Problème de dialer Résolu

Question

voila, depuis quelque jour, dialer qui je suis sur est un virus, demare en mem temps que windows, il s'ouvre de temps en temps et affiche d'abord :
Il software di connessione-navigazione. QUESTO SOFTWARE E' ESENTE DA VIRUS AL 100%. Attenzione! procedendo accetti le condizioni di utilizzo del software e dichiari di aver compiuto 18 anni. Il costo del collegamento e' di un euro e novanta centesimi (euro 1.99) al minuto IVA INCLUSA piu' zero euro (euro 00.31) di scatto alla risposta, la durata della connessione e' di venti minuti (20 min) consecutivi. Se accetti clicca sul: SI. BUON DIVERTIMENTO !
puis se ferme et affiche ensuite :
Connessione impossibile !
Il programma serà terminato.

Après cela, il créer des fichier dans c:/windows/temp :
- ddl***.tmp.exe
-win***.tmp
*** = un code différent tout le temps

au finale, tout ses programmes troune et le PC ralenti et fini par planté !

je ne trouve pas le programme d'origine, norton non plus et Spyware Doctor ne supprime que les fichiers dans c:/windows/temp mais il revienne tout le temps !!!
quelqu'un a une idée ?
merci d'avance !

incognito02 · Answer

Bonsoir ,

Dans un premier temps, fait déja tout cela :

telecharge et execute ces antispywares ( pense a les mettre a jour avant de les lancer)

(1) ad-aware version 1.06

(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip

***

(2) spybot version 1.4

(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite

voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
***

et aussi ceci
(3) CleanUp40.exe
http://www.florensac-chasse-trap.com/ section virus/logiciel de securite

voir demo
http://pageperso.aol.fr/balltrap34/democleanup.htm

***

(4) a2

http://www.emsisoft.net/fr/
penser a le metre a jour avant de scanner le pc
***
ps : un grand merci a balltrap pour les lien :)

(5) Edwido
http://download.ewido.net/ewido-setup.exe
Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour.

Clique sur scanner puis sur scan complet du système.

(6) télécharge HijackThis ici:
http://www.hijackthis.de/downloads/hijackthis_199.zip

Dézippe le dans un dossier prévu à cet effet.
Par exemple C:\hijackthis < Enregistre le bien dans c : !
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/Hijenr.gif

Lance le puis:
clique sur "do a system scan and save logfile" (cf démo)
faire un copier coller du log entier sur le forum

Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm

Bon courage

A+

bg68890 · Answer

Voilà ce que me dit HijackThis :Logfile of HijackThis v1.99.1Scan saved at 10:03:57, on 25/02/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\FTRTSVC.exeC:\Program Files\Alias\Maya7.0\docs\wrapper.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Spyware Doctor\sdhelp.exeC:\Program Files\Alias\Maya7.0\docs\jre\bin\java.exeC:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exeC:\WINDOWS\system32\wdfmgr.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\RTHDCPL.EXEC:\Program Files\Gigabyte\ET5\GUI.exeC:\Program Files\CyberLink\PowerDVD\PDVDServ.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXEC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Winamp\Winampa.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXEC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\Wanadoo\TaskBarIcon.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exeC:\PROGRA~1\MESSEN~1\Msmsgs.exeC:\Program Files\Netscape\Netscape\Netscp.exeC:\DOCUME~1\Benoit\MESDOC~1\YSTEM~1\cmd.exeC:\WINDOWS\system32\?ppPatch?gedit.exeC:\WINDOWS\TEMP\ddl36C.tmp.exeC:\WINDOWS\TEMP\ddl3A4.tmp.exeC:\WINDOWS\TEMP\ddl3B7.tmp.exeC:\WINDOWS\TEMP\ddl3C2.tmp.exeC:\WINDOWS\TEMP\ddl3CD.tmp.exeC:\WINDOWS\TEMP\ddl3D8.tmp.exeC:\WINDOWS\TEMP\ddl3E3.tmp.exeC:\WINDOWS\TEMP\ddl3EE.tmp.exeC:\WINDOWS\TEMP\ddl3F9.tmp.exeC:\WINDOWS\TEMP\ddl404.tmp.exeC:\WINDOWS\TEMP\ddl40F.tmp.exeC:\WINDOWS\TEMP\ddl41A.tmp.exeC:\WINDOWS\TEMP\ddl425.tmp.exeC:\WINDOWS\TEMP\ddl430.tmp.exeC:\WINDOWS\TEMP\ddl43B.tmp.exeC:\WINDOWS\TEMP\ddl446.tmp.exeC:\WINDOWS\TEMP\ddl451.tmp.exeC:\WINDOWS\TEMP\ddl45C.tmp.exeC:\WINDOWS\TEMP\ddl467.tmp.exeC:\WINDOWS\TEMP\ddl472.tmp.exeC:\WINDOWS\TEMP\ddl47D.tmp.exeC:\WINDOWS\TEMP\ddl488.tmp.exeC:\WINDOWS\TEMP\ddl493.tmp.exeC:\WINDOWS\TEMP\ddl49E.tmp.exeC:\WINDOWS\TEMP\ddl4A9.tmp.exeC:\WINDOWS\TEMP\ddl4B4.tmp.exeC:\WINDOWS\TEMP\ddl4BF.tmp.exeC:\WINDOWS\TEMP\ddl4CA.tmp.exeC:\WINDOWS\TEMP\ddl4D5.tmp.exeC:\WINDOWS\TEMP\ddl4E0.tmp.exeC:\WINDOWS\TEMP\ddl4EB.tmp.exeC:\WINDOWS\TEMP\ddl4F6.tmp.exeC:\WINDOWS\TEMP\ddl501.tmp.exeC:\WINDOWS\TEMP\ddl50C.tmp.exeC:\WINDOWS\TEMP\ddl517.tmp.exeC:\WINDOWS\TEMP\ddl685.tmp.exeC:\WINDOWS\TEMP\ddl692.tmp.exeC:\WINDOWS\TEMP\ddl6AF.tmp.exeC:\WINDOWS\TEMP\ddl6C0.tmp.exeC:\WINDOWS\TEMP\ddl7D6.tmp.exeC:\WINDOWS\TEMP\ddl7E1.tmp.exeC:\WINDOWS\TEMP\ddl7EC.tmp.exeC:\WINDOWS\TEMP\ddl7F7.tmp.exeC:\WINDOWS\TEMP\ddl805.tmp.exeC:\WINDOWS\TEMP\ddl810.tmp.exeC:\WINDOWS\TEMP\ddl81B.tmp.exeC:\WINDOWS\TEMP\ddl826.tmp.exeC:\WINDOWS\TEMP\ddl831.tmp.exeC:\WINDOWS\TEMP\ddl83C.tmp.exeC:\WINDOWS\TEMP\ddl847.tmp.exeC:\WINDOWS\TEMP\ddl857.tmp.exeC:\WINDOWS\TEMP\ddl862.tmp.exeC:\WINDOWS\TEMP\ddl86D.tmp.exeC:\WINDOWS\TEMP\ddl878.tmp.exeC:\WINDOWS\TEMP\ddl883.tmp.exeC:\WINDOWS\TEMP\ddl88E.tmp.exeC:\WINDOWS\TEMP\ddl89C.tmp.exeC:\WINDOWS\TEMP\ddl8A7.tmp.exeC:\WINDOWS\TEMP\ddl8B2.tmp.exeC:\WINDOWS\TEMP\ddl8BD.tmp.exeC:\WINDOWS\TEMP\ddl8C8.tmp.exeC:\WINDOWS\TEMP\ddl8D8.tmp.exeC:\WINDOWS\TEMP\ddl8E3.tmp.exeC:\WINDOWS\TEMP\ddl8EE.tmp.exeC:\WINDOWS\TEMP\ddl8F9.tmp.exeC:\WINDOWS\TEMP\ddl904.tmp.exeC:\WINDOWS\TEMP\ddl909.tmp.exeC:\WINDOWS\TEMP\ddl932.tmp.exeC:\WINDOWS\TEMP\ddl93E.tmp.exeC:\Program Files\Fichiers communs\Ahead\lib\NMIndexStoreSvr.exeC:\WINDOWS\TEMP\ddl968.tmp.exeC:\WINDOWS\TEMP\ddl971.tmp.exeC:\Program Files\Fichiers communs\Ahead\lib\NMIndexStoreSvr.exeC:\WINDOWS\TEMP\ddlB04.tmp.exeC:\WINDOWS\TEMP\ddlD2F.tmp.exeC:\WINDOWS\TEMP\ddlD35.tmp.exeC:\WINDOWS\TEMP\ddlD3A.tmp.exeC:\WINDOWS\TEMP\ddlD40.tmp.exeC:\WINDOWS\TEMP\ddlD45.tmp.exeC:\WINDOWS\TEMP\ddlD4B.tmp.exeC:\WINDOWS\TEMP\ddlD50.tmp.exeC:\WINDOWS\TEMP\ddlD56.tmp.exeC:\WINDOWS\TEMP\ddlD5B.tmp.exeC:\WINDOWS\TEMP\ddlD61.tmp.exeC:\WINDOWS\TEMP\ddlD66.tmp.exeC:\WINDOWS\TEMP\ddlD6C.tmp.exeC:\WINDOWS\TEMP\ddlD71.tmp.exeC:\WINDOWS\TEMP\ddlD77.tmp.exeC:\WINDOWS\TEMP\ddlD7C.tmp.exeC:\WINDOWS\TEMP\ddlD82.tmp.exeC:\WINDOWS\TEMP\ddlD87.tmp.exeC:\WINDOWS\TEMP\ddlD8D.tmp.exeC:\WINDOWS\TEMP\ddlD92.tmp.exeC:\WINDOWS\TEMP\ddlD98.tmp.exeC:\WINDOWS\TEMP\ddlD9D.tmp.exeC:\WINDOWS\TEMP\ddlDA3.tmp.exeC:\WINDOWS\TEMP\ddlDA8.tmp.exeC:\WINDOWS\TEMP\ddlDAE.tmp.exeC:\WINDOWS\TEMP\ddlDC0.tmp.exeC:\WINDOWS\TEMP\ddlDC8.tmp.exeC:\WINDOWS\TEMP\ddlDCD.tmp.exeC:\WINDOWS\TEMP\ddlDD3.tmp.exeC:\WINDOWS\TEMP\ddlDDF.tmp.exeC:\WINDOWS\TEMP\ddlDE4.tmp.exeC:\WINDOWS\TEMP\ddlDEA.tmp.exeC:\WINDOWS\TEMP\ddlDEF.tmp.exeC:\WINDOWS\TEMP\ddlDF5.tmp.exeC:\WINDOWS\TEMP\ddlDFA.tmp.exeC:\WINDOWS\TEMP\ddlE00.tmp.exeC:\WINDOWS\TEMP\ddlE05.tmp.exeC:\WINDOWS\TEMP\ddlE0B.tmp.exeC:\WINDOWS\TEMP\ddlE10.tmp.exeC:\WINDOWS\TEMP\ddlE16.tmp.exeC:\WINDOWS\TEMP\ddlE1B.tmp.exeC:\WINDOWS\TEMP\ddlE21.tmp.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINDOWS\System32\svchost.exeC:\PROGRA~1\Wanadoo\EspaceWanadoo.exeC:\PROGRA~1\Wanadoo\ComComp.exeC:\PROGRA~1\Wanadoo\Toaster.exeC:\PROGRA~1\Wanadoo\Inactivity.exeC:\PROGRA~1\Wanadoo\PollingModule.exeC:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXEC:\PROGRA~1\Wanadoo\Watch.exeC:\WINDOWS\System32\wbem\wmiapsrv.exeC:\WINDOWS\TEMP\win14B3.tmp.exeC:\WINDOWS\TEMP\win14B9.tmp.exeC:\WINDOWS\TEMP\win14B3.tmp.exeC:\WINDOWS\TEMP\win14B9.tmp.exeC:\WINDOWS\TEMP\win14B3.tmp.exeC:\Program Files\WinRAR\WinRAR.exeC:\DOCUME~1\Benoit\LOCALS~1\Temp\Rar$EX00.016\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLR3 - URLSearchHook: ScriptInocUI Class -  - (no file)R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLLR3 - URLSearchHook: (no name) - {B8FD0A6A-9AFB-D55E-F7AA-E4CB5B945CB3} - C:\WINDOWS\system32
cpfwz.dll (file missing)N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.netscape.fr"); (C:\Documents and Settings\Benoit\Application Data\Mozilla\Profiles\default\jeol1is8.slt\prefs.js)N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CNetscape_France.src"); (C:\Documents and Settings\Benoit\Application Data\Mozilla\Profiles\default\jeol1is8.slt\prefs.js)O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLLO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1	ools\iesdsg.dllO2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO2 - BHO: (no name) - {B8FD0A6A-9AFB-D55E-F7AA-E4CB5B945CB3} - C:\WINDOWS\system32
cpfwz.dll (file missing)O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dllO3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dllO3 - Toolbar: (no name) - {A20A76AD-7A29-4756-87FE-70C334CB40C0} - (no file)O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLLO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exeO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exeO4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exeO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"O4 - HKLM\..\Run: [Auto EPSON Stylus Photo RX420 Series sur KIRIKIKI] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P49 "Auto EPSON Stylus Photo RX420 Series sur KIRIKIKI" /O21 "\KIRIKIKI\Imprimante" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [EasyPHP] "C:\Program Files\EasyPHP1-8\EasyPHP.exe"O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\Msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turboO4 - HKCU\..\Run: [Aauu] "C:\DOCUME~1\Benoit\MESDOC~1\YSTEM~1\cmd.exe" -vt mtO4 - HKCU\..\Run: [Ccjspo] C:\WINDOWS\system32\?ppPatch?gedit.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZSYYYYYYYYFRO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exeO9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exeO9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exeO9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O15 - Trusted Zone: *.offshoreclicks.comO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cabO16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} (ICQVideoControl Class) - http://xtraz.icq.com/xtraz/activex/ICQVideoControl.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO20 - Winlogon Notify: winkve32 - C:\WINDOWS\SYSTEM32\winkve32.dllO20 - Winlogon Notify: winopn32 - C:\WINDOWS\SYSTEM32\winopn32.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Flash Media Server (FMS) (FMS) - Macromedia, Inc. - C:\Program Files\Macromedia\Flash Media Server 2\FMSMaster.exeO23 - Service: Flash Media Administration Server (FMSAdmin) - Macromedia, Inc. - C:\Program Files\Macromedia\Flash Media Server 2\FMSAdmin.exeO23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: Maya 7.0 Documentation Server (maya70docserver) - Unknown owner - C:\Program Files\Alias\Maya7.0\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya7.0\docs\Wrapper.conf (file missing)O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

incognito02 · Answer

Bonjour,Avant de m'envoyer le log hijackthis, il faudrait faire ce que je t'ai demandé dans l'ordre sinon cela va être dur dur de nettoyer ton ordi.Bon courage.A++

bg68890 · Answer

j'ai tout fait dans l'ordre, il semble que cela est marché, les fichiers dans temp ont disparu et le programme ne ce lance plus ! merci beaucoup !

je reste sur mes gardes, si il y a un problème je vous préviens !!!

encore merci !!!

incognito02 · Answer

Bonjour,Peux tu remettre un log hijackthis afin que je vérifie si tout est ok.A+

vinc · Answer

j'ai egalement le même probleme.Si quelqu'un peut m'aider, je le remercie fortement.Logfile of HijackThis v1.99.1Scan saved at 09:12:11, on 13/04/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exeC:\Program Files\Juniper\NetScreen-Remote\IreIKE.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\basfipm.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exeC:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exeC:\Program Files\PRTG Traffic Grapher\PRTG Traffic Grapher.exeC:\Program Files\PRTG Traffic Grapher\PRTG Traffic Grapher.exeC:\Program Files\VMware\VMware Workstation\vmware-authd.exeC:\WINDOWS\system32\vmnat.exeC:\WINDOWS\system32\MsPMSPSv.exeC:\WINDOWS\system32\vmnetdhcp.exeC:\OfficeScan NT	mlisten.exeC:\OfficeScan NT
trtscan.exeC:\OfficeScan NT\OfcPfwSvc.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Apoint\Apoint.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\OfficeScan NT\pccntmon.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxsrvc.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Apoint\HidFind.exeC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeC:\Program Files\Apoint\Apntex.exeC:\Program Files\yz dock\YzDock.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Mozilla Thunderbird	hunderbird.exeC:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exeC:\Program Files\E-nrgyPlus\E-nrgyPlus.exeC:\Documents and Settings\vfrouard\Mes documents\Mes fichiers reçus\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.interdata.fr/O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindowO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"O4 - HKLM\..\Run: [E-nrgyPlus] C:\Program Files\E-nrgyPlus\E-nrgyPlus.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - Startup: Raccourci vers YzDock.exe.lnk = C:\Program Files\yz dock\YzDock.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_02\bin
pjava131_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_02\bin
pjava131_02.dllO16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://intranet/officescan/console/ClientInstall/WinNTChk.cabO16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupINICtrl Class) - http://intranet/officescan/console/ClientInstall/setupini.cabO16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://intranet/officescan/console/ClientInstall/setup.cabO16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - http://intranet/officescan/console/html/AtxEnc.cabO16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://intranet/officescan/console/ClientInstall/RemoveCtrl.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dllO23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exeO23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exeO23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exeO23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT
trtscan.exeO23 - Service: Pare-feu OfficeScanNT (OfcPfwSvc) - Trend Micro Inc. - C:\OfficeScan NT\OfcPfwSvc.exeO23 - Service: PRTG Service - Paessler Router Traffic Grapher (PRTGService) - Paessler AG - C:\Program Files\PRTG Traffic Grapher\PRTG Traffic Grapher.exeO23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\OfficeScan NT	mlisten.exeO23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exeO23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exeO23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

incognito02 · Answer

Bonjour Vinc,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt

Problème de dialer

7 réponses

Discussions similaires

Newsletters