Virus google

enleve google de t'est favori et recheche google france le site sur internet et tu peux le renettre en favori
evite de le maitre en page de demarage

Bonjour,
J'ai exactement le même problème : virus sur google qui dirige les liens vers d'autres pages que celles souhaitées.
Voici mon rapport.
Merci d'avance.

Logfile of HijackThis v1.99.1
Scan saved at 11:37:17, on 19/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program

Files\Freenet\bin\wrapper-windows-x86-32.exe
C:\Program Files\Fichiers communs\Microsoft

Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\java.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Virtual CD v4

SDK\system\vcssecs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Virtual CD v4

SDK\system\vcsplay.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\iNote\iNote.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers

communs\Real\Update_OB\realsched.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\Mindjet\MindManager

6\MMReminderService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Vidalia\vidalia.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Tracker Software\PDF-XChange

3\pdfSaver\pdfSaver3.exe
C:\Program

Files\Google\GoogleToolbarNotifier\1.2.908.5008\Goog

leToolbarNotifier.exe
C:\Program Files\Harrap's

Multimédia\Shorter\bin\HiHarrapsTray.exe
C:\Program Files\Privoxy\privoxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_08\bin\jucheck.exe
C:\Program Files\Tor\tor.exe
C:\Documents and Settings\Fr\Mes documents\PIM

C\EssentialPIM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

https://www.hautetfort.com/login.php
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page =

https://www.msn.com/fr-fr/?ocid=iehp
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Inter

net Settings,ProxyServer = 127.0.0.1:80
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Inter

net Settings,ProxyOverride = ;localhost
R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Altavista Toolbar -

{4E7BD74F-2B8D-469E-92EA-EC65A294AE31} -

C:\PROGRA~1\ALTAVI~1\ALTAVI~1.DLL
O2 - BHO: (no name) -

{53707962-6F74-2D53-2644-206D7942484F} - C:\Program

Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) -

{60DF4425-F36F-42D7-AECF-A409EBE4558C} -

C:\PROGRA~1\MICROA~1\INTERN~1\tbcghost.dll
O2 - BHO: SSVHelper Class -

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: ST -

{9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program

Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: CmjBrowserHelperObject Object -

{AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program

Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: MSNToolBandBHO -

{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

Files\MSN Apps\MSN Toolbar\MSN

Toolbar\01.02.5000.1021\fr-ch\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper -

{C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program

Files\PDFCreator

Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) -

{FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program

Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN -

{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

Files\MSN Apps\MSN Toolbar\MSN

Toolbar\01.02.5000.1021\fr-ch\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de

fenêtres pop-up -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program

Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: SimonTools -

{CC48EB38-F950-48C0-9F22-D64F829AE3DF} -

C:\PROGRA~1\MICROA~1\INTERN~1\tbcghost.dll
O3 - Toolbar: &Google -

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar -

{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program

Files\PDFCreator

Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Altavista Toolbar -

{4E7BD74F-2B8D-469E-92EA-EC65A294AE31} -

C:\PROGRA~1\ALTAVI~1\ALTAVI~1.DLL
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program

Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [TPP Auto Loader]

C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck]

C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [iNote] C:\Program

Files\iNote\iNote.exe
O4 - HKLM\..\Run: [EM_EXEC]

C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [drawsoftwarestupidplatform]

C:\Documents and Settings\All Users\Application

Data\Cake flaw draw software\soapwipe.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe

-autorun
O4 - HKLM\..\Run: [CleanEasyImg]

c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [ActivSurf]

C:\apps\ActivSurf\4448364\Program\backweb-4448364.ex

e
O4 - HKLM\..\Run: [ACTIVBOARD]

C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [itype] "C:\Program

Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program

Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Site joy media else] C:\Documents

and Settings\All Users\Application

Data\plancompsitejoy\ownsjugs.exe
O4 - HKLM\..\Run: [KernelFaultCheck]

%systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program

Files\Fichiers communs\Real\Update_OB\realsched.exe"

-osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [MMReminderService] C:\Program

Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program

Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service]

C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [Pense-Bête] C:\Program

Files\Pense-bete\pb79b.exe
O4 - HKCU\..\Run: [peak plan]

C:\DOCUME~1\Fr\APPLIC~1\SOAPCU~1\Acid flap.exe
O4 - HKCU\..\Run: [LDM] C:\Program

Files\Logitech\Desktop

Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program

Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Vidalia] "C:\Program

Files\Vidalia\vidalia.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program

Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program

Files\Tracker Software\PDF-XChange

3\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program

Files\Google\GoogleToolbarNotifier\1.2.908.5008\Goog

leToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program

Files\Adobe\Acrobat

7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9

-reboot 1
O4 - Global Startup: Ask Harrap's Shorter.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk

= C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk =

C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Privoxy.lnk = C:\Program

Files\Privoxy\privoxy.exe
O8 - Extra context menu item: Recherche AltaVista -

file://C:\Documents and Settings\Fr\Application

Data\ALTAVISTA\SelectedContextSearch_Recherche

AltaVista.htm
O8 - Extra context menu item: Save with Download

Manager... - file://C:\Program Files\J River\Media

Center 11\DMDownload.htm
O8 - Extra context menu item: Traduction -

file://C:\Documents and Settings\Fr\Application

Data\ALTAVISTA\SelectedContextTranslation.htm
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Packard Bell -

{1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} -

C:\Apps\IECustom\script.htm
O9 - Extra button: Send to Mindjet MindManager -

{531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program

Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: (no name) -

{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide -

{E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program

Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

%windir%\Network Diagnostic\xpnetdiag.exe (file

missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

%windir%\Network Diagnostic\xpnetdiag.exe (file

missing)
O9 - Extra button: Ghost Navigator -

{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program

Files\Ghost Navigator2_6_0\Ghost (file missing)
O9 - Extra 'Tools' menuitem: Ghost Navigator -

{ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program

Files\Ghost Navigator2_6_0\Ghost (file missing)
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF:

START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE}

(TDServer Control) -

http://fr.encyclopedia.yahoo.com/rsc/tdserver.cab
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545}

(FVLiteLoad Class) -

http://digitalflip.net/fvlite22/fvlite.cab
O16 - DPF: {BA83FD38-CE14-4DA3-BEF5-96050D55F78A} -

https://www.flipviewer.com/exe/fvgen1.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7}

(Photodex Presenter AX control) -

http://www.photodex.com/pxplay.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF}

(Live365Player Class) -

https://live365.com/
O23 - Service: avast! iAVS4 Control Service

(aswUpdSv) - Unknown owner - C:\Program Files\Alwil

Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner -

C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner -

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe"

/service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner -

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe"

/service (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd -

C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Freenet 0.7 darknet-8888

(freenet-darknet-8888) - Unknown owner - C:\Program

Files\Freenet\bin\wrapper-windows-x86-32.exe" -s

"C:\Program Files\Freenet\wrapper.conf (file

missing)
O23 - Service: InstallDriver Table Manager

(IDriverT) - Macrovision Corporation - C:\Program

Files\Fichiers

communs\InstallShield\Driver\1150\Intel

32\IDriverT.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown

owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc)

- NVIDIA Corporation -

C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner -

C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: SmartLinkService (SLService) - -

C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK -

Version) (VCSSecS) - H+H Software GmbH - C:\Program

Files\Virtual CD v4 SDK\system\vcssecs.exe

Salut ! :-)

Peux-tu remettre, juste pour vérifier, un nouveau log d'HijackThis ?
Merci. ;-)

salut

il semble que le problème soit résolut

merci bien ++

Bonsoir.

Relance HijackThis et coche les cases devant les lignes suivantes :

O2 - BHO: (no name) - {8AD0273E-B964-44AB-B07D-EDE2685524FD} - C:\WINDOWS\system32\acleditd.dll
O2 - BHO: (no name) - {A47DE63A-7FFB-065B-8B9D-00A2D8A569C7} - (no file)
O2 - BHO: (no name) - {E6E94D79-DDE3-FF4A-9E0F-ACC81E882AC4} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {EAE94D79-DDE3-8E4C-9E0C-DFC81D892AB1} - C:\WINDOWS\system32\upxe.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)

+ toutes les lignes 016
Puis clique sur [Fix Checked]

Supprime ces fichiers :
C:\WINDOWS\system32\upxe.dll
C:\WINDOWS\system32\acleditd.dll

A la fin de cette manipulation, remets un nouveau log HijackThis.
A++++

meme problème

voici mes log hj

--------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 23:29:09, on 20/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Sagem\WLAN Card Utilities\Center.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\Rcman.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\EAX.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\VRC.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Center\RCenter.exe
C:\Program Files\Creative\ShareDLL\MediaDet.exe
C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\OSDMenu.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8AD0273E-B964-44AB-B07D-EDE2685524FD} - C:\WINDOWS\system32\acleditd.dll
O2 - BHO: (no name) - {A47DE63A-7FFB-065B-8B9D-00A2D8A569C7} - (no file)
O2 - BHO: (no name) - {E6E94D79-DDE3-FF4A-9E0F-ACC81E882AC4} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {EAE94D79-DDE3-8E4C-9E0C-DFC81D892AB1} - C:\WINDOWS\system32\upxe.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Control Center] C:\Program Files\Sagem\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\SBExtigy\RemoteCenter\Rc\Rcman.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://ts.clariteam.com/msrdp.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {A5173EA8-1337-4BAB-A67E-198C9919D9CC} (Loader Class) - http://213.11.100.127/websetup/websetup2.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/2.0.0.33/player.virtools.com/downloads/player/Install2.0/Installer.exe
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: DirectX Service (DirectSefs) - Unknown owner - c:\windows\system32\directx.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

---------------------------------------

salut
fait ceci
HijackThis (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
section virus/logiciel de securite demo animée sur la meme page
tuto animée d instalation d hijackthis http://pageperso.aol.fr/balltrap34/Hijenr.gif
telecharge le et met le dans son propre dossier ex/c :hj

clik sur do a systeme scan et save a logfile
et copier coller le rapport
demo
http://pageperso.aol.fr/balltrap34/demohijack.htm

---------------------------