Security Toolbar ==> Problème

Résolu
konoha_united -  
Bonjour,
J'ai un petit problème, ayant laissé mon cousin "s'amuser" avec mon pc, je me retrouve avec un prit problème. Je me retrouve, dans la page d'acceuil, une security toolbar sur Internet explorer. Je me retrouve avec tout plein de fenetres intempestives qui veulent mef aire installer je ne sais quoi. Je suis un débutant en matiere d'informatique, et je me retrouve a vous demander de l'aide, parce que la commence a me faire ch... Si une personne au grand coeur pourrait m'aider à résoudre ce problème, je le remercie d'avance :-)

Windows XP
Firefox 2.0.0.9
Configuration: Windows XP
Firefox 2.0.0.9

41 réponses

Résumé de la discussion

Infection logiciel conduit à l'apparition d'une barre de sécurité dans Internet Explorer et à des fenêtres intempestives sur Windows XP, suite à l'usage du PC par un proche. Des solutions proposées incluent l'utilisation d'outils tels que SmitFraudFix et VundoFix, suivies d'opérations en mode sans échec et d'HijackThis pour identifier et supprimer les composants malveillants. La procédure détaille des étapes successives, des avertissements sur les faux positifs des antivirus, et demande la génération de rapports avant un redémarrage, avec une progression documentée par des rapports de réparation.

Bobot (l’IA à votre service)
  1. espion3004
    Crées toi un post, ce problème est résolu, personne ne viendra te donner un coup de main...
    1. fab
      je viens de lire les problemes de konoha_united et j'ai le meme probleme alors comment faire
      2. konoha_united Auteur
        Pour mon pc ca va, je ne suis plus redirigé vers un site ou l'on me demande d'installe des logiciels bizarres, il faut juste que je change ma page d'acceuil. J'ai l'impression que tout est rentré dans l'ordre. J'espère que c'est le cas ...
        1. ^^Marie^^
          Ok

          Change ta page d' accueil
          Et on voit dans dans 1/2 jours si tout roule

          A++
      5. konoha_united Auteur
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 19:07:15, on 26/11/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16544)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
        c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
        C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
        C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
        c:\APPS\HIDSERVICE\HIDSERVICE.exe
        C:\WINDOWS\system32\HPZipm12.exe
        C:\WINDOWS\system32\slserv.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        c:\APPS\Powercinema\Kernel\TV\CLSched.exe
        C:\Program Files\Microsoft LifeChat\LifeChat.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\PROGRA~1\MSNMES~1\DEVICE~1\msgrdvmn.exe
        C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
        C:\Program Files\MSN Messenger\msnmsgr.exe
        C:\Program Files\Windows Media Player\wmplayer.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\Program Files\MSN Messenger\usnsvc.exe
        C:\Program Files\MSN Messenger\livecall.exe
        C:\Documents and Settings\Zakaria\Bureau\HijackThis.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
        O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
        O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
        O4 - HKLM\..\Run: [LifeChat] "C:\Program Files\Microsoft LifeChat\LifeChat.exe"
        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
        O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
        O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [WindowsLivePhone] "C:\PROGRA~1\MSNMES~1\DEVICE~1\msgrdvmn.exe" /AutoRun
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
        O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
        O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
        O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
        O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
        O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
        O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\befr.htm
        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
        O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://www.msn.com/fr-fr/
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-BE/a-UNO1/GAME_UNO1.cab
        O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
        O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
        O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
        O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
        1. ^^Marie^^
          OK

          Supprime CleanZip

          Comment se comporte ton PC ?

          Refais moi un log Hijackthis

          A++
          1. konoha_united Auteur
            Script execute en mode sans echec
            Rapport clean par Malekal_morte - http://www.malekal.com
            Script execute en mode sans echec lun. 26/11/2007 a 18:48:41,12

            Microsoft Windows XP [version 5.1.2600]

            *** Suppression des fichiers dans C:

            *** Suppression des fichiers dans C:\WINDOWS\
            tentative de suppression de C:\WINDOWS\smdat32m.sys

            *** Suppression des fichiers dans C:\WINDOWS\system32
            tentative de suppression de C:\WINDOWS\system32\ccApp.exe
            tentative de suppression de C:\WINDOWS\system32\f3PSSavr.scr
            tentative de suppression de "C:\WINDOWS\system32\P2P Networking v126.cpl"
            tentative de suppression de C:\WINDOWS\system32\ustart.exe
            tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1"

            *** Suppression des fichiers dans C:\Program Files
            tentative de suppression de "C:\Program Files\Dynamic Toolbar\"

            *** Suppression des clefs du registre effectuee..
            *** Fin du rapport !
            1. ^^Marie^^
              Salut

              Par rapport au poste <31>

              Redémarre ton PC en mode sans échec :
              Redémarre en mode sans échec (Pour cela : démarrer le PC en tapotant sur la touche F8 du clavier jusqu'à ce que le menu des options avancées de Windows apparaisse puis avec les touches fléchées du clavier, sélectionner Mode sans échec puis appuyer sur la touche Entrée...)
              Double-clic sur clean. Cela va ouvrir une fenêtre noire.
              Un menu va apparaître, choisis l'option 2 en appuyant sur la touche 2 de ton clavier.
              Clean va travailler.
              Un rapport Va etre généré, envoie le moi dans ta prochaine réponse !
              1. konoha_united Auteur
                C:\WINDOWS\System32\wpa.dbl -->23/11/2007 15:10:21
                C:\WINDOWS\System32\tmp.txt -->22/11/2007 19:26:39
                C:\WINDOWS\System32\tmp.reg -->22/11/2007 19:26:39
                C:\WINDOWS\System32\satsukidecodersettings.ini -->19/11/2007 14:39:44
                C:\WINDOWS\System32\FNTCACHE.DAT -->19/11/2007 13:07:32
                C:\WINDOWS\System32\MRT.exe -->2/11/2007 8:12:57
                C:\WINDOWS\System32\xpsp3res.dll -->29/10/2007 16:35:14
                C:\WINDOWS\System32\perfh00C.dat -->29/10/2007 16:04:14
                C:\WINDOWS\System32\perfh009.dat -->29/10/2007 16:04:13
                C:\WINDOWS\System32\perfc00C.dat -->29/10/2007 16:04:13
                C:\WINDOWS\System32\perfc009.dat -->29/10/2007 16:04:13
                C:\WINDOWS\System32\PerfStringBackup.INI -->29/10/2007 16:04:11
                C:\WINDOWS\System32\shell32.dll -->25/10/2007 17:56:24
                C:\WINDOWS\System32\WS2Fix.exe -->3/10/2007 23:36:46
                C:\WINDOWS\System32\uxtheme.dll -->8/09/2007 17:31:52
                C:\WINDOWS\System32\VCCLSID.exe -->5/09/2007 23:22:23
                C:\WINDOWS\System32\TZLog.log -->30/08/2007 11:38:50
                C:\WINDOWS\System32\inetcomm.dll -->21/08/2007 7:17:23
                C:\WINDOWS\System32\wininet.dll -->20/08/2007 10:59:31
                C:\WINDOWS\System32\webcheck.dll -->20/08/2007 10:59:31
                C:\WINDOWS\System32\urlmon.dll -->20/08/2007 10:59:31
                C:\WINDOWS\System32\url.dll -->20/08/2007 10:59:31
                C:\WINDOWS\System32\occache.dll -->20/08/2007 10:59:31
                C:\WINDOWS\System32\mstime.dll -->20/08/2007 10:59:30
                C:\WINDOWS\System32\msrating.dll -->20/08/2007 10:59:30

                C:\WINDOWS\WindowsUpdate.log -->23/11/2007 18:31:51
                C:\WINDOWS\NeroDigital.ini -->23/11/2007 16:14:53
                C:\WINDOWS\0.log -->23/11/2007 13:46:44
                C:\WINDOWS\wiadebug.log -->23/11/2007 13:46:24
                C:\WINDOWS\wiaservc.log -->23/11/2007 13:46:11
                C:\WINDOWS\bootstat.dat -->23/11/2007 13:45:40
                C:\WINDOWS\SchedLgU.Txt -->23/11/2007 13:44:37
                C:\WINDOWS\win.ini -->22/11/2007 19:54:46
                C:\WINDOWS\system.ini -->22/11/2007 19:54:46
                C:\WINDOWS\setupact.log -->22/11/2007 19:26:44
                C:\WINDOWS\setuperr.log -->22/11/2007 18:49:30
                C:\WINDOWS\AviSplitter.INI -->25/10/2007 21:45:32
                C:\WINDOWS\photo album.zip -->9/10/2007 22:44:05
                C:\WINDOWS\news95.zip -->9/10/2007 22:44:03
                C:\WINDOWS\news80.zip -->9/10/2007 22:44:01

                ( Par clean uptload )
                1. konoha_united Auteur
                  catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2007-11-23 19:12:31
                  Windows 5.1.2600 Service Pack 2 NTFS

                  scanning hidden processes ...

                  scanning hidden services & system hive ...

                  scanning hidden registry entries ...

                  scanning hidden files ...

                  C:\Documents and Settings\Zakaria\Local Settings\Application Data\Microsoft\Messenger\nightfire00766@hotmail.com\SharingMetadata\sarrah_la_miss@hotmail.com\DFSR\Staging\CS{731CF1D2-02D8-4335-CF74-A11BCD2B630C}\01\36-{731CF1D2-02D8-4335-CF74-A11BCD2B630C}-v1-{6C2312F9-320D-4642-A4F0-87164D5AE1C9}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

                  scan completed successfully
                  hidden processes: 0
                  hidden services: 0
                  hidden files: 1
                  1. konoha_united Auteur
                    SDFix: Version 1.115

                    Run by Zakaria on ven. 23/11/2007 at 18:51

                    Microsoft Windows XP [version 5.1.2600]

                    Running From: C:\SDFix

                    Safe Mode:
                    Checking Services:

                    Restoring Windows Registry Values
                    Restoring Windows Default Hosts File

                    Rebooting...

                    Normal Mode:
                    Checking Files:

                    Trojan Files Found:

                    C:\WINDOWS\downloadme15.zip - Deleted
                    C:\WINDOWS\downloadme21.zip - Deleted
                    C:\WINDOWS\downloadme24.zip - Deleted
                    C:\WINDOWS\downloadme3.zip - Deleted
                    C:\WINDOWS\downloadme39.zip - Deleted
                    C:\WINDOWS\downloadme51.zip - Deleted
                    C:\WINDOWS\downloadme54.zip - Deleted
                    C:\WINDOWS\downloadme66.zip - Deleted
                    C:\WINDOWS\downloadme72.zip - Deleted
                    C:\WINDOWS\downloadme84.zip - Deleted
                    C:\WINDOWS\downloadme93.zip - Deleted
                    C:\WINDOWS\downloadme96.zip - Deleted
                    C:\WINDOWS\file13.zip - Deleted
                    C:\WINDOWS\file16.zip - Deleted
                    C:\WINDOWS\file25.zip - Deleted
                    C:\WINDOWS\file28.zip - Deleted
                    C:\WINDOWS\file31.zip - Deleted
                    C:\WINDOWS\file34.zip - Deleted
                    C:\WINDOWS\file49.zip - Deleted
                    C:\WINDOWS\file64.zip - Deleted
                    C:\WINDOWS\file70.zip - Deleted
                    C:\WINDOWS\file73.zip - Deleted
                    C:\WINDOWS\file79.zip - Deleted
                    C:\WINDOWS\file82.zip - Deleted
                    C:\WINDOWS\files1.zip - Deleted
                    C:\WINDOWS\files13.zip - Deleted
                    C:\WINDOWS\files22.zip - Deleted
                    C:\WINDOWS\files28.zip - Deleted
                    C:\WINDOWS\files31.zip - Deleted
                    C:\WINDOWS\files34.zip - Deleted
                    C:\WINDOWS\files37.zip - Deleted
                    C:\WINDOWS\files43.zip - Deleted
                    C:\WINDOWS\files49.zip - Deleted
                    C:\WINDOWS\files58.zip - Deleted
                    C:\WINDOWS\files61.zip - Deleted
                    C:\WINDOWS\files7.zip - Deleted
                    C:\WINDOWS\files73.zip - Deleted
                    C:\WINDOWS\files79.zip - Deleted
                    C:\WINDOWS\files94.zip - Deleted
                    C:\WINDOWS\JPGimage2.zip - Deleted
                    C:\WINDOWS\JPGimage20.zip - Deleted
                    C:\WINDOWS\JPGimage23.zip - Deleted
                    C:\WINDOWS\JPGimage32.zip - Deleted
                    C:\WINDOWS\JPGimage56.zip - Deleted
                    C:\WINDOWS\JPGimage65.zip - Deleted
                    C:\WINDOWS\JPGimage68.zip - Deleted
                    C:\WINDOWS\JPGimage77.zip - Deleted
                    C:\WINDOWS\JPGimage8.zip - Deleted
                    C:\WINDOWS\JPGimage80.zip - Deleted
                    C:\WINDOWS\JPGimage83.zip - Deleted
                    C:\WINDOWS\JPGimage89.zip - Deleted
                    C:\WINDOWS\look12.zip - Deleted
                    C:\WINDOWS\look15.zip - Deleted
                    C:\WINDOWS\look18.zip - Deleted
                    C:\WINDOWS\look24.zip - Deleted
                    C:\WINDOWS\look30.zip - Deleted
                    C:\WINDOWS\look36.zip - Deleted
                    C:\WINDOWS\look39.zip - Deleted
                    C:\WINDOWS\look42.zip - Deleted
                    C:\WINDOWS\look45.zip - Deleted
                    C:\WINDOWS\look51.zip - Deleted
                    C:\WINDOWS\look54.zip - Deleted
                    C:\WINDOWS\look66.zip - Deleted
                    C:\WINDOWS\look69.zip - Deleted
                    C:\WINDOWS\look78.zip - Deleted
                    C:\WINDOWS\look81.zip - Deleted
                    C:\WINDOWS\news14.zip - Deleted
                    C:\WINDOWS\news17.zip - Deleted
                    C:\WINDOWS\news2.zip - Deleted
                    C:\WINDOWS\news38.zip - Deleted
                    C:\WINDOWS\news41.zip - Deleted
                    C:\WINDOWS\news47.zip - Deleted
                    C:\WINDOWS\news50.zip - Deleted
                    C:\WINDOWS\news53.zip - Deleted
                    C:\WINDOWS\news59.zip - Deleted
                    C:\WINDOWS\news62.zip - Deleted
                    C:\WINDOWS\news68.zip - Deleted
                    C:\WINDOWS\news71.zip - Deleted
                    C:\WINDOWS\news74.zip - Deleted
                    C:\WINDOWS\news80.zip - Deleted
                    C:\WINDOWS\news95.zip - Deleted
                    C:\WINDOWS\photo album.zip - Deleted

                    Removing Temp Files...

                    ADS Check:

                    C:\WINDOWS
                    No streams found.

                    C:\WINDOWS\system32
                    No streams found.

                    C:\WINDOWS\system32\svchost.exe
                    No streams found.

                    C:\WINDOWS\system32\ntoskrnl.exe
                    No streams found.

                    Final Check:

                    catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2007-11-23 19:12:31
                    Windows 5.1.2600 Service Pack 2 NTFS

                    scanning hidden processes ...

                    scanning hidden services & system hive ...

                    scanning hidden registry entries ...

                    scanning hidden files ...

                    C:\Documents and Settings\Zakaria\Local Settings\Application Data\Microsoft\Messenger\nightfire00766@hotmail.com\SharingMetadata\sarrah_la_miss@hotmail.com\DFSR\Staging\CS{731CF1D2-02D8-4335-CF74-A11BCD2B630C}\01\36-{731CF1D2-02D8-4335-CF74-A11BCD2B630C}-v1-{6C2312F9-320D-4642-A4F0-87164D5AE1C9}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

                    scan completed successfully
                    hidden processes: 0
                    hidden services: 0
                    hidden files: 1

                    Remaining Services:
                    ------------------

                    Authorized Application Key Export:

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
                    "C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"="C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe:*:Enabled:P2P Networking"
                    "%windir%\\system32\\ccapp.exe"="%windir%\\system32\\ccapp.exe:*:Enabled:System Process"
                    "C:\\Program Files\\Warez P2P Client\\warez.exe"="C:\\Program Files\\Warez P2P Client\\warez.exe:*:Enabled:warez"
                    "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
                    "C:\\Program Files\\Steam\\SteamApps\\makiavili@hotmail.com\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\makiavili@hotmail.com\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
                    "C:\\Program Files\\Steam\\SteamApps\\makiavili@hotmail.com\\half-life\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\makiavili@hotmail.com\\half-life\\hl.exe:*:Enabled:Half-Life Launcher"
                    "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
                    "C:\\Program Files\\Steam\\SteamApps\\nightfire00766\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\nightfire00766\\counter-strike source\\hl2.exe:*:Enabled:hl2"
                    "C:\\Program Files\\Steam\\SteamApps\\nightfire00766\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\nightfire00766\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
                    "C:\\Program Files\\Shareaza\\Shareaza.exe"="C:\\Program Files\\Shareaza\\Shareaza.exe:*:Enabled:Shareaza"
                    "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
                    "C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Ex‚cuter une DLL en tant qu'application"
                    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
                    "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe"="C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
                    "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget"
                    "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"="C:\\Program Files\\TVUPlayer\\TVUPlayer.exe:*:Enabled:TVU Player Component"
                    "C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
                    "C:\\Documents and Settings\\Zakaria\\Application Data\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Settings\\Zakaria\\Application Data\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
                    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
                    "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
                    "C:\\Program Files\\PPStream\\PPStream.exe"="C:\\Program Files\\PPStream\\PPStream.exe:*:Enabled:PPStream"
                    "C:\\Program Files\\TVAnts\\Tvants.exe"="C:\\Program Files\\TVAnts\\Tvants.exe:*:Enabled:TVAnts"
                    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
                    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
                    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
                    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

                    Remaining Files:
                    ---------------

                    File Backups: - C:\SDFix\backups\backups.zip

                    Files with Hidden Attributes:

                    Tue 30 Aug 2005 215 A.SHR --- "C:\BOOT.BAK"
                    Tue 20 Jun 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
                    Mon 25 Jun 2007 61,440 A..H. --- "C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP449\A0457959.dll"
                    Sun 19 Mar 2006 262,144 A.SH. --- "C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP449\A0457960.exe"
                    Fri 6 Apr 2007 10,752 A..H. --- "C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP457\A0458602.dll"
                    Mon 25 Jun 2007 61,440 A..H. --- "C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP457\A0458603.dll"
                    Mon 18 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
                    Thu 20 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\778fd2fc3fe6b905e366b5ddbba384c8\BIT3B.tmp"
                    Tue 20 Jun 2006 4,348 A..H. --- "C:\Documents and Settings\Zakaria\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
                    Tue 20 Jun 2006 20 A..H. --- "C:\Documents and Settings\Zakaria\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
                    Fri 4 Nov 2005 312 A.SH. --- "C:\Documents and Settings\Zakaria\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

                    Finished!
                    1. konoha_united Auteur
                      Voila ce qui le rapport généré par Clean, maintenant je fais en mode sans Echec.

                      ven. 23/11/2007 a 18:35:07,20

                      *** Recherche des fichiers dans C:

                      *** Recherche des fichiers dans C:\WINDOWS\
                      C:\WINDOWS\smdat32m.sys FOUND
                      "C:\WINDOWS\photo album.zip" FOUND

                      *** Recherche des fichiers dans C:\WINDOWS\system32
                      C:\WINDOWS\system32\ccApp.exe FOUND
                      C:\WINDOWS\system32\f3PSSavr.scr FOUND
                      "C:\WINDOWS\system32\P2P Networking v126.cpl" FOUND
                      C:\WINDOWS\system32\ustart.exe FOUND
                      "C:\WINDOWS\Downloaded Program Files\CONFLICT.1" FOUND

                      *** Recherche des fichiers dans C:\Program Files
                      "C:\Program Files\Dynamic Toolbar\" FOUND
                      1. konoha_united Auteur
                        Je ferais ça tantot, la je suis en pleine pause de midi ... Des que je reviens dés cours, je m'y met. Merci en tout cas pour votre patience ^^
                        1. ^^Marie^^
                          Slut

                          rajout du lien SdFix
                          Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
                          http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
                          1. espion3004
                            ok, bon travail

                            Supprime smthfraud et vide la poubelle..

                            ================

                            Télécharge sur ton bureau Clean (zip) :http://www.malekal.com/download/clean.zip
                            = Clic droit sur Clean.zip et Extraire ici ( ou extraire sans confirmation ou tout ou unzip)
                            =double-clic Dossier Clean
                            = double-clic Clean. ( avec comme symbole une roue dentée)
                            = Option 1 = taper 1
                            = copier/coller le rapport dans la réponse

                            =================
                            Redémarre en mode Sans Échec

                            (au démarrage, tapote immédiatement la touche F8), puis tu verras un écran avec choix de démarrages :
                            choisis Mode sans échec avec les flèches du clavier, puis valide avec Entrée.
                            Choisis ton compte usuel (et non Administrateur).

                            Double-cliquez sur SDFix.exe pour lancer l'installation.
                            Cliquez sur Install : cela va créer un dossier (à la racine du disque dur par défaut) nommé SDFix.
                            Il est indispensable d'effectuer le nettoyage avec SDFix en mode sans échec.
                            Une fois en mode sans échec, double-cliquez sur RunThis.bat
                            Tapez Y puis appuyez sur la touche Entrée de votre clavier, afin de lancer le nettoyage !
                            SDFix va procéder au nettoyage, soyez patient...
                            Appuyez sur une touche de votre clavier pour redémarrer le PC.
                            Au redémarrage de votre PC, SDFix vous indique que le nettoyage est terminé.
                            Appuyez sur une touche de votre clavier afin d'ouvrir le rapport créé par SDFix.

                            FAire copie du rapport effectué..Donc tu nous transmettras 2 rapports SDFIX + CleanZIP...
                            1. konoha_united Auteur
                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 22:01:22, on 22/11/2007
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\Ati2evxx.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\WINDOWS\system32\Ati2evxx.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
                              c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
                              C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
                              C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
                              c:\APPS\HIDSERVICE\HIDSERVICE.exe
                              C:\WINDOWS\system32\slserv.exe
                              C:\WINDOWS\system32\svchost.exe
                              c:\APPS\Powercinema\Kernel\TV\CLSched.exe
                              C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                              C:\Program Files\Microsoft LifeChat\LifeChat.exe
                              C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                              C:\Program Files\MSN Messenger\MsnMsgr.Exe
                              C:\Program Files\Google\Google Talk\googletalk.exe
                              C:\PROGRA~1\MSNMES~1\DEVICE~1\msgrdvmn.exe
                              C:\WINDOWS\system32\sistray.exe
                              C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                              C:\Program Files\MSN Messenger\usnsvc.exe
                              C:\Program Files\MSN Messenger\livecall.exe
                              C:\Program Files\MSN Messenger\msnmsgr.exe
                              C:\Program Files\Windows Media Player\wmplayer.exe
                              C:\Program Files\MSN Messenger\msnmsgr.exe
                              C:\Program Files\MSN Messenger\msnmsgr.exe
                              C:\Program Files\Mozilla Firefox\firefox.exe
                              C:\Program Files\FlashGet\flashget.exe
                              C:\HiJackThis\HijackThis.exe

                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                              O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                              O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                              O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
                              O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
                              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                              O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                              O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                              O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
                              O4 - HKLM\..\Run: [LifeChat] "C:\Program Files\Microsoft LifeChat\LifeChat.exe"
                              O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
                              O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                              O4 - HKLM\..\Run: [seekmo] "c:\program files\seekmo\seekmo.exe"
                              O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                              O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                              O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
                              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                              O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
                              O4 - HKCU\..\Run: [WindowsLivePhone] "C:\PROGRA~1\MSNMES~1\DEVICE~1\msgrdvmn.exe" /AutoRun
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                              O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                              O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
                              O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
                              O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
                              O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
                              O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
                              O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
                              O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing)
                              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\befr.htm
                              O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                              O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://www.msn.com/fr-fr/
                              O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                              O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-BE/a-UNO1/GAME_UNO1.cab
                              O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                              O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                              O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                              O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                              O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
                              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                              O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                              O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
                              O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
                              O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
                              O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
                              O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                              O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                              O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                              1. ^^Marie^^
                                F - Hijackthis - Outil de diagnostic et réparation
                                télécharge HijackThis ici:
                                http://telechargement.zebulon.fr/138-hijackthis-1991.html
                                Dézippe le dans un dossier prévu à cet effet.
                                Par exemple C:\hijackthis < Enregistre le bien dans c : !
                                Démo : (Merci a Balltrap34 pour cette réalisation)
                                http://pageperso.aol.fr/balltrap34/Hijenr.gif
                                Lance le puis:
                                clique sur "do a system scan and save logfile" (cf démo)
                                faire un copier coller du log entier sur le forum
                                Démo : (Merci a Balltrap34 pour cette réalisation)
                                http://pageperso.aol.fr/balltrap34/demohijack.htm
                                http://www.tutoriaux-excalibur.com/hijackthis.htm
                                https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

                                Bon courage

                                A+
                                2. konoha_united Auteur
                                  VundoFix V6.6.2

                                  Checking Java version...

                                  Java version is 1.4.2.5
                                  Old versions of java are exploitable and should be removed.

                                  Java version is 1.5.0.6
                                  Old versions of java are exploitable and should be removed.

                                  Scan started at 18:49:00 21/11/2007

                                  Listing files found while scanning....

                                  No infected files were found.

                                  Beginning removal...

                                  VundoFix V6.6.2

                                  Checking Java version...

                                  Java version is 1.4.2.5
                                  Old versions of java are exploitable and should be removed.

                                  Java version is 1.5.0.6
                                  Old versions of java are exploitable and should be removed.

                                  Scan started at 19:25:19 21/11/2007

                                  Listing files found while scanning....

                                  No infected files were found.

                                  Beginning removal...

                                  Beginning removal...

                                  VundoFix V6.6.2

                                  Checking Java version...

                                  Java version is 1.4.2.5
                                  Old versions of java are exploitable and should be removed.

                                  Java version is 1.5.0.6
                                  Old versions of java are exploitable and should be removed.

                                  Scan started at 0:03:09 22/11/2007

                                  Listing files found while scanning....

                                  No infected files were found.

                                  Beginning removal...

                                  VundoFix V6.6.2

                                  Checking Java version...

                                  Java version is 1.4.2.5
                                  Old versions of java are exploitable and should be removed.

                                  Java version is 1.5.0.6
                                  Old versions of java are exploitable and should be removed.

                                  Scan started at 18:12:09 22/11/2007

                                  Listing files found while scanning....

                                  No infected files were found.

                                  Beginning removal...

                                  VundoFix V6.6.2

                                  Checking Java version...

                                  Java version is 1.4.2.5
                                  Old versions of java are exploitable and should be removed.

                                  Java version is 1.5.0.6
                                  Old versions of java are exploitable and should be removed.

                                  Scan started at 19:34:38 22/11/2007

                                  Listing files found while scanning....

                                  No infected files were found.

                                  Beginning removal...
                                  • 1
                                  • 2
                                  • 3

                                  Discussions similaires

                                  Security boot fail lors du démarrage
                                  Steu

                                  5 réponses
                                  SecurityHealth est a désactiver ou pas au démarrage de W10 Pro 64 ?
                                  Walti55

                                  2 réponses
                                  Comment retirer le SECURE BOOT ?
                                  Elparigo60

                                  10 réponses
                                  Security Boot Fail Windows 10 Acer
                                  benjamin5800

                                  22 réponses
                                  Fiabilitè de SECURIBOX
                                  natatatanka

                                  38 réponses