\Content.IE5\8GOGSZZN\A64678FC41AC75C57AFE9636B648[1].jpg
Deleted ! - C:\Documents and Settings\Nathalie\Local Settings\Temporary Internet Files\Content.IE5\AX61ORUM\D3AC16D9B64E973AE42240F92D57D6[1].jpg
Deleted ! - C:\Documents and Settings\Nathalie\Local Settings\Temporary Internet Files\Content.IE5\CDERWT6B\B41B245922F927FB6478F09090CB3B[1].jpg
Deleted ! - C:\Documents and Settings\Nathalie\Local Settings\Temporary Internet Files\Content.IE5\S7YBKTYV\9A8983FFA7D84B6493FD559C2EC35[1].jpg
Deleted ! - C:\Documents and Settings\Nathalie\Local Settings\Temporary Internet Files\Content.IE5\VGRBEHPV\2343A87BFD51BA216B648328555E[1].jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{146BC6C3-7B64-43DE-A4C3-F91A57D1FBDE}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{1AB20AA8-5DB3-48F2-BB6F-DB83B61DFB64}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{4CB0EB64-5247-441F-AFBD-4DB831F6745A}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{73F95080-271A-46F2-B646-1A9E4A9BCF77}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{782084DB-9B64-4504-AD76-54CA84992CA9}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{98CC9206-C167-42DD-8727-B641B7BE2B9F}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{D0B1550D-CB98-4B2F-B642-95087DA2298C}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{DD94327E-B64A-407E-ACCB-22629F3603F5}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{E0B2B649-5A0D-4EA5-B79F-A29CC07AEFE1}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{F21151F7-9985-4DC9-9B64-F5E30811934E}.jpg
Deleted ! - C:\Documents and Settings\Gilles\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{F3E2CEF9-AB64-47C7-9FD9-8837518136A4}.jpg

--------------- [ Registry / Infected keys ] ----------------


--------------- [ States / Restarting of services ] ----------------



+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2


--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe

G: - Lecteur amovible

J: - Lecteur fixe


+- deleting files :


--------------- [ Registry / Mountpoint2 ] ----------------


-> Not found !


--------------- [ Searching Cracks / Keygen ] ----------------

C:\Documents and Settings\Gilles\Mes documents\Incomplete\T-3587785-Adam Green - Crackhouse Blues.mp3
C:\Documents and Settings\Gilles\Recent\Adobe.Photoshop.CS2.(v9.0).FR.Officielle.Incl-Crack.et.Keygen.par.eMule-Paradise.com.lnk
C:\Documents and Settings\Gilles\Recent\Adobe.Photoshop.CS2.v9.0.1.FR.Incl-Crack.et.Keygen.lnk


---------------- ! End of report ! ------------------



Rapport Toolbar S&D :


-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3000+ )
BIOS : Award Modular BIOS v6.00PG
USER : Gilles ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081211-0] 4.8.1296 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:149 Go (Free:103 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
G:\ (USB) - FAT - Total:1958 Mo (Free:0 Go)
J:\ (Local Disk) - NTFS - Total:298 Go (Free:138 Go)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [1] ( 12/12/2008|12:54 )

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Bar"="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fsearch%2flobby%2fsearch.asp%3f"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr"


--------------------\\ Recherche d'autres infections

--------------------\\ ROOTKIT !!

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV.SYS]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS]

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Gilles\Mes documents\Incomplete\T-3587785-Adam Green - Crackhouse Blues.mp3
C:\DOCUME~1\Gilles\Recent\Adobe.Photoshop.CS2.(v9.0).FR.Officielle.Incl-Crack.et.Keygen.par.eMule-Paradise.com.lnk
C:\DOCUME~1\Gilles\Recent\Adobe.Photoshop.CS2.v9.0.1.FR.Incl-Crack.et.Keygen.lnk



1 - "C:\ToolBar SD\TB_1.txt" - 12/12/2008|11:12 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 12/12/2008|12:56 - Option : [1]

-----------\\ Fin du rapport a 12:56:30,31

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TDSSSERV.SYS]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS]

relance et Fais l'option 2 de ToolBar S&D.

et donne nous un nouveau rapport hijack

voici tous ce qui a été suprimé sur son pc
"en attente d'un nouveau rapport"

suppression de C:\StubInstaller.exe

*** Suppression des fichiers dans C:\WINDOWS\system32
suppression de C:\WINDOWS\system32\winsys.exe
suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1"

-- [ Registre / Mountpoint2 ] -
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0655bd81-55a8-11da-b490-806d6172696f}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{45eff30e-bb94-11db-b9c2-000e509073b9}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1ab1343-5b8d-11d9-b434-806d6172696f}\Shell\AutoRun\command


- Fichiers temporaires effacés
- [Spécial : AdRotator] C:\WINDOWS\system32\bitsprx4.dll
- C:\DBBackup\