Ordi infecté => critical system error!

Résolu
moma3 -  
bonjour à tous, depuis hier j'ai un petit probleme, en fait dans la barre des taches il y a une petite croix jaune dans un cercle bleu et un point d'interrogation jaune qui clignottent. toutes les minutes, une bulle apparait avec un texte écrit en anglais me disant que mon ordi est infecté et qu'il faut que je le scann sinon il risque d'y avoir des problemes, c'est ce que j'ai fais, déja avec des antispyware (spybot, l'antispyware de secuitoo) et avec mon antivirus mais ça n'a pas résolu mon probleme.Donc je sais pas trop si c'est un spyware ou un virus mais pouvez-vous m'aider s'il-vous-plaît ???
merci d'avance

19 réponses

  1. zakTS
    j'ai pas voulu resoudre un problem , j'ai voulu dire pourkoi vous consillez les autres d'utiliser des antivirus ? si vous ne pouvez resoudre ces problemes avec vos connaissances,
    0
    1. zakTS
      salut
      pas compri, mais je pense que vous avez comprenez mon message marie
      0
      1. ^^Marie^^
        Re

        Regarde la date du posteur initial
        A+
        0
    2. zakTS
      salut,

      je suis zak, je veux savoir pourkoi vous pensez que vous resoudre des problems quand vous conseillez les autres de utiliser les antivirus , c'est de la publicité pour ces antivirus,
      vous avez des infections?
      votre registre est infecté?
      le plus grave par exemple!!! alors vous devez utiliser vos connaissance pour eliminer ces virus, parce que si le antiviur est vraiment capable de eliminer un virus pourkoi il l'as laisser de penetrer votre ordinateur?

      je vous conseille de installer les consoles de recuperation et creer des disquettees de reparation d'urgence, de sauvagarder l'etat de systeme,,,,,, se sont des solutions tres efficaces pour eliminer les fichiers endomages et les malwares...merci
      0
      1. ^^Marie^^
        Salut zakTS
        Je pense que depuis Octobre 2006, l'affaire est classée

        Merci quand mm

        A°
        0
    5. moma3 Auteur
      bonjour !
      Bah aparament il n'y a plus rien, donc je vais refaire un scan avec bitdefender et s'il y a des problemes, je te dirais !
      Voila, a+ et merci encore
      0
      1. green day Modérateur
        youval : merci de créer ton propre poste !
        0
        1. youval
          voila jsui pas trs fort en informatik si qq1 pouvait m aider silvouplait

          Logfile of HijackThis v1.99.1
          Scan saved at 21:34:19, on 21/10/2006
          Platform: Windows XP SP1 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
          C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
          C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
          C:\WINDOWS\System32\nvsvc32.exe
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\VideoCompressionCodec\pmsngr.exe
          C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
          C:\WINDOWS\System32\ctfmon.exe
          C:\Program Files\Microsoft ActiveSync\wcescomm.exe
          E:\eMule\emule.exe
          C:\PROGRA~1\MICROS~2\rapimgr.exe
          C:\Program Files\MSN Messenger\msnmsgr.exe
          C:\Program Files\Fichiers communs\Symantec Shared\Nmain.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          D:\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr/
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
          O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
          O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
          O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [QuickTime Task] "D:\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
          O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
          O4 - HKCU\..\Run: [eMuleAutoStart] E:\eMule\emule.exe -AutoStart
          O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
          O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
          O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
          O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
          O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
          O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
          O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
          O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
          O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
          O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
          O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
          O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
          O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll
          O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
          O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
          O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
          O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
          O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
          O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
          O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
          0
          1. youval
            voila jsui pas trs fort en informatik si qq1 pouvait m aider silvouplait

            Logfile of HijackThis v1.99.1
            Scan saved at 21:34:19, on 21/10/2006
            Platform: Windows XP SP1 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
            C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
            C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
            C:\WINDOWS\System32\nvsvc32.exe
            C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
            C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\VideoCompressionCodec\pmsngr.exe
            C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
            C:\WINDOWS\System32\ctfmon.exe
            C:\Program Files\Microsoft ActiveSync\wcescomm.exe
            E:\eMule\emule.exe
            C:\PROGRA~1\MICROS~2\rapimgr.exe
            C:\Program Files\MSN Messenger\msnmsgr.exe
            C:\Program Files\Fichiers communs\Symantec Shared\Nmain.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            D:\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
            O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
            O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
            O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
            O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [QuickTime Task] "D:\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
            O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
            O4 - HKCU\..\Run: [eMuleAutoStart] E:\eMule\emule.exe -AutoStart
            O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
            O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
            O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
            O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
            O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
            O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
            O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
            O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
            O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
            O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
            O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
            O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
            O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
            O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab
            O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
            O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
            O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll
            O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
            O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
            O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
            O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
            O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
            O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
            O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
            O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
            O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
            0
            1. green day Modérateur
              ok, tu n'as pas fais le scan pour rien lol

              Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
              O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

              O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
              O8 - Extra context menu item: Save Flash by &GetFlash - C:\PROGRA~1\GetFlash\getflash.htm

              repasse un coup de cleaunup et ccleaner

              où en sont tes soucis ???

              ++
              **La volonté trouve, la liberté choisit. Trouver et choisir, c'est penser ( V.Hugo) **
              0
              1. moma3 Auteur
                bitdefender m'a trouvé ça:

                C:\Documents and Settings\Christian_2\Application Data\winantiviruspro2006freeinstall_fr[1].exe
                Infected with: Trojan.Downloader.Winfixer.O

                C:\Documents and Settings\Christian_2\Application Data\winantiviruspro2006freeinstall_fr[1].exe
                Disinfection failed

                C:\Documents and Settings\Christian_2\Application Data\winantiviruspro2006freeinstall_fr[1].exe
                Deleted

                C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\backups\backup-20061020-193448-469.dll
                Infected with: Trojan.Downloader.Wintrim.DA

                C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\backups\backup-20061020-193448-469.dll
                Disinfection failed

                C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\backups\backup-20061020-193448-469.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171996.dll
                Infected with: Trojan.Downloader.Zlob.AQK

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171996.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171996.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171998.exe
                Infected with: Trojan.Downloader.Zlob.ABO

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171998.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0171998.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe=>(NSIS o)
                Infected with: Trojan.Downloader.Zlob.ABT

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe=>(NSIS o)
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe=>(NSIS o)
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172003.exe
                Update failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172013.dll
                Infected with: Trojan.Downloader.Zlob.AQK

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172013.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172013.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172015.exe
                Infected with: Trojan.Downloader.Zlob.ABO

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172015.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172015.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172037.dll
                Infected with: Trojan.Downloader.Zlob.AQK

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172037.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172037.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172038.exe
                Infected with: Trojan.Downloader.Zlob.ABO

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172038.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172038.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172142.dll
                Infected with: Trojan.Downloader.Zlob.AQK

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172142.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172142.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172143.exe
                Infected with: Trojan.Downloader.Zlob.ABO

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172143.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172143.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172157.dll
                Infected with: Trojan.Downloader.Zlob.AQK

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172157.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172157.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172158.exe
                Infected with: Trojan.Downloader.Zlob.ABO

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172158.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172158.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172200.dll
                Infected with: Trojan.FakeAlert.DJ

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172200.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172200.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172202.exe
                Infected with: Trojan.Downloader.Zlob.ACG

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172202.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172202.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172203.dll
                Infected with: Trojan.Downloader.Zlob.AQK

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172203.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172203.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172204.exe
                Infected with: Trojan.Downloader.Zlob.ABO

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172204.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172204.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172205.exe
                Infected with: Trojan.Downloader.Zlob.AQK

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172205.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172205.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172206.exe
                Infected with: Trojan.Downloader.Zlob.ACD

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172206.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0172206.exe
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0173222.dll
                Infected with: Trojan.Downloader.Wintrim.DA

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0173222.dll
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP476\A0173222.dll
                Deleted

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP478\A0173807.exe
                Infected with: Trojan.Downloader.Winfixer.O

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP478\A0173807.exe
                Disinfection failed

                C:\System Volume Information\_restore{6D4E05EB-3AF1-4205-8BE6-CBE5B521BF94}\RP478\A0173807.exe
                Deleted

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msi.dll
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msiexec.exe
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msihnd.dll
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msimsg.dll
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\msisip.dll
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\spmsg.dll
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\spuninst.exe
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\eula.txt
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\kb893803v2_net.cat
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\kb893803v2_w2k.cat
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\kb893803v2_wxp.cat
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\spcustom.dll
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update.exe
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update.ver
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\updatebr.inf
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update_w2k3.inf
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update_win2k.inf
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update_wxp.inf
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\updspapi.dll
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\_downloadprogress_.state
                Clean

                C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\_unpacked_.state
                Clean

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/1.htm
                Infected with: Exploit.ADODBStream.G

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/1.htm
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/1.htm
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/on-line.exe
                Infected with: Trojan.Small.BB

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/on-line.exe
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm=>/on-line.exe
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[1].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/1.htm
                Infected with: Exploit.ADODBStream.G

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/1.htm
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/1.htm
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/on-line.exe
                Infected with: Trojan.Small.BB

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/on-line.exe
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm=>/on-line.exe
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[2].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/1.htm
                Infected with: Exploit.ADODBStream.G

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/1.htm
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/1.htm
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/on-line.exe
                Infected with: Trojan.Small.BB

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/on-line.exe
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm=>/on-line.exe
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[3].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/1.htm
                Infected with: Exploit.ADODBStream.G

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/1.htm
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/1.htm
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/on-line.exe
                Infected with: Trojan.Small.BB

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/on-line.exe
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm=>/on-line.exe
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\hardmansp[4].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/x.htm
                Infected with: Trojan.Exploit.Html.Codebaseexec.AR

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/x.htm
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/x.htm
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/load.exe
                Infected with: Trojan.Downloader.Harnig.NAC

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/load.exe
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm=>/load.exe
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[1].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/x.htm
                Infected with: Trojan.Exploit.Html.Codebaseexec.AR

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/x.htm
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/x.htm
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm
                Update failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/load.exe
                Infected with: Trojan.Downloader.Harnig.NAC

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/load.exe
                Disinfection failed

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm=>/load.exe
                Deleted

                D:\sav cosnier\Documents and Settings\Christian\Local Settings\Temporary Internet Files\Content.IE5\PPQPAU2O\x[2].0hm
                Update failed

                D:\sav cosnier\ied_s7m.0ab
                Infected with: Trojan.Downloader.Mediket.D

                D:\sav cosnier\ied_s7m.0ab
                Deleted

                et voila le rapport d'hijackthis:

                Logfile of HijackThis v1.99.1
                Scan saved at 17:03:47, on 21/10/2006
                Platform: Windows XP SP1 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\System32\Ati2evxx.exe
                C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
                C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
                C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
                C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
                C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
                C:\WINDOWS\System32\LckFldService.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
                C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
                C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
                C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
                C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
                C:\Program Files\iPod\bin\iPodService.exe
                C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                C:\PROGRA~1\MESSAG~1\StartMessager.exe
                C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                C:\WINDOWS\System32\wuauclt.exe
                C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
                C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                C:\Program Files\QuickTime Alternative\qttask.exe
                C:\Program Files\iTunes\iTunesHelper.exe
                C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
                C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
                C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exe
                C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                C:\PROGRA~1\Wanadoo\ComComp.exe
                C:\PROGRA~1\Wanadoo\Toaster.exe
                C:\PROGRA~1\Wanadoo\Inactivity.exe
                C:\PROGRA~1\Wanadoo\PollingModule.exe
                C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
                C:\PROGRA~1\Wanadoo\Watch.exe
                C:\WINDOWS\System32\ctfmon.exe
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Program Files\MSN Messenger\msnmsgr.exe
                C:\Documents and Settings\Christian_2\Mes documents\logiciels\hijackthis\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
                O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\fsaswreg.exe"
                O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
                O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
                O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
                O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                O8 - Extra context menu item: Save Flash by &GetFlash - C:\PROGRA~1\GetFlash\getflash.htm
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                O17 - HKLM\System\CCS\Services\Tcpip\..\{DF525BD0-4B2F-4D8E-8B39-247E5B4C54D1}: NameServer = 80.10.246.130 80.10.246.3
                O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
                O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
                O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)
                O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
                O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
                O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
                O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe
                O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
                0
                1. green day Modérateur
                  re

                  c'est pas forcement à cause de cec service, je dirai que c'est un tout !

                  de plus tu avais une belle ptite infection !

                  ++
                  0
                  1. moma3 Auteur
                    ok je vais refaire ça, mais qu'est-ce que c'est :
                    France Telecom Routing Table Service ??
                    parce que depuis que je l'ai désactivé, ça bug beaucoup moins quand je me connecte, ça venait de ça ?
                    0
                    1. green day Modérateur
                      re

                      8h ???

                      lol non, pas autant, environ 3/4 heure, 1h tout au plus ...

                      je te conseil vivement de de le faire !!! il est très bien !

                      et ensuite de reposter un nouveau hijackthis pour verifier ...

                      je t'invite aussi à lire ceci pour eviter dans le futur ce genre de problème :

                      https://sebsauvage.net/safehex.html

                      securite proteger un ordinateur contre les malwares d internet

                      ++
                      0
                      1. moma3 Auteur
                        Voila c'est fait, j'ai fais tous les scans sauf bitdefender qui allait durer 8h00 !! mais sinon, il n'y a plus de problemes, je n'ai plus cette icone dans la barre des taches, donc tout va bien je te remercie de m'avoir aidé !
                        Donc bonne soirée et encore merci !
                        0
                        1. green day Modérateur
                          re

                          Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

                          O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\VideoCompressionCodec\isaddon.dll (file missing)

                          O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll (file missing)

                          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                          O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                          O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                          O4 - Global Startup: Image Transfer.lnk = ?
                          O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

                          ( toutes les 016 )
                          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                          O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab34120.cab
                          O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
                          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                          O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab32846.cab
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
                          O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/081e35c02e2a11fe0e19/netzip/RdxIE601_fr.cab
                          O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab32846.cab
                          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                          O16 - DPF: {71DA2A4E-ACB3-4065-9E41-8BC42EABE427} - http://scripts.dlv4.com/binaries/IA/svcia32_FR_XP.cab
                          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - a840.g.akamai.net
                          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                          O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
                          O16 - DPF: {A13516A3-BE86-4517-813C-B5FF0C8ACDF3} (Toontown Installer ActiveX Control French) - http://idownload.french.toontown.com/sv1.5.8.16/ttinst-french.cab
                          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFramework/v10/ZIntro.cab34246.cab
                          O16 - DPF: {BCF9A64D-1440-4404-863C-F5DF2B99F798} (Catan Online Game) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/zpagames/zpa_catan.cab35906.cab
                          O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
                          O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab35645.cab
                          O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
                          O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                          O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

                          O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll (file missing)

                          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

                          ==> Cliques sur :

                          demarrer < executer < tapes " services.msc"

                          cherches dans la liste cette ligne et regles la sur "desactivé"

                          France Telecom Routing Table Service

                          # ensuite :

                          cherche et supprime le dossier en gras :

                          C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe

                          => va dans ajout/supprimer un programme ( panneau de configuration ), et vire le programme su même nom

                          # télécharge ceci et execute les :

                          CleanUp40 (qui élimine les fichiers temporaires + cookies : gratuit )
                          http://pageperso.aol.fr/Balltrap34/CleanUp40.exe

                          tuto : (merci à Balltrap) http://pageperso.aol.fr/balltrap34/democleanup.htm

                          mets tout à jour,lance les scans en mode sans echec : pour cela redemarre en appuillant sur le touche F8 ou F5

                          # Ccleaner : Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs .

                          *Relance Ccleaner ,vas dans l'onglet "nettoyeur" present sur la gauche, decoche la derniere case (Avancé si elle
                          est cochée) puis clique sur "lancer le nettoyage"

                          ccleaner

                          tuto: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

                          # et enfin :

                          scan en ligne : colle rapport entier ( s’il y a quelque chose) :

                          http://www.bitdefender.fr/bd/site/search.php#

                          ++

                          **La volonté trouve, la liberté choisit. Trouver et choisir, c'est penser ( V.Hugo) **
                          0
                          1. moma3 Auteur
                            rapport de smitfraud:

                            SmitFraudFix v2.112

                            Rapport fait à 18:50:25,14, 20/10/2006
                            Executé à partir de C:\Documents and Settings\Christian_2\Mes documents\logiciels\SmitfraudFix
                            OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                            Fix executé en mode sans echec

                            »»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            SrchSTS.exe by S!Ri
                            Search SharedTaskScheduler's .dll

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                            "{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="contrabandists"

                            [HKEY_CLASSES_ROOT\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
                            @="C:\WINDOWS\System32\dpfwu.dll"

                            [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dfa61db1-388e-4c87-8d56-540fa229bcb4}\InProcServer32]
                            @="C:\WINDOWS\System32\dpfwu.dll"

                            »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                            »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                            GenericRenosFix by S!Ri

                            C:\WINDOWS\System32\dpfwu.dll -> Hoax.Win32.Renos.gen.d
                            C:\WINDOWS\System32\dpfwu.dll -> Deleted

                            »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                            C:\WINDOWS\system32\1024\ supprimé
                            C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url supprimé
                            C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url supprimé
                            C:\Program Files\VideoCompressionCodec\ supprimé
                            C:\Program Files\VirusBurster\ supprimé

                            »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

                            »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                            Nettoyage terminé.

                            »»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            SrchSTS.exe by S!Ri
                            Search SharedTaskScheduler's .dll

                            »»»»»»»»»»»»»»»»»»»»»»»» Fin

                            rapport d'hijackthis:

                            Logfile of HijackThis v1.99.1
                            Scan saved at 19:03:39, on 20/10/2006
                            Platform: Windows XP SP1 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\WINDOWS\System32\Ati2evxx.exe
                            C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
                            C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                            C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
                            C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
                            C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
                            C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
                            C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exe
                            C:\WINDOWS\System32\FTRTSVC.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
                            C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
                            C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
                            C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
                            C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
                            C:\WINDOWS\SOUNDMAN.EXE
                            C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                            C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
                            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                            C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                            C:\PROGRA~1\MESSAG~1\StartMessager.exe
                            C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                            C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
                            C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
                            C:\Program Files\QuickTime Alternative\qttask.exe
                            C:\Program Files\iTunes\iTunesHelper.exe
                            C:\WINDOWS\System32\ctfmon.exe
                            C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
                            C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
                            C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
                            C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
                            C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                            C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                            C:\Program Files\iPod\bin\iPodService.exe
                            C:\PROGRA~1\Wanadoo\ComComp.exe
                            C:\PROGRA~1\Wanadoo\Toaster.exe
                            C:\PROGRA~1\Wanadoo\Inactivity.exe
                            C:\PROGRA~1\Wanadoo\PollingModule.exe
                            C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
                            C:\PROGRA~1\Wanadoo\Watch.exe
                            C:\WINDOWS\System32\wuauclt.exe
                            C:\WINDOWS\System32\wuauclt.exe
                            C:\Program Files\Mozilla Firefox\firefox.exe
                            C:\Documents and Settings\Christian_2\Mes documents\logiciels\HijackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
                            O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                            O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                            O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Program Files\VideoCompressionCodec\isaddon.dll (file missing)
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                            O3 - Toolbar: Protection Bar - {8aed5df3-6e0b-4930-b1a5-f8aa8d757497} - C:\Program Files\VideoCompressionCodec\iesplugin.dll (file missing)
                            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                            O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                            O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                            O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
                            O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                            O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                            O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
                            O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\Av_Fw\Anti-Spyware\fsaswreg.exe"
                            O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
                            O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                            O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
                            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                            O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
                            O4 - Global Startup: Image Transfer.lnk = ?
                            O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
                            O4 - Global Startup: Lancer l'utilitaire d'enregistrement.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
                            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                            O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
                            O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                            O8 - Extra context menu item: Save Flash by &GetFlash - C:\PROGRA~1\GetFlash\getflash.htm
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                            O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                            O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab34120.cab
                            O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
                            O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                            O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                            O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab32846.cab
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
                            O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/081e35c02e2a11fe0e19/netzip/RdxIE601_fr.cab
                            O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab32846.cab
                            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                            O16 - DPF: {71DA2A4E-ACB3-4065-9E41-8BC42EABE427} - http://scripts.dlv4.com/binaries/IA/svcia32_FR_XP.cab
                            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - a840.g.akamai.net
                            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                            O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
                            O16 - DPF: {A13516A3-BE86-4517-813C-B5FF0C8ACDF3} (Toontown Installer ActiveX Control French) - http://idownload.french.toontown.com/sv1.5.8.16/ttinst-french.cab
                            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
                            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFramework/v10/ZIntro.cab34246.cab
                            O16 - DPF: {BCF9A64D-1440-4404-863C-F5DF2B99F798} (Catan Online Game) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/bingame/zpagames/zpa_catan.cab35906.cab
                            O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
                            O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab35645.cab
                            O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
                            O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                            O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
                            O17 - HKLM\System\CCS\Services\Tcpip\..\{DF525BD0-4B2F-4D8E-8B39-247E5B4C54D1}: NameServer = 80.10.246.1 80.10.246.132
                            O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                            O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll (file missing)
                            O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                            O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                            O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE
                            O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                            O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
                            O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
                            O23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)
                            O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exe
                            O23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exe
                            O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
                            O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
                            O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                            O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
                            0
                            1. green day Modérateur
                              ok,

                              # Démarre en mode sans échec :
                              Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
                              Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
                              Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
                              (Si F8 ne marche pas utilise la touche F5).
                              ----------------------------------------------------------------------------
                              # Relance le programme Smitfraud :
                              Cette fois choisit l’option 2, répond oui a tous ;
                              Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

                              ensuite :

                              Télécharge ceci :

                              Lien : hijackthis

                              Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

                              Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

                              ++

                              0
                              1. moma3 Auteur
                                merci de m'avoir répondu, voila le rapport :
                                SmitFraudFix v2.112

                                Rapport fait à 18:39:09,73, 20/10/2006
                                Executé à partir de C:\Documents and Settings\Christian_2\Mes documents\logiciels\SmitfraudFix
                                OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                Fix executé en mode normal

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                C:\WINDOWS\system32\dpfwu.dll PRESENT !
                                C:\WINDOWS\system32\1024\ PRESENT !

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christian_2

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christian_2\Application Data

                                »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url PRESENT !
                                C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url PRESENT !

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~2\Favoris

                                »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                C:\Program Files\VideoCompressionCodec\ PRESENT !
                                C:\Program Files\VirusBurster\ PRESENT !

                                »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                "Source"="About:Home"
                                "SubscribedURL"="About:Home"
                                0
                                1. green day Modérateur
                                  Salut

                                  # Télécharge ceci: (merci a S!RI pour ce petit programme).

                                  http://siri.urz.free.fr/Fix/SmitfraudFix.zip

                                  Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1,
                                  voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
                                  il va générer un rapport : copie/colle le sur le poste stp.

                                  ++

                                  **La volonté trouve, la liberté choisit. Trouver et choisir, c'est penser ( V.Hugo) **
                                  0

                                  Discussions similaires

                                  Critical low batterie
                                  annemarie

                                  1 réponse
                                  Rétrodiffusion "Mail Delivery System"
                                  baissaoui

                                  0 réponse
                                  Plug ASUS : que signifie "check system power error" ?
                                  Shimrhod

                                  49 réponses
                                  PC acer critical low battery mais battery neuve
                                  Pento_57

                                  10 réponses
                                  Ordi ne charge plus
                                  Laneige

                                  3 réponses