[TROJAN?] Infection trop chiante...HELP PLZ!

Salut

Merci :)
De rien,

Si tu as besoin, n'héistes pas :)

A+

Les problemes ont l'air d'avoir disparus...Je te remercie vivement pour ton aide trés éclairée....Bonne continuation a toi...a plus et continue, c'est trés utile

Salut

Ca semble ok, confirmes moi que tu n as plus de soucis?

A+

ok j'ai bien fait les manips et voila le scan hijackthis....ca a l'air d'aller au niveau fonctionnement ....tu penses que c'est bon? en tt cas merci MEEUUsieur!

Logfile of HijackThis v1.99.1
Scan saved at 21:03:29, on 08/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\avast antivirus\aswUpdSv.exe
D:\Program Files\avast antivirus\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\avast antivirus\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\PROGRA~1\AVASTA~1\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\asta\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fhelp%2fHelp4%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\program files\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\AVASTA~1\ashDisp.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/27f037ef43f3dae47905/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\avast antivirus\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\avast antivirus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\avast antivirus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\avast antivirus\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NeroNET - Unknown owner - D:\Program Files\Nero\NeroNET\NeroNET.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Unknown owner - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe (file missing)

Bonjour,

Courage, c'est bientôt terminé.

Méthode à suivre dans l'ordre...
----------------------------------------------------------------------------
¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite:

1/

Spybot S&D 1.4
https://www.safer-networking.org/

Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

2/

Ad-Aware SE 1.06
https://www.adaware.com/
-Une aide:
http://usa.lucretius-ada.com/zcvisitor/8782d344-4821-11ea-83ce-0a2cdf2c6be7?campaignid=0d1dff40-82d7-11e9-9533-0a157bfa6bfc
- installe le patch français, tu pourras le trouver ici:
http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
http://pageperso.aol.fr/balltrap34/adawrevid.asf

3/ AVG Anti-Spyware :

https://www.malekal.com/avg-antivirus-free-antivirus-gratuit-pour-proteger-son-pc-des-virus/

4/ Ccleaner :

https://www.malekal.com/tutoriel-ccleaner/
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

Coche « afficher les fichiers et dossiers cachés »

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.

Et appliquer !
----------------------------------------------------------------------------
¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

O2 - BHO: (no name) - {08A50B2A-ABE2-6783-BD57-062FB184C10E} - C:\WINDOWS\system32\rlvhdpk.dll

O2 - BHO: (no name) - {313300DA-0267-4825-B7F5-841E3503FE31} - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)

O2 - BHO: (no name) - {6D0BB46B-CE38-49E5-8902-C3C1C88C473A} - (no file)

O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - (no file)

O4 - HKCU\..\Run: [Microsoft WinUpdate] svchosts.exe

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/

O20 - Winlogon Notify: wineak32 - wineak32.dll (file missing)
----------------------------------------------------------------------------
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Recherche et supprime ceci:
attention seulement les fichiers (si présents).

C:\WINDOWS\system32\rlvhdpk.dll
svchosts.exe (/!\ Il y a un "s")
----------------------------------------------------------------------------
¤ Lance AVG Anti-Spyware

Clique sur le bouton Analyse (de la barre d'outils)

Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.

Reviens à l'onglet Analyse. Clique sur Analyse complète du système.

A la fin du scan, choisis l'option 3

"Appliquer toutes les actions " en bas.

Clique sur "Enregistrer le rapport".

Copie/colle le rapport sur le forum.
----------------------------------------------------------------------------
¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
----------------------------------------------------------------------------
¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
-------------------------------------------------------------------------------------------
¤ Lance CCleaner comme sur le tuto fournit au début de la procédure.
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

Précise tes soucis s’il en reste....

Tiens-moi au courant

A+

ok alors voila les derniers rapports.....dis moi que c'est bon stp....

SDFix: Version 1.69

Run by Administrateur - 04/03/2007 @ 11:17:07,46

Microsoft Windows XP [version 5.1.2600]

Running From: C:\Documents and Settings\asta\Bureau\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Entries
Restoring Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\L0YQZBN6\CAEN6NQ1.HTM - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\RID06DOR\CAAZMZ2D.HTM - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\RID06DOR\CARAK3V5.HTM - Deleted
C:\DOCUME~1\asta\LOCALS~1\Temp\uninstall.exe - Deleted
C:\WINDOWS\system32\hook.dll - Deleted
C:\WINDOWS\system32\TFTP1048 - Deleted
C:\WINDOWS\system32\TFTP1104 - Deleted
C:\WINDOWS\system32\TFTP1120 - Deleted
C:\WINDOWS\system32\TFTP1192 - Deleted
C:\WINDOWS\system32\TFTP1220 - Deleted
C:\WINDOWS\system32\TFTP1308 - Deleted
C:\WINDOWS\system32\TFTP1312 - Deleted
C:\WINDOWS\system32\TFTP1316 - Deleted
C:\WINDOWS\system32\TFTP1336 - Deleted
C:\WINDOWS\system32\TFTP1356 - Deleted
C:\WINDOWS\system32\TFTP1384 - Deleted
C:\WINDOWS\system32\TFTP1388 - Deleted
C:\WINDOWS\system32\TFTP1400 - Deleted
C:\WINDOWS\system32\TFTP1404 - Deleted
C:\WINDOWS\system32\TFTP1472 - Deleted
C:\WINDOWS\system32\TFTP1484 - Deleted
C:\WINDOWS\system32\TFTP1488 - Deleted
C:\WINDOWS\system32\TFTP1492 - Deleted
C:\WINDOWS\system32\TFTP1504 - Deleted
C:\WINDOWS\system32\TFTP1548 - Deleted
C:\WINDOWS\system32\TFTP1560 - Deleted
C:\WINDOWS\system32\TFTP1596 - Deleted
C:\WINDOWS\system32\TFTP1624 - Deleted
C:\WINDOWS\system32\TFTP1652 - Deleted
C:\WINDOWS\system32\TFTP1676 - Deleted
C:\WINDOWS\system32\TFTP1740 - Deleted
C:\WINDOWS\system32\TFTP1752 - Deleted
C:\WINDOWS\system32\TFTP1764 - Deleted
C:\WINDOWS\system32\TFTP1776 - Deleted
C:\WINDOWS\system32\TFTP1784 - Deleted
C:\WINDOWS\system32\TFTP1800 - Deleted
C:\WINDOWS\system32\TFTP1816 - Deleted
C:\WINDOWS\system32\TFTP1828 - Deleted
C:\WINDOWS\system32\TFTP184 - Deleted
C:\WINDOWS\system32\TFTP1852 - Deleted
C:\WINDOWS\system32\TFTP1868 - Deleted
C:\WINDOWS\system32\TFTP1888 - Deleted
C:\WINDOWS\system32\TFTP1916 - Deleted
C:\WINDOWS\system32\TFTP1928 - Deleted
C:\WINDOWS\system32\TFTP1964 - Deleted
C:\WINDOWS\system32\TFTP1980 - Deleted
C:\WINDOWS\system32\TFTP1984 - Deleted
C:\WINDOWS\system32\TFTP1988 - Deleted
C:\WINDOWS\system32\TFTP1992 - Deleted
C:\WINDOWS\system32\TFTP200 - Deleted
C:\WINDOWS\system32\TFTP2000 - Deleted
C:\WINDOWS\system32\TFTP2012 - Deleted
C:\WINDOWS\system32\TFTP2076 - Deleted
C:\WINDOWS\system32\TFTP208 - Deleted
C:\WINDOWS\system32\TFTP216 - Deleted
C:\WINDOWS\system32\TFTP2200 - Deleted
C:\WINDOWS\system32\TFTP2228 - Deleted
C:\WINDOWS\system32\TFTP2244 - Deleted
C:\WINDOWS\system32\TFTP2284 - Deleted
C:\WINDOWS\system32\TFTP2304 - Deleted
C:\WINDOWS\system32\TFTP2376 - Deleted
C:\WINDOWS\system32\TFTP2456 - Deleted
C:\WINDOWS\system32\TFTP2516 - Deleted
C:\WINDOWS\system32\TFTP2548 - Deleted
C:\WINDOWS\system32\TFTP2580 - Deleted
C:\WINDOWS\system32\TFTP260 - Deleted
C:\WINDOWS\system32\TFTP2628 - Deleted
C:\WINDOWS\system32\TFTP2712 - Deleted
C:\WINDOWS\system32\TFTP276 - Deleted
C:\WINDOWS\system32\TFTP2792 - Deleted
C:\WINDOWS\system32\TFTP280 - Deleted
C:\WINDOWS\system32\TFTP2904 - Deleted
C:\WINDOWS\system32\TFTP3004 - Deleted
C:\WINDOWS\system32\TFTP3052 - Deleted
C:\WINDOWS\system32\TFTP3152 - Deleted
C:\WINDOWS\system32\TFTP3252 - Deleted
C:\WINDOWS\system32\TFTP3408 - Deleted
C:\WINDOWS\system32\TFTP3600 - Deleted
C:\WINDOWS\system32\TFTP3684 - Deleted
C:\WINDOWS\system32\TFTP384 - Deleted
C:\WINDOWS\system32\TFTP3864 - Deleted
C:\WINDOWS\system32\TFTP3924 - Deleted
C:\WINDOWS\system32\TFTP3940 - Deleted
C:\WINDOWS\system32\TFTP3952 - Deleted
C:\WINDOWS\system32\TFTP396 - Deleted
C:\WINDOWS\system32\TFTP3968 - Deleted
C:\WINDOWS\system32\TFTP3980 - Deleted
C:\WINDOWS\system32\TFTP400 - Deleted
C:\WINDOWS\system32\TFTP4196 - Deleted
C:\WINDOWS\system32\TFTP4208 - Deleted
C:\WINDOWS\system32\TFTP4276 - Deleted
C:\WINDOWS\system32\TFTP4472 - Deleted
C:\WINDOWS\system32\TFTP464 - Deleted
C:\WINDOWS\system32\TFTP4908 - Deleted
C:\WINDOWS\system32\TFTP5236 - Deleted
C:\WINDOWS\system32\TFTP532 - Deleted
C:\WINDOWS\system32\TFTP556 - Deleted
C:\WINDOWS\system32\TFTP5856 - Deleted
C:\WINDOWS\system32\TFTP5952 - Deleted
C:\WINDOWS\system32\TFTP664 - Deleted
C:\WINDOWS\system32\TFTP700 - Deleted
C:\WINDOWS\system32\TFTP752 - Deleted
C:\WINDOWS\system32\TFTP768 - Deleted
C:\WINDOWS\system32\TFTP800 - Deleted
C:\WINDOWS\system32\TFTP900 - Deleted
C:\WINDOWS\system32\TFTP936 - Deleted
C:\WINDOWS\system32\TFTP948 - Deleted
C:\WINDOWS\system32\TFTP972 - Deleted

ADS Check:

C:\WINDOWS\system32
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Steam\\steam.exe"="C:\\Program Files\\Steam\\steam.exe:*:Enabled:Steam"
"C:\\Program Files\\Steam\\SteamApps\\atstakilla\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\atstakilla\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"D:\\divx player\\realplay.exe"="D:\\divx player\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"D:\\Freeplayer\\vlc\\vlc.exe"="D:\\Freeplayer\\vlc\\vlc.exe:*:Enabled:VLC media player"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"D:\\demolisha sound system\\Graffiti Studio\\Graffiti Studio.exe"="D:\\demolisha sound system\\Graffiti Studio\\Graffiti Studio.exe:*:Disabled:Macromedia Projector"
"D:\\demolisha sound system\\TEMPORAIRE\\Freeplayer\\vlc\\vlc.exe"="D:\\demolisha sound system\\TEMPORAIRE\\Freeplayer\\vlc\\vlc.exe:*:Enabled:VLC media player"
"D:\\HomePlayer\\vlc\\vlc.exe"="D:\\HomePlayer\\vlc\\vlc.exe:*:Enabled:VLC media player"
"D:\\Program Files\\VNC4\\winvnc4.exe"="D:\\Program Files\\VNC4\\winvnc4.exe:*:Enabled:VNC Server Free Edition for Win32"
"D:\\demolisha sound system\\Graffiti Studio\\FINAL gs 2.0 pc\\Graffiti Studio 2.0\\Graffiti Studio.exe"="D:\\demolisha sound system\\Graffiti Studio\\FINAL gs 2.0 pc\\Graffiti Studio 2.0\\Graffiti Studio.exe:*:Enabled:Macromedia Projector"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"D:\\Program Files\\Steam\\SteamApps\\atstakilla\\counter-strike\\hl.exe"="D:\\Program Files\\Steam\\SteamApps\\atstakilla\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"D:\\Program Files\\vlc\\vlc.exe"="D:\\Program Files\\vlc\\vlc.exe:*:Disabled:VLC media player"
"C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\86exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\86exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\5exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\5exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\65exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\65exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\67exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\67exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\28exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\28exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\75exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\75exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\14exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\14exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\24exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\24exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\21exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\21exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\17exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\17exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\40exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\40exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\96exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\96exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\3exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\3exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\77exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\77exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\6exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\6exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\92exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\92exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\82exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\82exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\18exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\18exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\9exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\9exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\56exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\56exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\98exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\98exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\80exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\80exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\7exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\7exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\8exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\8exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\58exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\58exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\54exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\54exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\89exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\89exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\62exinjs.a2.exe"="C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\62exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\98exinjs.a2.exe"="C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\98exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\17exinjs.a2.exe"="C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\17exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\63exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\63exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\88exinjs.a2.exe"="C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\88exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\41exinjs.a2.exe"="C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\41exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\53exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\53exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\54exinjs.a2.exe"="C:\\DOCUME~1\\maria\\LOCALS~1\\Temp\\54exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\16exinjs.a2.exe"="C:\\DOCUME~1\\asta\\LOCALS~1\\Temp\\16exinjs.a2.exe:*:Enabled:Microsoft Update"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

Remaining Files:
---------------

Backups Folder: - C:\DOCUME~1\asta\Bureau\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes :

C:\Program Files\Fichiers communs\Adobe\ESD\DLMCleanup.exe
C:\jvcjaw3o.sys
C:\WINDOWS\system32\KGyGaAvL.sys
C:\Documents and Settings\asta\Local Settings\Temp\~10.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~11.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~12.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~13.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~14.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~15.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~15B.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~16.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~17.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~18.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~19.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~1A.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~1B.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~1C.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~1D.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~1E.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~1F.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~20.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~21.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~217.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~21E.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~21F.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~243.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~24A.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~256.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~258.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~27.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~2A.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~2B.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~2D.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~3.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~34.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~35.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~38.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~3F9.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~4.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~87.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~8C.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~8E.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~A.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~B.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~C.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~D.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~E.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~F.tmp
C:\Documents and Settings\asta\Local Settings\Temp\~FA.tmp

Add/Remove Programs List:

Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Download Manager 2.0 (Supprimer uniquement)
adsl TV
avast! Antivirus
AVG Anti-Spyware 7.5
BSPlayer
Canon i560
CCleaner (remove only)
Counter-Strike: Condition Zero
Creative MuVo N200 Media Explorer
DivXPacK .NG
eMule
ffdshow (remove only)
Free - Kit de connexion
Freeplayer
Graffiti Studio 2.0
Haali Media Splitter
HijackThis 1.99.1
HomePlayer
Java Web Start
Kaspersky Online Scanner
Correctif Windows XP - KB834707
Correctif Windows XP - KB867282
Microsoft Data Access Components KB870669
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB886185
Correctif Windows XP - KB887472
Correctif Windows XP - KB887742
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891781
Correctif Windows XP - KB893066
Correctif Windows XP - KB893086
Language pack for Ad-Aware SE
Macromedia Shockwave Player
Matroska Pack
MSI 3D!Turbo 2001
MuVo Driver
Nero 6 Ultra Edition
NVIDIA Windows 2000/XP Display Drivers
Direct Show Ogg Vorbis Filter (remove only)
Microsoft Office Professional Plus 2007 (Beta)
Quick Zip 3.06.3
RealPlayer
Adobe Flash Player 9 ActiveX
adsl TV
VIA USB Filter Driver (Vlink)
Windows XP Service Pack 2
The GIMP 2.2.11
GTK+ 2.8.9 runtime environment
Archiveur WinRAR
Sony Sound Forge 7.0
OpenMG Secure Module 3.1
Java 2 Runtime Environment, SE v1.4.1_01
Google Toolbar for Internet Explorer
Microsoft Office Professional 2007 (Beta)
Microsoft Office Access MUI (French) 2007 (Beta)
Microsoft Office Excel MUI (French) 2007 (Beta)
Microsoft Office PowerPoint MUI (French) 2007 (Beta)
Microsoft Office Publisher MUI (French) 2007 (Beta)
Microsoft Office Outlook MUI (French) 2007 (Beta)
Microsoft Office Word MUI (French) 2007 (Beta)
Microsoft Office Proof (Arabic) 2007 (Beta)
Microsoft Office Proof (German) 2007 (Beta)
Microsoft Office Proof (English) 2007 (Beta)
Microsoft Office Proof (French) 2007 (Beta)
Microsoft Office Proof (Dutch) 2007 (Beta)
Microsoft Office Proof (Spanish) 2007 (Beta)
Microsoft Office InfoPath MUI (French) 2007 (Beta)
Microsoft Office Shared MUI (French) 2007 (Beta)
Music Visualizer Library 1.4.00
Macromedia Extension Manager
Visionneuse Journal Windows Microsoft
SAGEM F@st 800-908
Creative MediaSource
Macromedia Flash 8 Video Encoder
Camtasia Studio 4
Sony ACID Pro 6.0
MSN Messenger 7.5
Avance AC'97 Audio

Finished

et maintenant hitjackthis....

Logfile of HijackThis v1.99.1
Scan saved at 11:28:13, on 04/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\avast antivirus\aswUpdSv.exe
D:\Program Files\avast antivirus\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\avast antivirus\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\PROGRA~1\AVASTA~1\ashDisp.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\asta\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fhelp%2fHelp4%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.free.fr/freebox/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\program files\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {08A50B2A-ABE2-6783-BD57-062FB184C10E} - C:\WINDOWS\system32\rlvhdpk.dll
O2 - BHO: (no name) - {313300DA-0267-4825-B7F5-841E3503FE31} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {6D0BB46B-CE38-49E5-8902-C3C1C88C473A} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\AVASTA~1\ashDisp.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Microsoft WinUpdate] svchosts.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/27f037ef43f3dae47905/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: wineak32 - wineak32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\avast antivirus\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\avast antivirus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\avast antivirus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\avast antivirus\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NeroNET - Unknown owner - D:\Program Files\Nero\NeroNET\NeroNET.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Unknown owner - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe (file missing)

a toi de jouer....

Salut

Il en reste.

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

voila missiou....

VundoFix V6.3.12

Checking Java version...

Scan started at 12:06:11 03/03/2007

Listing files found while scanning....

VundoFix V6.3.12

Checking Java version...

Scan started at 12:14:16 03/03/2007

Listing files found while scanning....

C:\WINDOWS\system32\ddcbxuv.dll
C:\WINDOWS\system32\orqss.bak1
C:\WINDOWS\system32\orqss.bak2
C:\WINDOWS\system32\orqss.ini
C:\WINDOWS\system32\orqss.ini2
C:\WINDOWS\system32\orqss.tmp
C:\WINDOWS\system32\sjhsoywd.dll
C:\WINDOWS\system32\ssqro.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ddcbxuv.dll
C:\WINDOWS\system32\ddcbxuv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\orqss.bak1
C:\WINDOWS\system32\orqss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\orqss.bak2
C:\WINDOWS\system32\orqss.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\orqss.ini
C:\WINDOWS\system32\orqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\orqss.ini2
C:\WINDOWS\system32\orqss.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\orqss.tmp
C:\WINDOWS\system32\orqss.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\sjhsoywd.dll
C:\WINDOWS\system32\sjhsoywd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqro.dll
C:\WINDOWS\system32\ssqro.dll Has been deleted!

Performing Repairs to the registry.
Done!

et maintenant hijackthis.....

Logfile of HijackThis v1.99.1
Scan saved at 12:28:51, on 03/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\avast antivirus\aswUpdSv.exe
D:\Program Files\avast antivirus\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\avast antivirus\ashMaiSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\PROGRA~1\AVASTA~1\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\asta\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fhelp%2fHelp4%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.free.fr/freebox/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\program files\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {08A50B2A-ABE2-6783-BD57-062FB184C10E} - C:\WINDOWS\system32\rlvhdpk.dll
O2 - BHO: (no name) - {313300DA-0267-4825-B7F5-841E3503FE31} - C:\WINDOWS\system32\ddcbxuv.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {6D0BB46B-CE38-49E5-8902-C3C1C88C473A} - C:\WINDOWS\system32\ssqro.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - C:\WINDOWS\system32\sjhsoywd.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\AVASTA~1\ashDisp.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wUpdate.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Microsoft WinUpdate] svchosts.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/27f037ef43f3dae47905/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: wineak32 - wineak32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\avast antivirus\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\avast antivirus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\avast antivirus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\avast antivirus\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NeroNET - Unknown owner - D:\Program Files\Nero\NeroNET\NeroNET.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Unknown owner - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe (file missing)

voila...avast n'a rien trouvé a l'ouverture de windows alors que d'hab il me prenait la tete.De plus pas de pub a la navigation, j'espere que ca a marché....je t'en dis plus si ca redeconne, j'attend un peu. Merci deja, efficace l'ami

Salut,

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4

Double-clique VundoFix.exe afin de le lancer.
Clique sur le bouton Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
Démarre ton PC à nouveau.
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

voila le scan bit defender ...j'ai l'impression qu'a chaque fois, les scans trouvent des trucs différents...c'est légèrement chiant...

BitDefender Online Scanner

Scan report generated at: Wed, Feb 28, 2007 - 17:26:51

Scan path: A:\;C:\;D:\;E:\;F:\;

Statistics

Time
02:27:38

Files
252511

Folders
4605

Boot Sectors
3

Archives
1912

Packed Files
16985

Results

Identified Viruses
8

Infected Files
8

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
5

Engines Info

Virus Definitions
394002

Engine build
AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)

Scan plugins
14

Archive plugins
38

Unpack plugins
6

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\WINDOWS\inf\alchem.inf
Infected with: Trojan.Downloader.Alchemic.B

C:\WINDOWS\inf\alchem.inf
Disinfection failed

C:\WINDOWS\inf\alchem.inf
Deleted

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\TZ0WN05O\0006_regular[1].cab=>istactivex.inf
Infected with: Trojan.Downloader.Istbar.PY

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\TZ0WN05O\0006_regular[1].cab=>istactivex.inf
Disinfection failed

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\TZ0WN05O\0006_regular[1].cab=>istactivex.inf
Deleted

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\TZ0WN05O\0006_regular[1].cab
Update failed

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\TZ0WN05O\gamma[1].htm
Infected with: JS.Trojan.Downloader.IstBar.A

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\TZ0WN05O\gamma[1].htm
Disinfection failed

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\TZ0WN05O\gamma[1].htm
Deleted

C:\WINDOWS\system32\ddcbxuv.dll
Infected with: MemScan:Trojan.Vundo.AD

C:\WINDOWS\system32\ddcbxuv.dll
Disinfection failed

C:\WINDOWS\system32\ddcbxuv.dll
Delete failed

C:\WINDOWS\system32\rlvhdpk.dll
Infected with: Trojan.Busky.2.Gen

C:\WINDOWS\system32\rlvhdpk.dll
Disinfection failed

C:\WINDOWS\system32\rlvhdpk.dll
Delete failed

C:\WINDOWS\system32\ssqro.dll
Infected with: MemScan:Trojan.Vundo.AA

C:\WINDOWS\system32\ssqro.dll
Disinfection failed

C:\WINDOWS\system32\ssqro.dll
Delete failed

C:\WINDOWS\system32\thdfaxue.exe
Infected with: Trojan.Agent.ACL

C:\WINDOWS\system32\thdfaxue.exe
Disinfection failed

C:\WINDOWS\system32\thdfaxue.exe
Deleted

C:\WINDOWS\system32\yxcjnjww.dll
Infected with: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\yxcjnjww.dll
Disinfection failed

C:\WINDOWS\system32\yxcjnjww.dll
Deleted

Salut,

Lance ce scan en ligne:
http://www.bitdefender.fr/scan8/ie.html
Copie/colle le rapport
Aide en image : http://pageperso.aol.fr/rginformatique/mapage/defender.htm

A+

j'ai suivi la procedure et voila le resultat du scan fsecure

Search Navipromo version 1.0.3 commencé le 23/02/2007 à 1:56:43.98

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Documents and Settings\asta\Bureau
Mise a jour le 21.02.2007 a 17h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans C:\Documents and Settings\asta\Application Data ***

*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en

F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of April, 2007.
Version information: 2.2.1055.

[+] Started on 02/23/07 at 01:56:47.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ..............................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 02/23/07 at 02:05:54 (return code = 0).

*** Recherche fichiers ***

*** Recherche cles registre ***

Recharche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

Recharche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]

Recherche Clé Magic Control

*** Module de recherche complémentaire ***
(recherche fichiers spécifiques)

*** Analyse Terminé le 23/02/2007 à 2:06:46.14 ***

en esperant que cela puisses t'inspirer parce que moi....

Salut

Prends connaissance du contenu le lien suivant:
http://www.f-secure.com/products/license-terms/eult_fra.pdf
Tu as donc pris connaissance et accepté les conditions d'utilisations du programme blacklight qui est inclus dans le dossier compressé navilog1.zip que tu vas télécharger.
Maintenant fais un clic droit sur ce lien :
http://perso.orange.fr/il.mafioso/Navifix/navilog1.zip
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Fais un clic droit sur navilog1.zip et choisis "tout extraire"
Ensuite double clique sur navilog1.bat
Laisses-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2 sans notre avis/accord)
Patientes jusqu'au message :
*** Analyse Termine le ..... ***
Appuies sur une touche comme demandé, le blocnote va s'ouvrir.
Copies-colles l'intégralité dans une réponse. Refermes le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)