Google redirigé

ok parfait!

Pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

_______________

telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

_________________

Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Collect::
C:\WINDOWS\system32\kungsfvgnijejy.dll
C:\WINDOWS\system32\kungsfnkrjufbw.dat.rmv
C:\WINDOWS\system32\kungsfnkrjufbw.dat
C:\WINDOWS\system32\kungsfmodanxob.dll.rmv
C:\WINDOWS\system32\kungsfmodanxob.dll
C:\WINDOWS\system32\drivers\kungsfunbxcpxe.sys.rmv
C:\WINDOWS\system32\drivers\kungsfunbxcpxe.sys
Driver ::
kungsfunbxcpxe
File::
C:\WINDOWS\system32\kungsfvgnijejy.dll
C:\WINDOWS\system32\kungsfnkrjufbw.dat.rmv
C:\WINDOWS\system32\kungsfnkrjufbw.dat
C:\WINDOWS\system32\kungsfmodanxob.dll.rmv
C:\WINDOWS\system32\kungsfmodanxob.dll
C:\WINDOWS\system32\drivers\kungsfunbxcpxe.sys.rmv
C:\WINDOWS\system32\drivers\kungsfunbxcpxe.sys
C:\WINDOWS\system32\drivers\kungsfunbxcpxe.sys

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

vire firefox puis remets le

c'est bon?

Télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
(attention bien mettre :files)

:processes
explorer.exe
:files
C:\DOCUME~1\HP_ADM~1\Application Data\Azureus\torrents\Anonymus_Virtua_Girl_HD_Install_KeyGen[1].torrent
C:\DOCUME~1\HP_ADM~1\Local Settings\Application Data\ApplicationHistory\VGHDKeygen.exe.1ae07cd0.ini
C:\DOCUME~1\HP_ADM~1\Local Settings\Application Data\ApplicationHistory\VGHDKeygen.exe.3ad2215d.ini
C:\DOCUME~1\HP_ADM~1\Local Settings\Application Data\ApplicationHistory\VGHDKeygen.exe.87c72bb7.ini
C:\DOCUME~1\HP_ADM~1\My Documents\Portable Acoustica CD_DVD Label Maker v3.32\keygen
C:\DOCUME~1\HP_ADM~1\My Documents\Portable Acoustica CD_DVD Label Maker v3.32\keygen\CDDVDLabelMakerKeygen.exe
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

_____________________________

utilise pour supprimer tes traces

CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo
(dans les options puis avancé :désactive la case: effacer les fichiers de plus de 48 heures)
https://www.malekal.com/tutoriel-ccleaner/
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

_______________________________

cela persiste?

télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
(attention bien mettre :files)

:processes
explorer.exe
:files
C:\hp\recovery\wizard\SWR_Wizard.exe
K:\logiciel\vReveal-1.0.1.rar
:reg
hkey_classes_root\vbrad.trayicon
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

__________________

ceci si t'es pas sur tu vire:

C:\Documents and Settings\HP_Administrator\My Documents\wintv\smd\hcwsmd05.exe
K:\logiciel\allok video joiner\KeyGen.rar[
K:\logiciel\Allok.Video.Joiner.v2.0.2.Keygen..rar
K:\logiciel\hcw2_7_24117_usb2.zip

_____________________

# télécharger Hoster :
http://www.funkytoad.com/download/HostsXpert.zip

# Dézipper le dossier sur le bureau.
# Lancer Hoster et cliquer sur Restore Microsoft's Hosts File

si impossible fais RHOST

http://siri.urz.free.fr/RHosts.php

________________________

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

http://darfuns.com/remove-google-search-result-redirect-virus/

internet explorer 8 reinitialiser
firefox ca marche pas es-ce bien pour xp de toute facon la semaine passé j'avais toute enleve et reinstallé avec le defaut.
scan panda;
Ne pas tenir compte de la description qui commence par k car c'est mon disque dur externe que j'ai oublié d'enlever.ni du systeme volume car c'est mon systeme restore point que j'ai nettoyé
il reste pas grand chose et de toute facon j'ai enlevé et sans resultat.

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-06-03 22:35:03
PROTECTIONS: 2
MALWARE: 7
SUSPECTS: 19
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Antivirus BitDefender 12.0 No Yes
AVG Anti-Virus 8.5 No Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00003428 adware/memorywatcher Adware No 0 Yes No hkey_classes_root\vbrad.trayicon
00487624 Trj/Banker.LNO Virus/Trojan No 1 Yes No C:\hp\recovery\wizard\SWR_Wizard.exe
00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP453\A0090872.sys
00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP452\A0090601.sys
00921467 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP409\A0080882.exe
00921467 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP412\A0081768.exe
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP412\A0082702.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP409\A0080912.EXE
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP409\A0080901.sys
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP412\A0082691.sys
05304580 Generic Trojan Virus/Trojan No 0 No No K:\logiciel\vReveal-1.0.1.rar[vReveal-1.0.1\Cerise\vReveal.exe]
;===================================================================================================================================================================================
SUSPECTS
Sent Location `.
;===================================================================================================================================================================================
No C:\Documents and Settings\HP_Administrator\My Documents\wintv\smd\hcwsmd05.exe `.
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP420\A0083996.exe `.
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP420\A0083996.exe[32788R22FWJFW\n.com]
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP420\A0083996.exe[32788R22FWJFW\NirCmd.cfexe]
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP420\A0083996.exe[32788R22FWJFW\n.com]
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP420\A0083996.exe[32788R22FWJFW\NirCmd.cfexe]
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP420\A0083996.exe[32788R22FWJFW\n.com]
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP420\A0083996.exe[32788R22FWJFW\NirCmd.cfexe]
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP452\A0090789.com `.
No C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP452\A0090791.com `.
No C:\WINDOWS\NIRCMD.exe `.
No K:\logiciel\allok video joiner\KeyGen.rar[keygen.exe] `.
No K:\logiciel\Allok.Video.Joiner.v2.0.2.Keygen..rar[keygen\keygen.exe] `.
No K:\logiciel\ComboFix.exe[32788R22FWJFW\NirCmd.cfexe] `.
No K:\logiciel\ComboFix.exe[32788R22FWJFW\n.com] `.
No K:\logiciel\hcw2_7_24117_usb2.zip[smd/hcwsmd05.exe] `.
No K:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP375\A0077726.exe `.
No K:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP410\A0081451.exe `.
No K:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP453\A0090925.exe `.
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description `.
;===================================================================================================================================================================================
;===================================================================================================================================================================================

initialise firefox ou internet explorer comme ceci:

http://www.commentcamarche.net/faq/sujet 9525 reinitialiser firefox reset

https://www.pcastuces.com/newsletter/adj/1943.htm

________________

colle un scan en ligne panda

https://www.informatruc.com

Log Malwarebytes' Anti-Malware 1.37

Database version: 2214
Windows 5.1.2600 Service Pack 3

02/06/2009 3:33:11 PM
mbam-log-2009-06-02 (15-33-11).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 210089
Time elapsed: 1 hour(s), 25 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Pour avg 8 je ne trouve pas de log(option) il y ajuste le log event mais ca dis juste qu'un scan a ete fait telle date.Le log de file je ne trouve pas

Merci de m'aider.
Je suis redirigé sur plusieurs site
exemple: https://encyclopedia.thefreedictionary.com -https://parkavedomains.com/domain/FindStuff.com/
des sites qui vends des anti-malware,et surtout de la pub
lorsque que je reessaye le lien apres plusieurs fois ca me redirige vers http://www.google.ca/undefined ensuite le lien marche.Voici le log de combofix:
ComboFix 09-05-31.06 - HP_Administrator 01/06/2009 17:48.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1518 [GMT -4:00]
Running from: c:\documents and settings\HP_Administrator\My Documents\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\HP_Administrator\Application Data\inst.exe
c:\windows\system32\mfc45.dll
D:\Desktop.ini

.
((((((((((((((((((((((((( Files Created from 2009-05-01 to 2009-06-01 )))))))))))))))))))))))))))))))
.

2009-06-01 21:43 . 2009-06-01 21:44 -------- d-----w- C:\ComboKill
2009-05-28 21:24 . 2009-05-28 21:25 3371383 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-28 21:24 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-28 21:24 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 21:24 . 2009-05-28 21:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-27 19:50 . 2009-05-27 19:50 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Xenocode
2009-05-26 02:10 . 2009-05-26 02:23 -------- d-----w- c:\program files\Nufsoft
2009-05-25 04:47 . 2003-08-04 05:15 9804 ----a-w- c:\windows\system\vdremote.dll
2009-05-25 04:47 . 2003-08-04 05:14 7244 ----a-w- c:\windows\system\vdsvrlnk.dll
2009-05-24 21:12 . 2009-05-24 21:12 -------- d-----w- c:\program files\CCleaner
2009-05-22 03:44 . 2009-05-24 21:10 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\NLauncher
2009-05-19 02:41 . 2009-05-19 16:17 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\MotionDSP
2009-05-19 02:39 . 2009-05-19 16:17 -------- d-----w- c:\documents and settings\All Users\Application Data\MotionDSP
2009-05-19 02:37 . 2009-05-19 02:37 -------- d-----w- c:\program files\Common Files\Borland Shared
2009-05-19 02:37 . 1999-01-20 09:01 210032 ----a-w- c:\windows\system32\DBCLIENT.DLL
2009-05-19 02:37 . 2005-01-10 21:42 361472 ----a-w- c:\windows\system32\wPDF200A.dll
2009-05-19 02:37 . 2009-05-25 19:59 -------- d-----w- c:\program files\CV Expert 3
2009-05-18 13:22 . 2009-05-04 02:08 312088 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
2009-05-14 12:44 . 2009-05-14 12:44 2051864 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-14 12:44 . 2009-05-04 02:08 2302232 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
2009-05-14 12:44 . 2009-05-04 02:08 3399960 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-05-14 12:44 . 2009-05-04 02:08 3288344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-05-14 12:44 . 2009-05-04 02:08 424472 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
2009-05-14 12:44 . 2009-05-04 02:08 1262880 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll
2009-05-14 12:44 . 2009-05-04 02:08 177432 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
2009-05-14 12:44 . 2009-05-04 02:08 486168 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
2009-05-12 23:21 . 2009-05-12 23:21 -------- d-----w- c:\program files\easetech
2009-05-07 05:24 . 2009-05-07 05:24 -------- d-----w- C:\ERDNT
2009-05-06 23:51 . 2008-07-31 14:41 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
2009-05-06 23:51 . 2008-07-31 14:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2009-05-06 23:51 . 2008-07-31 14:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2009-05-06 23:51 . 2008-07-12 12:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2009-05-06 23:51 . 2008-07-12 12:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2009-05-06 23:51 . 2008-07-12 12:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2009-05-04 21:31 . 2009-05-04 21:31 -------- d-sh--w- c:\documents and settings\HP_Administrator\IECompatCache
2009-05-04 21:31 . 2009-05-04 21:31 -------- d-sh--w- c:\documents and settings\HP_Administrator\PrivacIE
2009-05-04 21:28 . 2009-05-04 21:28 -------- d-sh--w- c:\documents and settings\HP_Administrator\IETldCache
2009-05-04 21:26 . 2009-05-04 21:26 -------- d-----w- c:\windows\ie8updates
2009-05-04 21:26 . 2009-02-28 04:55 105984 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-05-04 21:25 . 2009-05-04 21:25 -------- dc-h--w- c:\windows\ie8
2009-05-04 20:59 . 2009-05-04 20:59 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
2009-05-04 20:56 . 2009-05-04 21:56 -------- d-----w- c:\windows\ERUNT
2009-05-04 20:56 . 2009-05-04 21:07 -------- d-----w- C:\Backups
2009-05-04 02:07 . 2009-05-04 02:07 1083672 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe
2009-05-04 02:07 . 2009-05-04 02:07 755992 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
2009-05-04 02:07 . 2009-05-04 02:07 1437464 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-05-04 02:07 . 2009-05-03 03:09 587032 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgiproxy.exe
2009-05-04 02:05 . 2009-05-04 02:05 -------- d-----w- c:\windows\system32\wbem\Repository
2009-05-04 01:08 . 2009-05-04 01:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-03 03:31 . 2009-05-04 02:04 -------- d-sh--w- C:\RECYCLER(2)
2009-05-03 03:06 . 2009-05-03 03:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-01 21:32 . 2009-03-23 01:05 117760 ----a-w- c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-01 16:14 . 2009-04-21 17:32 -------- d-----w- c:\program files\DU Meter
2009-06-01 15:47 . 2008-07-02 11:51 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Azureus
2009-06-01 15:42 . 2008-10-24 20:14 -------- d-----w- c:\program files\Autorun
2009-05-30 18:28 . 2009-05-30 18:01 131 ----a-w- c:\program files\pec.ini
2009-05-29 03:18 . 2006-04-07 07:18 -------- d-----w- c:\program files\Google
2009-05-28 22:02 . 2008-11-19 01:58 -------- d-----w- c:\program files\WinTV
2009-05-28 22:02 . 2006-04-07 07:13 -------- d-----w- c:\program files\PC-Doctor 5 for Windows
2009-05-28 21:14 . 2008-07-01 22:10 -------- d-----w- c:\program files\Windows Media Connect 2
2009-05-28 20:53 . 2008-07-03 11:38 -------- d-----w- c:\documents and settings\All Users\Application Data\iolo
2009-05-27 22:15 . 2008-07-09 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-27 00:16 . 2009-01-07 17:03 -------- d-----w- c:\program files\VS Revo Group
2009-05-25 02:39 . 2008-07-02 14:41 -------- d-----w- c:\program files\Ultra Video Splitter
2009-05-24 21:15 . 2009-01-18 05:38 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-05-24 02:11 . 2009-01-22 09:25 -------- d-----w- c:\program files\Ashampoo
2009-05-22 04:26 . 2008-07-02 14:48 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Vso
2009-05-22 04:26 . 2008-07-02 14:48 47360 ----a-w- c:\documents and settings\HP_Administrator\Application Data\pcouffin.sys
2009-05-22 04:26 . 2008-07-02 14:48 47360 ----a-w- c:\documents and settings\HP_Administrator\Application Data\pcouffin.sys
2009-05-21 15:17 . 2008-10-21 05:31 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Orbit
2009-05-21 15:06 . 2008-08-29 02:55 -------- d-----w- c:\program files\Orbitdownloader
2009-05-19 02:41 . 2006-04-07 06:49 85688 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-15 14:26 . 2008-07-02 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Zultrax P2P
2009-05-15 00:02 . 2008-07-02 15:08 -------- d-----w- c:\program files\Windows Live
2009-05-13 04:05 . 2009-03-12 11:32 606096 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-13 01:42 . 2008-08-30 05:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-09 05:53 . 2008-08-08 03:11 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\dvdcss
2009-05-08 16:47 . 2009-03-04 20:56 -------- d-----w- c:\program files\ImpotExpert 2008
2009-05-04 21:35 . 2008-07-18 22:30 -------- d-----w- c:\program files\Windows Live Safety Center
2009-05-04 17:32 . 2009-02-28 15:34 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-04 02:08 . 2008-12-01 15:03 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-04 02:08 . 2008-12-01 15:03 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-04 02:08 . 2008-12-01 15:03 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-04 02:08 . 2008-12-01 15:03 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-05-04 02:08 . 2008-12-01 15:03 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-21 17:32 . 2009-04-21 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-04-19 18:17 . 2009-04-19 18:04 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll
2009-04-19 18:17 . 2009-04-19 18:04 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe
2009-04-19 18:17 . 2009-04-19 18:03 323584 ----a-w- c:\windows\system32\AUDIOGENIE2.DLL
2009-04-19 16:36 . 2006-04-07 06:24 -------- d-----w- c:\program files\Java
2009-04-19 16:35 . 2009-04-19 16:35 152576 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-18 16:21 . 2008-09-14 10:09 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\DVD Flick
2009-04-18 16:21 . 2009-01-23 07:21 -------- d-----w- c:\program files\DVD Flick
2009-04-15 17:57 . 2008-07-01 22:14 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\HP
2009-04-15 17:57 . 2006-04-07 06:41 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-04-15 01:07 . 2009-04-15 01:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Trymedia
2009-04-07 22:41 . 2009-04-07 22:41 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Emulators
2009-04-05 16:26 . 2008-08-08 11:57 -------- d-----w- c:\program files\Microsoft Silverlight
2009-04-03 17:48 . 2009-04-03 17:48 -------- d-----w- c:\program files\Xilisoft
2009-04-03 17:35 . 2009-03-28 04:33 -------- d-----w- c:\program files\WMR11
2009-03-24 04:29 . 2006-04-06 18:56 14336 ----a-w- c:\windows\system32\svchost.exe
2009-03-24 04:29 . 2006-04-06 18:56 14336 ----a-w- c:\windows\system32\svchost(2).exe
2009-03-24 03:12 . 2009-03-24 03:12 7168 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Thinstall\Fast AVI MPEG Joiner 1.2.0812\40000062700003i\avm.exe
2009-03-22 21:21 . 2009-03-22 21:21 4096 ----a-w- c:\windows\system32\drivers\nocashio.sys
2009-03-20 19:32 . 2009-03-20 19:32 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-03-19 14:08 . 2009-03-05 21:19 152576 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-03-18 14:54 . 2009-03-18 14:50 0 ----a-w- c:\program files\Common Files\chd.exe
2009-03-18 01:55 . 2009-03-16 21:23 1024 ----a-w- c:\documents and settings\All Users\Application Data\sowdp88.dat
2009-03-12 11:35 . 2009-01-07 15:50 164812 ----a-w- c:\windows\hpoins21.dat
2009-03-09 09:19 . 2008-11-28 19:30 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-03-08 08:34 . 2006-04-07 01:58 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2006-04-06 18:53 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2006-04-06 18:50 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2006-04-06 18:58 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2006-04-06 18:50 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2006-04-06 18:53 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2006-04-06 18:53 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2006-04-06 18:53 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2006-04-06 18:53 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2006-04-06 18:53 156160 ----a-w- c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2006-04-06 18:54 284160 ----a-w- c:\windows\system32\pdh.dll
2009-03-04 20:56 . 2009-03-04 20:56 10134 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{451BB54C-8B23-4455-8BDC-14FC7D43E056}\ARPPRODUCTICON.exe
2007-04-01 20:06 . 2008-07-01 23:04 22 --sha-w- c:\windows\SMINST\HPCD.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2008-06-10 2645528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-04 1947928]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-05-26 414480]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-03-08 16010240]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2008-11-18 106551]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 19:56 352256 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-04 02:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McrdSvc"=2 (0x2)
"ehRecvr"=2 (0x2)
"ehSched"=2 (0x2)
"Nero BackItUp Scheduler 3"=2 (0x2)
"navapsvc"=2 (0x2)
"idsvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Sorenson Media\\Sorenson Squeeze\\Squeeze.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Zultrax P2P\\Zultrax.Exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [01/12/2008 11:03 AM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [01/12/2008 11:03 AM 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [01/12/2008 11:03 AM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [04/12/2008 2:50 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [04/12/2008 2:50 PM 55024]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [08/01/2009 8:58 AM 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [08/01/2009 8:58 AM 298776]
R3 iComp;Hauppauge WinTV PVR2 USB2 Encoder;c:\windows\system32\drivers\HCWUSB2.sys [18/11/2008 10:09 PM 1458688]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28/05/2009 5:24 PM 19096]
S2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [01/06/2009 12:14 PM 1386008]
S2 gupdate1c9275bef2d4b40;Google Update Service (gupdate1c9275bef2d4b40);c:\program files\Google\Update\GoogleUpdate.exe [05/10/2008 10:33 PM 133104]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28/05/2009 5:24 PM 194832]
S2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [24/01/2009 10:56 PM 598856]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [27/04/2009 9:59 PM 410976]
S3 DrvFltIp;DrvFltIp;\??\c:\documents and settings\HP_Administrator\Local Settings\TEMP\DrvFltIp --> c:\documents and settings\HP_Administrator\Local Settings\TEMP\DrvFltIp [?]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe --> c:\program files\MAGIX\Common\Database\bin\fbserver.exe [?]
S3 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\WinTV\HCWTVS~1.EXE --> c:\progra~1\WinTV\HCWTVS~1.EXE [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\35.tmp --> c:\windows\system32\35.tmp [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [04/12/2008 2:50 PM 7408]

--- Other Services/Drivers In Memory ---

*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-01 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-10-06 02:33]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys

.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.ca/
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\8xoe2yxu.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Google\Google Gears\Firefox\components\gears.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-01 17:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DUMeterSvc]
"ImagePath"="c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\c:\documents and settings\HP_Administrator\Local Settings\TEMP\ASFWHide"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DrvFltIp]
"ImagePath"="\??\c:\documents and settings\HP_Administrator\Local Settings\TEMP\DrvFltIp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\35.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(504)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-01 17:53
ComboFix-quarantined-files.txt 2009-06-01 21:53

Pre-Run: 187,433,549,824 bytes free
Post-Run: 187,416,879,104 bytes free

305 --- E O F --- 2009-05-12 20:11

Combofix n'a pas resolu mon probleme.J'avais l'ancienne version celle ci n'a pas fais de tort.

slt

tu es redirigé sur quoi?

________________

malwarebyte et avg8 ne trouvent rien?

_________________

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix