Rapport HijackThis

http://siri.urz.free.fr/Fix/SmitfraudFix.php

1. Avant toute chose installer un pare-feu personnel du type ZoneAlarm ou Sunbelt Personal Firewall pour fermer la porte aux intrus sur l'ordinateur.

2. Désactiver le service d'affichage des messages en ouvrant le panneau de configuration et en choisissant "Outils d'administration" (dans certains cas il sera nécessaire de cliquer sur "Basculer vers l'affichage classique" pour faire apparaître cet item). Cliquer sur "Services" puis double-cliquer sur "Affichage des messages" et enfin choisir à type de démarrage "Désactivé".

3. Désactiver la restauration système en cliquant avec le bouton droit sur le Poste de travail et en choisissant Propriétés. Dans l'onglet Restauration du système cocher "Désactiver la restauration du système sur tous les lecteurs". Cliquer sur OK pour confirmer.

4.Télécharger Smitfraudfix par S!RI :
Décompresser l'archive
Exécuter le en double cliquant sur Smitfraudfix.cmd
Appuyer sur une touche pour continuer
Arriver à l'invite de commande, saisir la lettre L afin de basculer le fix en langue française
Au menu, choisir l’option 4 puis 1 : Recherche
Poster le rapport ainsi généré dans le forum Virus/Sécurité (ou le cas échéant à la suite de votre message) :

Quelqu'un pour m'aider please ?

Bonjour,

j'utilise mon ancien topic parce qu'il m'arrive la même chose que l'autre fois. Mon PC s'est remit à ramer depuis quelques jours (j'ai choper un Trojan Horse y a pas longtemps il me semble) donc j'ai fait un rapport HijackThis que voilà:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:06:15, on 02/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\TuneUp Utilities 2008\RegistryCleaner.exe
C:\WINDOWS\System32\TuneUpDefragService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: {772df20e-6405-b239-fda4-be465c509a40} - {04a905c5-64eb-4adf-932b-5046e02fd277} - C:\WINDOWS\system32\hrypjf.dll
O2 - BHO: (no name) - {09B5AD46-3482-42BA-8A3D-42800724E8AC} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {79163723-7935-46BE-90CE-C9E9719F8C66} - C:\WINDOWS\system32\xxyyYQJC.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CA1E333-FF60-4447-B5F9-744B87CD9DC3} - (no file)
O2 - BHO: (no name) - {A932137A-CBEF-41E7-AF89-9D6764414F27} - C:\WINDOWS\system32\khfCuTjG.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {B2FA7AAF-D101-4069-9799-03D032685361} - (no file)
O2 - BHO: (no name) - {C58AFC8C-B1C6-4D83-84AD-606A489B3A3D} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [sLSBSurD8k] C:\Documents and Settings\All Users\Application Data\ehepolkt\ufezkjkx.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: calrbe.dll hbbcnb.dll zglhwa.dll hrypjf.dll
O20 - Winlogon Notify: xxyyYQJC - xxyyYQJC.dll (file missing)
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Tu as bien la suite de AVG, avec l'antispyware intégré???

Je ne comprends dès lors pas pourquoi il n'efface pas les fichiers suspects.

Tu ne peux pas les éliminer ???

Fermons cette parenthèse.

Comment fonctionne ton ordinateur, par rapport à ta demande initiale?

Je te propose un scan on-line avec Kaspersky (attention utiliser dans ce cas internet explorer comme navigateur)

https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

A bientôt

Zor

Oui oui j'ai fait les 2 rapports en mode sans échec !
Voilà le scan de l'anti-virus:

"Scan ""Scan whole computer"" was finished."
"Infections found:";"0"
"Infected objects removed or healed:";"0"
"Not removed or healed:";"0"
"Spyware found:";"0"
"Spyware removed:";"0"
"Not removed:";"0"
"Warnings count:";"8"
"Information count:";"0"
"Scan started:";"mardi 5 août 2008, 16:47:51"
"Scan finished:";"mardi 5 août 2008, 17:44:20 (56 minute(s) 29 second(s))"
"Total object scanned:";"564766"
"User who launched the scan:";"CYRIL"

"Warnings"
"File";"Infection";"Result"
"C:\Documents and Settings\CYRIL\Cookies\cyril@atdmt[2].txt";"Found Tracking cookie.Atdmt";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.amo";"Found Adware.DesktopTraffic";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.iiittt";"Found Adware.DesktopTraffic";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@atdmt[2].txt:\atdmt.com.b3e33b5f";"Found Tracking cookie.Atdmt";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@weborama[1].txt";"Found Tracking cookie.Weborama";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.momo";"Found Adware.Begin2Search";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@weborama[1].txt:\weborama.fr.30104bcb";"Found Tracking cookie.Weborama";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.ohb";"Found Adware.DesktopTraffic";"Potentially dangerous object"

J'espère que tout cela a bien été fait en mode sans échec...J'insiste...Quel nettoyage en tout cas.

Peux-tu faire à nouveau un scan avec ton antivirus?

A plus

Zor

Alors voilà le rapport Vundofix:

VundoFix V7.0.6

Scan started at 02:10:22 05/08/2008

Listing files found while scanning....

C:\Windows\system32\asntwqih.dll
C:\Windows\system32\asqdxbcn.dll
C:\Windows\system32\ausdutys.dll
C:\Windows\system32\ctgsynig.dll
C:\Windows\system32\egesbcyn.dll
C:\Windows\system32\eiyahnpx.dll
C:\Windows\system32\hoicuvuf.dll
C:\Windows\system32\jigqkagb.dll
C:\Windows\system32\kimpuvim.dll
C:\Windows\system32\nvaxkuyc.dll
C:\Windows\system32\oimsewtf.dll
C:\Windows\system32\ojbbtswa.dll
C:\Windows\system32\penwyabg.dll
C:\Windows\system32\pwtbwkpm.dll
C:\Windows\system32\ubxsxrhd.dll
C:\Windows\system32\uoaygjys.dll
C:\Windows\system32\uqsqputk.dll
C:\Windows\system32\xdrlleua.dll
C:\Windows\system32\xybmhlrp.dll
C:\Windows\system32\yvwjaeok.dll

Beginning removal...

Attempting to delete C:\Windows\system32\asntwqih.dll
C:\Windows\system32\asntwqih.dll Has been deleted!

Attempting to delete C:\Windows\system32\asqdxbcn.dll
C:\Windows\system32\asqdxbcn.dll Has been deleted!

Attempting to delete C:\Windows\system32\ausdutys.dll
C:\Windows\system32\ausdutys.dll Has been deleted!

Attempting to delete C:\Windows\system32\ctgsynig.dll
C:\Windows\system32\ctgsynig.dll Has been deleted!

Attempting to delete C:\Windows\system32\egesbcyn.dll
C:\Windows\system32\egesbcyn.dll Has been deleted!

Attempting to delete C:\Windows\system32\eiyahnpx.dll
C:\Windows\system32\eiyahnpx.dll Has been deleted!

Attempting to delete C:\Windows\system32\hoicuvuf.dll
C:\Windows\system32\hoicuvuf.dll Has been deleted!

Attempting to delete C:\Windows\system32\jigqkagb.dll
C:\Windows\system32\jigqkagb.dll Has been deleted!

Attempting to delete C:\Windows\system32\kimpuvim.dll
C:\Windows\system32\kimpuvim.dll Has been deleted!

Attempting to delete C:\Windows\system32\nvaxkuyc.dll
C:\Windows\system32\nvaxkuyc.dll Has been deleted!

Attempting to delete C:\Windows\system32\oimsewtf.dll
C:\Windows\system32\oimsewtf.dll Has been deleted!

Attempting to delete C:\Windows\system32\ojbbtswa.dll
C:\Windows\system32\ojbbtswa.dll Has been deleted!

Attempting to delete C:\Windows\system32\penwyabg.dll
C:\Windows\system32\penwyabg.dll Has been deleted!

Attempting to delete C:\Windows\system32\pwtbwkpm.dll
C:\Windows\system32\pwtbwkpm.dll Has been deleted!

Attempting to delete C:\Windows\system32\ubxsxrhd.dll
C:\Windows\system32\ubxsxrhd.dll Has been deleted!

Attempting to delete C:\Windows\system32\uoaygjys.dll
C:\Windows\system32\uoaygjys.dll Has been deleted!

Attempting to delete C:\Windows\system32\uqsqputk.dll
C:\Windows\system32\uqsqputk.dll Has been deleted!

Attempting to delete C:\Windows\system32\xdrlleua.dll
C:\Windows\system32\xdrlleua.dll Has been deleted!

Attempting to delete C:\Windows\system32\xybmhlrp.dll
C:\Windows\system32\xybmhlrp.dll Has been deleted!

Attempting to delete C:\Windows\system32\yvwjaeok.dll
C:\Windows\system32\yvwjaeok.dll Has been deleted!

Performing Repairs to the registry.
Done!

Et voilà le rapport MBAM:

Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1026
Windows 5.1.2600 Service Pack 2

10:29:17 05/08/2008
mbam-log-8-5-2008 (10-29-17).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 100743
Temps écoulé: 2 hour(s), 35 minute(s), 45 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

Désolé j'avais pas vu au bon endroit... J'ai trouvé ;) ! Je continue...

2) Comment supprimer un virus logé dans le dossier System Volume Information sous Windows XP ?

* Clique droit sur "Poste de travail" -> "Propriétés" -> onglet "Restauration du système" -> cocher "Désactiver la Restauration du système sur tous les lecteurs" -> "Appliquer" -> "Oui".
* Ensuite, décocher "Désactiver la Restauration du système sur tous les lecteurs" -> "Appliquer" -> "OK".

Dans "Poste de travail" -> "Propriétés" il n'y a pas d'onglet "Restauration du système"...

salut, et pour cause qu'il rame

1) nettoie avec CCleaner http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner
tuto ici https://www.malekal.com/tutoriel-ccleaner/
----------------------------------------------------------------------------------------------------------------------------------------------------------
2) Comment supprimer un virus logé dans le dossier System Volume Information sous Windows XP ?

* Clique droit sur "Poste de travail" -> "Propriétés" -> onglet "Restauration du système" -> cocher "Désactiver la Restauration du système sur tous les lecteurs" -> "Appliquer" -> "Oui".
* Ensuite, décocher "Désactiver la Restauration du système sur tous les lecteurs" -> "Appliquer" -> "OK".
----------------------------------------------------------------------------------------------------------------------------------------------------------
3) préparation des outils anti vundo

mets Malwarebytes (MBAM) à jour

télécharge Vundofix http://sasi.xooit.fr/t48-Guide-d-utilisation-de-VundoFix.htm

attention: pas de scan à ce stade!!!!

4) Démarrage en mode sans échec

Démarrer en mode sans échec avec : Windows XP

N'utilisez cette méthode (avec la touche F8) que si Windows XP est le seul système d'exploitation installé sur votre ordinateur.

* 1/ Redémarrez l’ordinateur. L'ordinateur commence le traitement d'instructions connues sous le nom Basic Input/Output System (BIOS). L'affichage dépend du fabricant du BIOS. Certains ordinateurs affichent une barre de progression faisant référence à BIOS, d'autres peuvent ne pas indiquer le processus en cours de réalisation.
* 2/ A la fin du chargement du BIOS, commencez à appuyer sur la touche F8 de votre clavier (ou F5 si F8 ne fonctionne pas). Procédez ainsi jusqu'à ce que le menu des options avancées de Windows apparaisse. Si vous commencez à appuyer sur la touche F8 trop tôt, il est possible que certains ordinateurs affichent le message "erreur clavier". Pour résoudre ce problème, redémarrez l'ordinateur et essayez de nouveau.
* 3/ En utilisant les flèches de votre clavier, sélectionnez "Mode sans échec" dans le menu puis appuyez sur Entrée.

En mode sans échec,
- fais un scan (et élimination) avec Vundofix comme indiqué sur le tuto (redémarre l'ordi au besoin)
Toujours en mode sans échec, refais une désinfection avec MBAM

Colle les deux rapports (Vundofix et MBAM) ici

Bon courage

Zor

Voilà le rapport de l'anti-virus:

"Scan ""Scan whole computer"" was finished."
"Infections found:";"10"
"Infected objects removed or healed:";"10"
"Not removed or healed:";"0"
"Spyware found:";"14"
"Spyware removed:";"14"
"Not removed:";"0"
"Warnings count:";"87"
"Information count:";"0"
"Scan started:";"lundi 4 août 2008, 20:52:04"
"Scan finished:";"lundi 4 août 2008, 21:45:35 (53 minute(s) 31 second(s))"
"Total object scanned:";"570319"
"User who launched the scan:";"CYRIL"

"Infections"
"File";"Infection";"Result"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091239.dll";"Trojan horse Generic11.CPS";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091240.dll";"Trojan horse Agent.ZGJ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091241.dll";"Trojan horse Agent.ZGJ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091243.dll";"Trojan horse Generic11.CPQ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091245.dll";"Trojan horse Generic11.CPQ";"Moved to Virus Vault"
"C:\WINDOWS\system32\afcxlcbo.dll";"Trojan horse Generic11.CPQ";"Moved to Virus Vault"
"C:\WINDOWS\system32\iqndigfk.dll";"Trojan horse Agent.ZGJ";"Moved to Virus Vault"
"C:\WINDOWS\system32\nxjkltqk.dll";"Trojan horse Generic11.CPQ";"Moved to Virus Vault"
"C:\WINDOWS\system32\xwpokfxp.dll";"Trojan horse Agent.ZGJ";"Moved to Virus Vault"
"C:\WINDOWS\system32\ycmebdkm.dll";"Trojan horse Generic11.CPS";"Moved to Virus Vault"

"Spyware"
"File";"Infection";"Result"
"C:\Documents and Settings\CYRIL\Bureau\Aide_dial-a-fix.exe";"Adware Generic3.KKH";"Moved to Virus Vault"
"C:\WINDOWS\system32\batvcskw.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091242.dll";"Adware Generic3.KIP";"Moved to Virus Vault"
"C:\WINDOWS\system32\dtbnnjxf.dll";"Adware Generic3.KIP";"Moved to Virus Vault"
"C:\WINDOWS\system32\hqsebgrl.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091244.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091246.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091247.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091248.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091249.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{39138AFC-2562-464E-ABA0-3F3BA0BC3ED9}\RP1016\A0091250.exe";"Adware Generic3.KKH";"Moved to Virus Vault"
"C:\WINDOWS\system32\hrlyfkrr.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\WINDOWS\system32\jrhtnjro.dll";"Adware Generic3.KIO";"Moved to Virus Vault"
"C:\WINDOWS\system32\tiigvean.dll";"Adware Generic3.KIO";"Moved to Virus Vault"

"Warnings"
"File";"Infection";"Result"
"C:\Documents and Settings\CYRIL\Cookies\cyril@2o7[2].txt";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@2o7[2].txt:\2o7.net.92b4d8ae";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.830b6f08";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.87a9ab5d";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.c982816c";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.cfb9f79a";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adopt.euroclick[1].txt";"Found Tracking cookie.Euroclick";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adopt.euroclick[1].txt:\adopt.euroclick.com.891542da";"Found Tracking cookie.Euroclick";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adopt.euroclick[1].txt:\adopt.euroclick.com.fb764ef7";"Found Tracking cookie.Euroclick";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adopt.euroclick[1].txt:\adopt.euroclick.com.ffe11db7";"Found Tracking cookie.Euroclick";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adtech[1].txt";"Found Tracking cookie.Adtech";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adtech[1].txt:\adtech.de.a9245469";"Found Tracking cookie.Adtech";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@advertising[1].txt";"Found Tracking cookie.Advertising";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@advertising[1].txt:\advertising.com.1820df7a";"Found Tracking cookie.Advertising";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@advertising[1].txt:\advertising.com.203aa218";"Found Tracking cookie.Advertising";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@advertising[1].txt:\advertising.com.b624fa46";"Found Tracking cookie.Advertising";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@advertising[1].txt:\advertising.com.f62113d5";"Found Tracking cookie.Advertising";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adviva[1].txt";"Found Tracking cookie.Adviva";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@hitbox[2].txt";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@hitbox[2].txt:\hitbox.com.2b95f8a3";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@hitbox[2].txt:\hitbox.com.bbf2a6e8";"Found Tracking cookie.Hitbox";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@serving-sys[1].txt";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@serving-sys[1].txt:\serving-sys.com.400f83f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@serving-sys[1].txt:\serving-sys.com.255d6f2f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@serving-sys[1].txt:\serving-sys.com.4b416ef8";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@serving-sys[1].txt:\serving-sys.com.606c3d3b";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@serving-sys[1].txt:\serving-sys.com.6a1cf9e8";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adviva[1].txt:\adviva.net.39ec90c";"Found Tracking cookie.Adviva";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@atdmt[2].txt";"Found Tracking cookie.Atdmt";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@atdmt[2].txt:\atdmt.com.b3e33b5f";"Found Tracking cookie.Atdmt";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@bs.serving-sys[2].txt";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@bs.serving-sys[2].txt:\bs.serving-sys.com.5bf1f00f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@doubleclick[1].txt";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@doubleclick[1].txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@mediaplex[1].txt";"Found Tracking cookie.Mediaplex";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@mediaplex[1].txt:\mediaplex.com.f652b123";"Found Tracking cookie.Mediaplex";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@overture[1].txt";"Found Tracking cookie.Overture";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@overture[1].txt:\overture.com.8e32a996";"Found Tracking cookie.Overture";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@serving-sys[1].txt:\serving-sys.com.c9034af6";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@ad.yieldmanager[1].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adbrite[2].txt";"Found Tracking cookie.Adbrite";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adbrite[2].txt:\adbrite.com.44f92a69";"Found Tracking cookie.Adbrite";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adbrite[2].txt:\adbrite.com.d5e309c2";"Found Tracking cookie.Adbrite";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adrevolver[2].txt";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adrevolver[2].txt:\adrevolver.com.4a719aa9";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adrevolver[2].txt:\adrevolver.com.9b9d670a";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adrevolver[2].txt:\adrevolver.com.b595d4db";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@adrevolver[2].txt:\adrevolver.com.f6cfcad4";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@bluestreak[2].txt";"Found Tracking cookie.Bluestreak";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@bluestreak[2].txt:\bluestreak.com.bf396750";"Found Tracking cookie.Bluestreak";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@media.adrevolver[2].txt";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@media.adrevolver[2].txt:\media.adrevolver.com.2be00b0";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@media.adrevolver[2].txt:\media.adrevolver.com.5fed601d";"Found Tracking cookie.Adrevolver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@smartadserver[2].txt";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@msnportal.112.2o7[1].txt";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@msnportal.112.2o7[1].txt:\msnportal.112.2o7.net.7225be6f";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@smartadserver[2].txt:\smartadserver.com.321a5cf8";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@smartadserver[2].txt:\smartadserver.com.3e749ab9";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@smartadserver[2].txt:\smartadserver.com.5550c4ed";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@smartadserver[2].txt:\smartadserver.com.c5827141";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@tradedoubler[2].txt";"Found Tracking cookie.Tradedoubler";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@tradedoubler[2].txt:\tradedoubler.com.ba12c0e9";"Found Tracking cookie.Tradedoubler";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@tradedoubler[2].txt:\tradedoubler.com.dc3c9994";"Found Tracking cookie.Tradedoubler";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@tradedoubler[2].txt:\tradedoubler.com.eab0972e";"Found Tracking cookie.Tradedoubler";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@weborama[2].txt";"Found Tracking cookie.Weborama";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@weborama[2].txt:\weborama.fr.30104bcb";"Found Tracking cookie.Weborama";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt:\zedo.com.775ee79c";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt:\zedo.com.a5b6a132";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt:\zedo.com.c1dd09f2";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt:\zedo.com.cef1c7af";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@weborama[2].txt:\weborama.fr.5f498b98";"Found Tracking cookie.Weborama";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@weborama[2].txt:\weborama.fr.ca746c8c";"Found Tracking cookie.Weborama";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@weborama[2].txt:\weborama.fr.f636611";"Found Tracking cookie.Weborama";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt:\zedo.com.14a38114";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt:\zedo.com.dd15d628";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"C:\Documents and Settings\CYRIL\Cookies\cyril@zedo[1].txt:\zedo.com.f1d14556";"Found Tracking cookie.Zedo";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.amo";"Found Adware.DesktopTraffic";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.iiittt";"Found Adware.DesktopTraffic";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.momo";"Found Adware.Begin2Search";"Potentially dangerous object"
"HKLM\SOFTWARE\Classes\dsktrf.ohb";"Found Adware.DesktopTraffic";"Potentially dangerous object"

Ben je trouve qu'il rame toujours autant :s ! Je collerai un rapport de mon anti-virus quand il aura fini...

C'est okay. Comment se porte ton ordi???

Tu peux aussi coller un rapport de scan de ton antivirus

A plus

Zor

Oui pas de problème ;) ! Voilà le nouveau rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:10:04, on 03/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

tu peux refaire un scan Hijackthis, par aquit de conscience, si tu le souhaites...

A plus

Zor

Voilà j'ai pris le premier lien et je l'ai installé comme tu me l'as dit !

le premier lien est la version de base (7 mo), l'autre est la plus complète (15 Mo)

Je te conseille de désinstaller ta version actuelle de Java et d'installer la version de base.

A plus

Zor

Salut zorinho, je viens de faire tout ce que tu m'as dit de faire !
Par contre dans le lien que tu m'as donné pour télécharger les mises à jour de Java je sais pas si c'est le premier lien ou le 2ème lien de Windows qu'il faut choisir...

Salut,

tu peux encore relancer Hijackthis, scan only, coche les lignes suivantes

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

Fais "fix checked"
----------------------------------------------------------------------------------------------------------------------------------------------------------

Fais les mises à jour de Java
https://www.java.com/en/download/manual.jsp

A bon entendeur

Zor

Up!