Virus defensenetsurfage

Résolu
kevinr166 -  
Bonjour,
je suis infecté par le virus defensenetsurfage et j'ai tout éssayé mais je n'arrive pas à le supprimer j'ai aussi fait une analyse avec hijackthis qui ma indiqué des fichiers é des clés registres mais je ne sais pas lesquelles supprimer j'èspère que quelqu'un pourra m'aider parsk ce virus me soule depui kelke jour... répondez svp!! merci d'avance
Configuration: Windows XP
Internet Explorer 7.0

45 réponses

Résumé de la discussion

Une infection par un malware complexe est rencontrée sur Windows XP, résistante aux tentatives de suppression et nécessitant l’identification précise de fichiers et clés malveillants. Plusieurs réponses préconisent des outils spécialisés comme SafeBootKeyRepair, SmitFraudFix, ComboFix, et des scans en ligne (BitDefender), associés à des nettoyages de registre et à la suppression de fichiers et de dossiers suspects. En parallèle, des analyses montrent des éléments de démarrage et des services modifiés, avec des rapports HijackThis et des logs SmitFraudFix/ComboFix décrivant des entrées douteuses et des restes de programmes malveillants. Des retours successifs évoquent des suppressions et restaurations, incluant un rapport ComboFix récent, mais sans confirmation formelle de la suppression complète ni du statut actuel du système.

Bobot (l’IA à votre service)
  1. kevinr166
    Re! D'accord voila le combofix :

    ComboFix 07-11-05.2 - HP_Propriétaire 2007-11-13 19:01:45.3 - NTFSx86
    Running from: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
    .

    ((((((((((((((((((((((((((((( Fichiers créés 2007-10-13 to 2007-11-13 ))))))))))))))))))))))))))))))))))))
    .

    2007-11-12 19:01 <REP> d-------- C:\WINDOWS\BDOSCAN8
    2007-11-10 09:38 53,248 --a------ C:\WINDOWS\system32\Process.exe
    2007-11-06 19:17 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2007-11-06 11:45 <REP> d----c--- C:\Program Files\VideoLAN
    2007-11-05 23:43 <REP> d----c--- C:\Program Files\Navilog1
    2007-11-05 22:54 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-11-05 13:56 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-11-05 10:52 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
    2007-11-05 10:52 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
    2007-11-05 10:52 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
    2007-11-05 10:52 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
    2007-11-04 22:05 3,268 --a------ C:\WINDOWS\system32\tmp.reg
    2007-11-04 14:32 <REP> d----c--- C:\VundoFix Backups
    2007-11-03 19:41 <REP> d----c--- C:\Program Files\Trend Micro
    2007-10-30 18:55 2,855 --a------ C:\WINDOWS\system32\edit.PIF
    2007-10-27 09:07 44,032 --a------ C:\WINDOWS\system32\VuPassword.dll
    2007-10-25 10:26 53,248 --a------ C:\WINDOWS\bdoscandel.exe

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-11-13 01:35 --------- dc----w C:\Program Files\eMule
    2007-11-06 14:29 --------- dc----w C:\Program Files\Wanadoo
    2007-11-06 10:47 --------- dc----w C:\Documents and Settings\HP_Propriétaire\Application Data\vlc
    2007-10-27 17:45 --------- dc----w C:\Program Files\DivX
    2007-10-25 17:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
    2007-10-25 17:05 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
    2007-10-25 17:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
    2007-10-25 17:01 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
    2007-10-25 16:58 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
    2007-10-25 16:24 815,480 -c--a-w C:\WINDOWS\system32\aswBoot.exe
    2007-10-25 16:14 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
    2007-10-15 17:37 --------- dc----w C:\Program Files\Shareaza
    2007-10-08 18:58 --------- dc----w C:\Documents and Settings\HP_Propriétaire\Application Data\BearShare
    2007-09-28 16:08 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2007-09-28 16:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2007-09-28 16:07 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
    2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2007-09-28 16:07 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2007-09-28 16:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll
    2007-09-28 16:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
    2007-09-28 16:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
    2007-09-28 16:07 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
    2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
    2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
    2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
    2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
    2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
    2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
    2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
    2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
    2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
    2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
    2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2007-09-23 20:09 --------- dc----w C:\Program Files\Dictionnaire
    2007-08-28 19:53 164,352 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
    2007-08-22 07:45 15,470 -c--a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
    2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-04-01 12:52 95,288 -c--a-w C:\Documents and Settings\HP_Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
    2005-08-23 15:40:18 0 --sha-w C:\WINDOWS\SMINST\HPCD.sys
    2005-10-24 07:39:23 56 --sh--r C:\WINDOWS\system32\8CD90E1E38.sys
    2003-08-16 19:56:00 579,584 --sha-r C:\WINDOWS\system32\cd.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2007-11-05_23.11.59.54 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
    + 2007-10-25 09:26:48 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll
    + 2005-05-16 18:34:48 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
    + 2006-03-20 12:17:24 65,536 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
    + 2006-03-20 12:17:20 798,720 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
    + 2007-11-13 12:26:25 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_144.dat
    + 2007-11-13 12:26:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_54c.dat
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{65D5A3B2-859E-42F5-AE9E-BC6D7EC1B0EB}]
    C:\WINDOWS\system32\VBA232.DLL

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{944864A5-3916-46E2-96A9-A2E84F3F1208}]
    C:\Program Files\Accoona\ASearchAssist.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B7531CF3-3DBE-4D68-BED9-E3697F3CDC9B}]
    C:\WINDOWS\system32\dplay32.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2EA6A7E-79FC-4CFB-90E4-898C742B44C5}]
    C:\WINDOWS\system32\mobsyncd.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F3E3A0A8-906B-47D7-8E5E-8C7F1D3C0BDC}]
    C:\WINDOWS\system32\ulib32.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-01 23:12]
    "HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 18:53]
    "h3yb0y"="C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe" []
    "h3yb0y1"="C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe" []
    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49]
    "helpr"="C:\Program Files\SETI\helper.exe" []
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 10:52]
    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04]
    "AlcxMonitor"="ALCXMNTR.EXE" []
    "PS2"="C:\WINDOWS\system32\ps2.exe" []
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20]
    "HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 18:43]
    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-18 08:38]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 20:43]
    "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" []

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PCShield"="regsvr32 /s C:\WINDOWS\system32\sfg.dll" []
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 11:00]
    "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 19:31]
    "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

    C:\Documents and Settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
    Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2006-03-17 21:16:17]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "EditLevel"=0 (0x0)
    "NoCommonGroups"=0 (0x0)
    "DisallowRun"=0 (0x0)
    "NoToolbarsOnTaskbar"=0 (0x0)
    "NoTrayContextMenu"=0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
    "1"=edi.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "bxsbang"= {D117607A-ED64-4810-9909-CD719374EE12} - C:\WINDOWS\bxsbang.dll [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "System"="lsass.exe"
    "UIHost"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,\

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=. 3 SF3.DLL,noxizaca.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acme.PCHButton]
    C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX3200]
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    nwiz.exe /installquiet /keeploaded /nodetect

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCShield]
    regsvr32 /s "C:\WINDOWS\system32\sfg.dll"

    R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys
    R0 vax347b2;vax347b2;C:\WINDOWS\system32\DRIVERS\vax347b2.sys
    R0 vax347s2;vax347s2;C:\WINDOWS\system32\Drivers\vax347s2.sys
    R2 MicroGuard;MicroGuard Copy Protection;\??\C:\WINDOWS\system32\drivers\mgnt.sys
    R3 Cap7134;ASUS TV7134 WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys
    R3 PhTVTune;ASUS WDM TV Tuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys
    R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys
    S2 NoxizacDriver;Noxizac Driver;\??\C:\WINDOWS\system32\noxizac.sys
    S2 NoxizacSrv;Noxizac Service;C:\WINDOWS\system32\noxizac.exe
    S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
    S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
    S3 DFUBTUSB;WIDCOMM USB Bluetooth Driver in DFU State;C:\WINDOWS\system32\Drivers\frmupgr.sys
    S3 hSONYPVh;hSONYPVh;\??\C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\hSONYPVh.sys
    S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\SophosMEMSWEEP.SYS
    S3 OCBNEXFH;OCBNEXFH;C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\OCBNEXFH.exe
    S3 p2pgasvc;Authentification de groupe réseau homologue;C:\WINDOWS\system32\svchost.exe -k p2psvc
    S3 p2pimsvc;Gestionnaire d'identité réseau homologue;C:\WINDOWS\system32\svchost.exe -k p2psvc
    S3 p2psvc;Réseau homologue;C:\WINDOWS\system32\svchost.exe -k p2psvc
    S3 PavSRK.sys;PavSRK.sys;\??\C:\WINDOWS\system32\PavSRK.sys
    S3 PNRPSvc;Protocole de résolution de noms d'homologues;C:\WINDOWS\system32\svchost.exe -k p2psvc
    S3 SaiH0464;SaiH0464;C:\WINDOWS\system32\DRIVERS\SaiH0464.sys
    S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
    S4 PavProc;Panda Process Protection Driver;\??\C:\WINDOWS\system32\DRIVERS\PavProc.sys
    S4 QVMKLIL;QVMKLIL;C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\QVMKLIL.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{096db9a4-0d52-11dc-b652-0060b3b148b3}]
    \Shell\AutoRun\command - G:\SETUP.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16e5fb2a-6824-11db-a3db-806d6172696f}]
    \Shell\AutoRun\command - G:\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3970f550-40b0-11db-9d5b-806d6172696f}]
    \Shell\AutoRun\command - K:\SETUP.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d6f0b4a-35e0-11dc-9a38-806d6172696f}]
    \Shell\AutoRun\command - E:\autoplay.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47c058ab-3c1b-11dc-b036-806d6172696f}]
    \Shell\AutoRun\command - H:\autorun.exe
    \Shell\directx\command - H:\DirectX9\dxsetup.exe
    \Shell\setup\command - H:\install.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47c058c3-3c1b-11dc-b036-0060b3b148b3}]
    \Shell\AutoRun\command - EXPLORER.EXE
    \Shell\explore\Command - EXPLORER.EXE
    \Shell\open\Command - EXPLORER.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5d5377a8-4a78-11db-90ea-806d6172696f}]
    \Shell\AutoRun\command - E:\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5d5377aa-4a78-11db-90ea-806d6172696f}]
    \Shell\AutoRun\command - G:\Autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d37e11a-0923-11dc-b645-0060b3b148b3}]
    \Shell\AutoRun\command - EXPLORER.EXE
    \Shell\explore\Command - EXPLORER.EXE
    \Shell\open\Command - EXPLORER.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94c17f00-5499-11db-a6fe-806d6172696f}]
    \Shell\AutoRun\command - D:\setupSNK.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a11c522a-3d00-11db-bb3c-806d6172696f}]
    \Shell\AutoRun\command - G:\autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4b15c4f-cf59-11db-9570-806d6172696f}]
    \Shell\AutoRun\command - F:\autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab1b69cc-4bad-11db-8e77-806d6172696f}]
    \Shell\AutoRun\command - D:\setupSNK.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab1b69d0-4bad-11db-8e77-806d6172696f}]
    \Shell\AutoRun\command - G:\EE2AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d6a63ceb-b08e-11db-b7cf-0060b3b148b3}]
    \Shell\AutoRun\command - M:\Autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de217750-44a2-11db-a39c-806d6172696f}]
    \Shell\AutoRun\command - G:\Autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4043a5a-56c1-11db-a1c1-806d6172696f}]
    \Shell\AutoRun\command - D:\setupSNK.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7d74926-5151-11db-a6d7-806d6172696f}]
    \Shell\AutoRun\command - D:\setupSNK.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7d74928-5151-11db-a6d7-806d6172696f}]
    \Shell\AutoRun\command - E:\AUTORUN\AUTORUN.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7d7492a-5151-11db-a6d7-806d6172696f}]
    \Shell\AutoRun\command - G:\Autorun.exe

    *Newly Created Service* - PCANDIS5

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe"
    .
    **************************************************************************

    catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-11-13 19:07:18
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    **************************************************************************
    .
    Completion time: 2007-11-13 19:08:48
    C:\ComboFix2.txt ... 2007-11-06 13:54
    C:\ComboFix3.txt ... 2007-11-05 23:14
    .
    --- E O F ---
    1. Regis59 Contributeur sécurité
      Ok on fera sans.

      Remet un combofix et on supprimera les fichiers malicieux.

      A+
      1. kevinr166
        Re,
        Désolé mais le scan online ne se lance pas j'ai tout fait jusqu'à l'installation du controle ActiveX, mais juste après un message d'erreur s'affiche :
        "This web site is not authorized to host this ActiveX control.
        Please contact the webmaster of this website, or report to BitDefender at the e-mail adress: scanonline@bitdefender.com"

        Et après avoir cliqué sur le "ok" de ce message, le lien "Scan online" ne fonctionne pas...

        A+
        1. Regis59 Contributeur sécurité
          Ok.

          On les vireras en auto alors.

          Lance ce scan en ligne:
          http://www.bitdefender.fr/scan8/ie.html
          Copie/colle le rapport
          Aide en image : http://pageperso.aol.fr/rginformatique/mapage/defender.htm

          a+
          2. kevinr166
            Re,
            Non toujours pas, les cases étaient déja comme tu m'as demandé (j'avais déjà du le faire auparavent) il n'y a que les fichiers que je t'ai écrit dans mon post précédent qui sont au chemin indiqué, pour les autres, j'en ai aperçu quelque-uns dans le dossier C:\Windows\ mais pas dans les autres dossiers, et le dossier C:\Windows\System32\dllcahe\win32\ n'existe pas sur m'on système.

            A+
            1. Regis59 Contributeur sécurité
              OK

              ¤Affiche tous les fichiers et dossiers :
              Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

              Coche « afficher les fichiers et dossiers cachés »

              Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

              Décoche « masquer les extensions dont le type est connu »
              Puis fais «Ok» pour valider les changements.

              Et appliquer !

              Dis moi s'ils sont présent sur ton systeme en suivant le chemin (ne pas utiliser la fonction rechercher)

              A+
              1. kevinr166
                Petit problème... parmis tous les fichiers que tu m'as demandé d'analyser, il n'y en a que 2* qui sont a l'emplacement que tu as écrit (C:\WINDOWS\bxsbang.dl n'est plus présent non plus), les autres sont à d'autres emplacement. Dois-je quand même les analyser??

                *C:\WINDOWS\SYSTEM32\DRIVERS\etc\conf.dll et
                C:\WINDOWS\SYSTEM32\DRIVERS\etc\serv-u.ini :

                Status: OK

                A+
                1. Regis59 Contributeur sécurité
                  Re,

                  Tu vas m'analyser plusieurs fichiers.

                  Vas sur le site https://virusscan.jotti.org/
                  - Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
                  C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe
                  - Clic sur submit toujours en haut à droite
                  - Le scan va se lancer, ça va prendre un petit instant
                  - En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
                  Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799

                  Pareil avec:
                  C:\WINDOWS\SYSTEM32\DRIVERS\etc\service.exe
                  C:\WINDOWS\SYSTEM32\DRIVERS\etc\conf.dll
                  C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe
                  C:\WINDOWS\SYSTEM32\DRIVERS\etc\system.exe
                  C:\WINDOWS\SYSTEM32\DRIVERS\etc\serv-u.ini
                  C:\WINDOWS\bxsbang.dll << ne devrait plus etre present
                  C:\WINDOWS\system32\noxizac.exe
                  c:\windows\system32\dllcache\win32\winlogon.exe
                  C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\OCBNEXFH.exe

                  Merci.

                  A+
                  1. kevinr166
                    D'accord je l'ai fait voici le rapport fixwareout :

                    Username "HP_Propriétaire" - 10/11/2007 15:45:03 [Fixwareout edited 9/01/2007]

                    ~~~~~ Prerun check

                    Cache de résolution DNS vidé.

                    System was rebooted successfully.

                    ~~~~~ Postrun check
                    HKLM\SOFTWARE\~\Winlogon\ "System"="lsass.exe"
                    ....
                    ....
                    ~~~~~ Misc files.
                    ....
                    ~~~~~ Checking for older varients.
                    ....

                    ~~~~~ Current runs (hklm hkcu "run" Keys Only)
                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
                    "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
                    "HPHUPD06"="c:\\Program Files\\HP\\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\\hphupd06.exe"
                    "h3yb0y"="C:\\WINDOWS\\SYSTEM32\\DRIVERS\\etc\\LSASS.exe C:\\WINDOWS\\SYSTEM32\\DRIVERS\\etc\\service.exe C:\\WINDOWS\\SYSTEM32\\DRIVERS\\etc\\conf.dll"
                    "h3yb0y1"="C:\\WINDOWS\\SYSTEM32\\DRIVERS\\etc\\LSASS.exe C:\\WINDOWS\\SYSTEM32\\DRIVERS\\etc\\system.exe C:\\WINDOWS\\SYSTEM32\\DRIVERS\\etc\\serv-u.ini"
                    "WOOWATCH"="C:\\PROGRA~1\\Wanadoo\\Watch.exe"
                    "helpr"="C:\\Program Files\\SETI\\helper.exe -loader -nolog"
                    "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
                    "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
                    "AlcxMonitor"="ALCXMNTR.EXE"
                    "PS2"="C:\\WINDOWS\\system32\\ps2.exe"
                    "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
                    "HPHmon06"="C:\\WINDOWS\\system32\\hphmon06.exe"
                    "Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"
                    "Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
                    "UnlockerAssistant"="\"C:\\Program Files\\Unlocker\\UnlockerAssistant.exe\""

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "PCShield"="regsvr32 /s \"C:\\WINDOWS\\system32\\sfg.dll\""
                    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
                    "STYLEXP"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide"
                    "CursorXP"="C:\\Program Files\\CursorXP\\CursorXP.exe"
                    "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"
                    "SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
                    ....
                    Hosts file was reset, If you use a custom hosts file please replace it...
                    C:\WINDOWS\System32\AUTOEXEC.NT missing
                    ~~~~~ End report ~~~~~

                    Et le rapport hijack this :

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 15:59:14, on 10/11/2007
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                    C:\WINDOWS\System32\FTRTSVC.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\WINDOWS\system32\nvsvc32.exe
                    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                    C:\WINDOWS\system32\tcpsvcs.exe
                    C:\WINDOWS\System32\snmp.exe
                    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    C:\WINDOWS\system32\LVCOMSX.EXE
                    C:\windows\system\hpsysdrv.exe
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\WINDOWS\system32\hphmon06.exe
                    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                    C:\Program Files\CursorXP\CursorXP.exe
                    C:\Program Files\Windows Media Player\WMPNSCFG.exe
                    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                    C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
                    C:\Program Files\Internet Explorer\IEXPLORE.EXE
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 255.255.255.255
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 255.255.255.255:80
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: (no name) - <default> - (no file)
                    R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
                    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
                    O2 - BHO: (no name) - {65D5A3B2-859E-42F5-AE9E-BC6D7EC1B0EB} - C:\WINDOWS\system32\VBA232.DLL (file missing)
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O2 - BHO: ADefaultSearch Class - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Program Files\Accoona\ASearchAssist.dll (file missing)
                    O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                    O2 - BHO: (no name) - {B7531CF3-3DBE-4D68-BED9-E3697F3CDC9B} - C:\WINDOWS\system32\dplay32.dll (file missing)
                    O2 - BHO: (no name) - {C2EA6A7E-79FC-4CFB-90E4-898C742B44C5} - C:\WINDOWS\system32\mobsyncd.dll (file missing)
                    O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
                    O2 - BHO: (no name) - {F3E3A0A8-906B-47D7-8E5E-8C7F1D3C0BDC} - C:\WINDOWS\system32\ulib32.dll (file missing)
                    O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll (file missing)
                    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
                    O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
                    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
                    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
                    O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
                    O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                    O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
                    O4 - HKLM\..\Run: [h3yb0y] C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\service.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\conf.dll
                    O4 - HKLM\..\Run: [h3yb0y1] C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\system.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\serv-u.ini
                    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                    O4 - HKLM\..\Run: [helpr] C:\Program Files\SETI\helper.exe -loader -nolog
                    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
                    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
                    O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\system32\sfg.dll"
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
                    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
                    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
                    O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                    O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                    O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
                    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
                    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                    O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com/resources/MsnPUpld.cab
                    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586-jc.cab
                    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                    O17 - HKLM\System\CCS\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer = 192.168.1.1
                    O20 - AppInit_DLLs: . 3 SF3.DLL,noxizaca.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
                    O21 - SSODL: bxsbang - {D117607A-ED64-4810-9909-CD719374EE12} - C:\WINDOWS\bxsbang.dll (file missing)
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
                    O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                    O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
                    O23 - Service: Noxizac Service (NoxizacSrv) - Unknown owner - C:\WINDOWS\system32\noxizac.exe (file missing)
                    O23 - Service: NTSVCMGR - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe (file missing)
                    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                    O23 - Service: OCBNEXFH - Unknown owner - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\OCBNEXFH.exe (file missing)
                    O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
                    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
                    1. Regis59 Contributeur sécurité
                      Re,

                      Télécharge le FixWareout sur le bureau:
                      http://download.bleepingcomputer.com/lonny/Fixwareout.exe

                      Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
                      Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

                      Quand ton système aura redémarré, suis les invites des messages. Ensuite lance HijackThis. Clique sur Scan et coche les lignes suivantes:

                      O17 - HKLM\System\CCS\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer = 85.155.115.94,85.155.118.94
                      O17 - HKLM\System\CS5\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer = 85.155.115.94,85.155.118.94
                      O17 - HKLM\System\CS6\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer = 85.155.115.94,85.155.118.94

                      Clique sur Fix Checked. Ferme HijackThis et clique sur OK pour continuer la procédure.

                      A la fin du fix, tu auras peut-être encore besoin de redémarrer le PC.

                      Au final, poste le contenu de C:\fixwareout\report.txt avec un nouveau rapport HijackThis.

                      A+
                      1. kevinr166
                        Ok c'est fait voila le rapport smitfraudfix :

                        SmitFraudFix v2.248

                        Rapport fait à 12:34:47.42, 10/11/2007
                        Executé à partir de C:\Documents and Settings\HP_Propriétaire\Bureau\SmitfraudFix
                        OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                        Le type du système de fichiers est NTFS
                        Fix executé en mode normal

                        »»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

                        Description: Sagem XG703 USB 802.11g - Miniport d'ordonnancement de paquets
                        DNS Server Search Order: 192.168.1.1

                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer=85.155.115.94,85.155.118.94
                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=192.168.1.1
                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=208.67.220.220,208.67.222.222
                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=208.67.220.220,208.67.222.222
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0

                        »»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

                        Description: Sagem XG703 USB 802.11g - Miniport d'ordonnancement de paquets
                        DNS Server Search Order: 192.168.1.1

                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer=85.155.115.94,85.155.118.94
                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=192.168.1.1
                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=208.67.220.220,208.67.222.222
                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=208.67.220.220,208.67.222.222
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                        HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
                        HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0

                        Ainsi que le rapport hijackthis :

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 12:37:50, on 10/11/2007
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                        C:\WINDOWS\System32\FTRTSVC.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        C:\WINDOWS\system32\nvsvc32.exe
                        C:\WINDOWS\system32\tcpsvcs.exe
                        C:\WINDOWS\System32\snmp.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        C:\Program Files\CursorXP\CursorXP.exe
                        C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
                        C:\Program Files\Shareaza\Shareaza.exe
                        C:\WINDOWS\EXPLORER.EXE
                        C:\Program Files\eMule\emule.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Internet Explorer\IEXPLORE.EXE
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 255.255.255.255
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 255.255.255.255:80
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: (no name) - <default> - (no file)
                        R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
                        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
                        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
                        O2 - BHO: (no name) - {65D5A3B2-859E-42F5-AE9E-BC6D7EC1B0EB} - C:\WINDOWS\system32\VBA232.DLL (file missing)
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: ADefaultSearch Class - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Program Files\Accoona\ASearchAssist.dll (file missing)
                        O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                        O2 - BHO: (no name) - {B7531CF3-3DBE-4D68-BED9-E3697F3CDC9B} - C:\WINDOWS\system32\dplay32.dll (file missing)
                        O2 - BHO: (no name) - {C2EA6A7E-79FC-4CFB-90E4-898C742B44C5} - C:\WINDOWS\system32\mobsyncd.dll (file missing)
                        O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
                        O2 - BHO: (no name) - {F3E3A0A8-906B-47D7-8E5E-8C7F1D3C0BDC} - C:\WINDOWS\system32\ulib32.dll (file missing)
                        O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll (file missing)
                        O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
                        O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
                        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
                        O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
                        O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
                        O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
                        O4 - HKLM\..\Run: [h3yb0y] C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\service.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\conf.dll
                        O4 - HKLM\..\Run: [h3yb0y1] C:\WINDOWS\SYSTEM32\DRIVERS\etc\LSASS.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\system.exe C:\WINDOWS\SYSTEM32\DRIVERS\etc\serv-u.ini
                        O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
                        O4 - HKLM\..\Run: [helpr] C:\Program Files\SETI\helper.exe -loader -nolog
                        O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                        O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
                        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                        O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
                        O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\system32\sfg.dll"
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
                        O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
                        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
                        O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                        O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                        O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                        O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
                        O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
                        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                        O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                        O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                        O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com/resources/MsnPUpld.cab
                        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                        O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586-jc.cab
                        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer = 85.155.115.94,85.155.118.94
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer = 192.168.1.1
                        O17 - HKLM\System\CS5\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer = 85.155.115.94,85.155.118.94
                        O17 - HKLM\System\CS6\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer = 85.155.115.94,85.155.118.94
                        O20 - AppInit_DLLs: . 3 SF3.DLL,noxizaca.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
                        O21 - SSODL: bxsbang - {D117607A-ED64-4810-9909-CD719374EE12} - C:\WINDOWS\bxsbang.dll (file missing)
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
                        O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                        O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                        O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                        O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
                        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                        O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                        O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
                        O23 - Service: Noxizac Service (NoxizacSrv) - Unknown owner - C:\WINDOWS\system32\noxizac.exe (file missing)
                        O23 - Service: NTSVCMGR - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe (file missing)
                        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                        O23 - Service: OCBNEXFH - Unknown owner - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\OCBNEXFH.exe (file missing)
                        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
                        O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                        O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
                        1. Regis59 Contributeur sécurité
                          OKay!

                          Choisis l'option 5 de Smitfraudfix puis remet un nouveau HijackThis.

                          A+
                          1. kevinr166
                            Slt, ok c'est fait voici le rapport :

                            SmitFraudFix v2.248

                            Rapport fait à 9:38:51.90, 10/11/2007
                            Executé à partir de C:\Documents and Settings\HP_Propriétaire\Bureau\SmitfraudFix
                            OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                            Le type du système de fichiers est NTFS
                            Fix executé en mode normal

                            »»»»»»»»»»»»»»»»»»»»»»»» Process

                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                            C:\WINDOWS\System32\FTRTSVC.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                            C:\WINDOWS\system32\nvsvc32.exe
                            C:\WINDOWS\system32\tcpsvcs.exe
                            C:\WINDOWS\System32\snmp.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            C:\Program Files\CursorXP\CursorXP.exe
                            C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                            C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
                            C:\Program Files\eMule\emule.exe
                            C:\WINDOWS\explorer.exe
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\WINDOWS\system32\cmd.exe

                            »»»»»»»»»»»»»»»»»»»»»»»» hosts

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propriétaire

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propriétaire\Application Data

                            »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_PRO~1\Favoris

                            »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                            »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                            »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                            »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                            »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            SrchSTS.exe by S!Ri
                            Search SharedTaskScheduler's .dll

                            »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                            "AppInit_DLLs"=". 3 SF3.DLL,noxizaca.dll C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"

                            »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                            "System"="lsass.exe"

                            »»»»»»»»»»»»»»»»»»»»»»»» Rustock

                            »»»»»»»»»»»»»»»»»»»»»»»» DNS

                            Description: Sagem XG703 USB 802.11g - Miniport d'ordonnancement de paquets
                            DNS Server Search Order: 192.168.1.1

                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: NameServer=85.155.115.94,85.155.118.94
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=192.168.1.1
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CCS\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=208.67.220.220,208.67.222.222
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS2\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{0715969B-283B-4E93-8F2C-A4343706CA61}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: DhcpNameServer=192.168.1.1 0.0.0.0
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{14DCEE1F-2437-4031-BA4A-C5A1D2178B73}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{A4936D06-CABB-4B7A-B4A3-C8CD91583420}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{A8BD60E3-62AE-4BF3-BE4B-4DD66B50BFFD}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{BCEA4CCD-5AD7-462A-BC53-19A51F9571AC}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: DhcpNameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS3\Services\Tcpip\..\{D76BD333-1E83-4E68-AF63-C008CBBC9822}: NameServer=85.255.115.94,85.255.112.24
                            HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
                            HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
                            HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                            »»»»»»»»»»»»»»»»»»»»»»»» Fin
                            1. Regis59 Contributeur sécurité
                              Re

                              Rends toi ici:
                              C:\Windows\system32\drivers\etc\
                              Ouvre HOSTS avec le bloc note, supprime tout pour ne laisser que ceci: 

                              # Copyright (c) 1993-1999 Microsoft Corp.
#
# Ceci est un exemple de fichier HOSTS utilisé par Microsoft TCP/IP
# pour Windows.
#
# Ce fichier contient les correspondances des adresses IP aux noms d'hôtes.
# Chaque entrée doit être sur une ligne propre. L'adresse IP doit être placée
# dans la première colonne, suivie par le nom d'hôte correspondant. L'adresse
# IP et le nom d'hôte doivent être séparés par au moins un espace.
#
# De plus, des commentaires (tels que celui-ci) peuvent être insérés sur des
# lignes propres ou après le nom d'ordinateur. Ils sont indiqué par le
# symbole '#'.
#
# Par exemple :
#
#      102.54.94.97     rhino.acme.com          # serveur source
#       38.25.63.10     x.acme.com              # hôte client x

127.0.0.1       localhost


                              Tu relances smitfraudfix option 1 et tu copies colle le rapport.

                              A+
                              1. kevinr166
                                Exact il est réparé!!! merci beaucoup!!ça va beaucoup servir je pense! Ect-ce-qu'il faut que je recommence l'option 2 de smifraudfix en mode sans échec??

                                A+
                                1. Regis59 Contributeur sécurité
                                  Ok, on a réparer le mode sans échec.

                                  Essaie pour voir si cela fonctionne.

                                  A+
                                  1. kevinr166
                                    Slt ok c'est fait voici le rapport :

                                    Reg export of SafeBoot key after repair:
                                    ========================

                                    Windows Registry Editor Version 5.00

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
                                    @="FSFilter System Recovery"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
                                    @="Universal Serial Bus controllers"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
                                    @="CD-ROM Drive"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
                                    @="DiskDrive"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
                                    @="Standard floppy disk controller"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
                                    @="Hdc"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
                                    @="Keyboard"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
                                    @="Mouse"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
                                    @="PCMCIA Adapters"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
                                    @="SCSIAdapter"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
                                    @="System"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
                                    @="Floppy disk drive"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
                                    @="Volume"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
                                    @="Human Interface Devices"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]
                                    @="FSFilter System Recovery"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]
                                    @="Driver Group"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]
                                    @="Driver"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]
                                    @="Service"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
                                    @="Universal Serial Bus controllers"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
                                    @="CD-ROM Drive"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
                                    @="DiskDrive"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
                                    @="Standard floppy disk controller"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
                                    @="Hdc"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
                                    @="Keyboard"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
                                    @="Mouse"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
                                    @="Net"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
                                    @="NetClient"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
                                    @="NetService"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
                                    @="NetTrans"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
                                    @="PCMCIA Adapters"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
                                    @="SCSIAdapter"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
                                    @="System"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
                                    @="Floppy disk drive"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
                                    @="Volume"

                                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
                                    @="Human Interface Devices"

                                    ========================
                                    3. Regis59 Contributeur sécurité
                                      Supprime le crack des sims que tu as téléchargé ! Il est infecté.

                                      ...
                                      • 1
                                      • 2
                                      • 3

                                      Discussions similaires

                                      Softonic,est-ce un virus ?
                                      techmel1

                                      6 réponses
                                      Chrome://newtab
                                      Nova

                                      14 réponses
                                      Désinstaller Softonic
                                      Diguimette

                                      5 réponses
                                      Supprimer New Tab
                                      tysaozon

                                      8 réponses
                                      Bouton pause/break
                                      frans003

                                      3 réponses