Des Virus partout help!

Angel83 -  
Bonjour,

j'ai des virus qui traine, avec des pseudos antivirus qui se sont installes tous seuls, ma connection a internet est limite et des pages apparaissent tous le tps, j ai bien essaye avec agv ms il n a pas resolu tous les pb.

voici le hitrackthis de mon ordi

Merci pour votre aide!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:03 AM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: <html>
O1 - Hosts: <frameset rows="60%,40%">
O1 - Hosts: <frame src="http://www.crous-poitiers.fr/portail.html" name="up" marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: <frame src="frame_login.cgi" name="down" noresize marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: </frameset>
O1 - Hosts: </html>
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe

--
End of file - 5816 bytes
Configuration: Windows XP
Internet Explorer 6.0

34 réponses

Résumé de la discussion

Plusieurs virus et des pseudos antivirus s'installent automatiquement sous Windows XP, la connexion est ralentie et des pages s'affichent en continu, malgré un scan avec AVG Anti-Spyware. Plusieurs conseils clés recommandent d'installer un antivirus fiable et d'utiliser FixWareout pour éliminer les éléments persistants, puis de redémarrer et d'analyser un nouveau rapport HijackThis. Des étapes détaillées impliquent de télécharger FixWareout depuis une source fiable, lancer le fix en mode approprié puis redémarrer, afin d'obtenir un rapport mis à jour et de réexécuter HijackThis pour vérification. En complément, il peut être utile de restaurer les paramètres d'hôtes et de supprimer les entrées suspectes, tout en surveillant les services Windows et les programmes au démarrage pour éviter les réinfections.

Bobot (l’IA à votre service)
  1. momonj
    en effet tu a des choses bizards,mais je ne m'y connais pas assez pour te conseiller
    1. Utilisateur anonyme
      houla la !!!!

      c est le souk !!

      instal d urgence un antivirus

      telecharge et instal ANTIVIR :

      https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html

      ensuite :

      Imprime ces instructions car il va y avoir un redémarrage de l'ordinateur.

      * Télécharge FixWareout de ce site sur le bureau:
      http://downloads.subratam.org/Fixwareout.exe
      hxxp://swandog46.geekstogo.com/Fixwareout.exe

      * Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
      Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

      *Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) avec un nouveau rapport HijackThis! dans ta prochaine réponse.

      Supprime aussi tous les fichiers crackés et les keygens. Ce sont des nids potentiels ou réels d'infections.

      L'important à suivre, c'est cette ligne :

      O1 - Hosts: localhost 127.0.0.1

      Si elle est encore dans le prochain rapport hijackthis, tu feras ça :

      Télécharge cet outil de SiRi:

      http://siri.urz.free.fr/RHosts.php

      Double cliquer dessus pour l'exécuter

      et cliquer sur " Restore original Hosts "

      ensuite refais un scan hijackthis et poste l erapport stp
      1. Angel83
        Merci pour ton aide,

        j ai essaye d installer antivir mais pendant l installation j ai le msg: the file could not be copied error code 2,

        Que faire?
    2. jfkpresident Contributeur sécurité
      salut !

      Beaucoup d'infections sur ton log hijack !!

      On va commencer par celle ci :

      # Téléchargez FixWareout LonnyRJones à partir l'une de ces adresses :

      * http://downloads.subratam.org/Fixwareout.exe
      * http://swandog46.geekstogo.com/Fixwareout.exe

      # Lancez le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
      # Il vous sera demandé de redémarrer votre ordinateur, redémarrez-le.
      # Votre système mettra un peu plus de temps au démarrage, c'est normal.

      ensuite :

      -> Relance HijackThis cliques sur « scanner seulement » ou (« do a scan only »),
      coche les cases devant ces lignes :

      O17 - HKLM\System\CCS\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
      O17 - HKLM\System\CCS\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer = 85.255.113.75,85.255.112.40
      O17 - HKLM\System\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer = 85.255.113.75,85.255.112.40
      O17 - HKLM\System\CCS\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer = 85.255.113.75,85.255.112.40
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
      O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
      O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
      O17 - HKLM\System\CS2\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
      O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
      O17 - HKLM\System\CS3\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40

      et ensuite ferme toutes les fenêtres actives autres que HijackThis!, navigateur inclus,
      puis clique "Fix checked"( ou « fixer objet »). Ferme HijackThis!

      reposte moi un nouveau hijack.
      1. jfkpresident Contributeur sécurité
        salut chiquitine ,nos messages se sont croisé !

        tu as qu'a continuer ,je reste pour suivre ...

        @++ bonne continuation a vous deux .
        3. Utilisateur anonyme
          ok j en avait peur en effet

          fait ça :

          Imprime ces instructions car il va y avoir un redémarrage de l'ordinateur.

          * Télécharge FixWareout de ce site sur le bureau:
          http://downloads.subratam.org/Fixwareout.exe
          hxxp://swandog46.geekstogo.com/Fixwareout.exe

          * Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
          Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

          *Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) avec un nouveau rapport HijackThis! dans ta prochaine réponse.

          ensuite :

          Télécharge cet outil de SiRi:

          http://siri.urz.free.fr/RHosts.php

          Double cliquer dessus pour l'exécuter

          et cliquer sur " Restore original Hosts "

          ensuite refais un scan hijackthis et poste le rapport stp
          1. Angel83
            me revoila!

            rapport fix

            Username "Administrator" - 06/01/2008 4:46:09 [Fixwareout edited 9/01/2007]

            ~~~~~ Prerun check
            HKLM\SOFTWARE\~\Winlogon\ "System"="kdrhk.exe"

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
            "nameserver"="85.255.113.75 85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{124642DA-A703-4BB6-BF6E-ECD92D71C032}
            "nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}
            "nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{B64D7F17-9FB9-4695-8A6C-729BEA115344}
            "nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2779F00-B031-49BD-9BB0-21565CFF5650}
            "nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{124642DA-A703-4BB6-BF6E-ECD92D71C032}
            "DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}
            "DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2779F00-B031-49BD-9BB0-21565CFF5650}
            "DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.
            HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F7A81E81-F60B-4565-9A80-8C9C71951DE6}
            "DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.

            Successfully flushed the DNS Resolver Cache.

            System was rebooted successfully.

            ~~~~~ Postrun check
            HKLM\SOFTWARE\~\Winlogon\ "system"=""
            ....
            ....
            ~~~~~ Misc files.
            ....
            ~~~~~ Checking for older varients.
            ....
            ~~~~~ Other
            C:\WINDOWS\TEMP\kdrhk.ren 63488 08/03/2004

            ~~~~~ Current runs (hklm hkcu "run" Keys Only)
            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
            "runwinlogon"="C:\\WINDOWS\\winlogon.exe"
            "ntuser"="C:\\WINDOWS\\system32\\drivers\\spools.exe"
            "autoload"="C:\\Documents and Settings\\Administrator\\cftmon.exe"
            "40a69435"="rundll32.exe \"C:\\WINDOWS\\system32\\lqqylmhp.dll\",b"
            "C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
            "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
            "avgnt"="\"C:\\Program Files\\Avira\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "Tok-Cirrhatus-3444"="\"C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\smss.exe\""
            "Tok-Cirrhatus"=""
            "ntuser"="C:\\WINDOWS\\system32\\drivers\\spools.exe"
            "autoload"="C:\\Documents and Settings\\Administrator\\cftmon.exe"
            ....
            Hosts file was reset, If you use a custom hosts file please replace it...
            ~~~~~ End report ~~~~~

            <gras>rapport hijackthis</gras>

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 5:12:45 AM, on 6/1/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
            Boot mode: Safe mode with network support

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\WINDOWS\system32\drivers\spools.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
            R3 - Default URLSearchHook is missing
            O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
            O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
            O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
            O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
            O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
            O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
            O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
            O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
            O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
            O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
            O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
            O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
            O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
            O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
            O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
            O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
            O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
            O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
            O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
            O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
            O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
            O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
            O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
          2. Angel83
            rapport hijackthis apres Siri

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 5:23:44 AM, on 6/1/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
            Boot mode: Safe mode with network support

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\WINDOWS\system32\drivers\spools.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
            R3 - Default URLSearchHook is missing
            O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
            O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
            O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
            O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
            O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
            O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
            O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
            O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
            O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
            O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
            O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
            O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
            O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
            O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
            O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
            O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
            O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
            O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
            O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
            O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
            O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
            O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
            O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
            O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
            O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
        5. Utilisateur anonyme
          # Télécharge ceci: (merci a S!RI pour ce petit programme).

          http://siri.urz.free.fr/Fix/SmitfraudFix.zip

          Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1,
          voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
          il va générer un rapport : copie/colle le sur le poste stp.

          1. Utilisateur anonyme
            non je veux le rapport smithfraud stp

            voir post 10
            1. Angel83
              SmitFraudFix v2.323

              Scan done at 5:35:32.79, Sun 06/01/2008
              Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
              OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
              The filesystem type is FAT32
              Fix run in safe mode

              »»»»»»»»»»»»»»»»»»»»»»»» Process

              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              C:\WINDOWS\system32\drivers\spools.exe
              C:\WINDOWS\system32\cmd.exe

              »»»»»»»»»»»»»»»»»»»»»»»» hosts

              »»»»»»»»»»»»»»»»»»»»»»»» C:\

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

              C:\WINDOWS\privacy_danger FOUND !
              C:\WINDOWS\xmpstean.exe FOUND !
              C:\WINDOWS\Tasks\At?.job FOUND !
              C:\WINDOWS\Tasks\At??.job FOUND !

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

              »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

              »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator

              »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data

              »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

              »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\FAVORI~1

              »»»»»»»»»»»»»»»»»»»»»»»» Desktop

              »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

              »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

              »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

              »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
              !!!Attention, following keys are not inevitably infected!!!

              IEDFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» VACFix
              !!!Attention, following keys are not inevitably infected!!!

              VACFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri
              +--------------------------------------------------+
              [!] Suspicious: boqnrwdmqed.dll
              BHO: QXK Olive - {4F7764DC-5B4A-44B9-B629-E889E542C545}
              TypeLib: {34042290-F6F7-4D2A-81D7-D160BCE39CFC}
              Interface: {122EE594-360F-42B1-88D5-2EBB113B5DE4}
              Interface: {A4F2F919-0658-4162-9B8E-5453758C75FC}

              [!] Suspicious: atfxqogp.dll
              Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878}
              TypeLib: {DC225FE6-B048-46B4-8AEE-D720C14B6F66}
              Interface: {F73CEA33-AB5A-41B2-A912-D76C8289E46B}
              Classe: atfxqogp.bwxd
              Classe: atfxqogp.ToolBar.1

              [!] Suspicious: vltdfabw.dll
              SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC}

              [!] Suspicious: vregfwlx.dll
              SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22}

              »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
              !!!Attention, following keys are not inevitably infected!!!

              404Fix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
              !!!Attention, following keys are not inevitably infected!!!

              SrchSTS.exe by S!Ri
              Search SharedTaskScheduler's .dll

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
              "{B5AC49A2-94F2-42BD-F434-2604812C897D}"="Hkjr94jdfdgj"

              [HKEY_CLASSES_ROOT\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
              @="C:\WINDOWS\system32\hdxjd4g.dll"

              [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
              @="C:\WINDOWS\system32\hdxjd4g.dll"

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
              "{B5AF0562-94F3-42BD-F434-2604812C797D}"="Hjkfj93dffd"

              [HKEY_CLASSES_ROOT\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
              @="C:\WINDOWS\system32\djki397g.dll"

              [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
              @="C:\WINDOWS\system32\djki397g.dll"

              »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
              !!!Attention, following keys are not inevitably infected!!!

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
              "AppInit_DLLs"=""

              »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
              !!!Attention, following keys are not inevitably infected!!!

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
              "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
              "system"=""

              »»»»»»»»»»»»»»»»»»»»»»»» Rustock

              »»»»»»»»»»»»»»»»»»»»»»»» DNS

              Description: VIA Compatable Fast Ethernet Adapter - Packet Scheduler Miniport
              DNS Server Search Order: 192.168.250.254

              HKLM\SYSTEM\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{F7A81E81-F60B-4565-9A80-8C9C71951DE6}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS2\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS3\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.113.75 85.255.112.40
              HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254

              »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

              »»»»»»»»»»»»»»»»»»»»»»»» End
          2. Utilisateur anonyme
            Démarre en mode sans échec :
            Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
            Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
            Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
            (Si F8 ne marche pas utilise la touche F5).
            ----------------------------------------------------------------------------
            # Relance le programme Smitfraud :
            Cette fois choisit l’option 2, répond oui a tous ;
            Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum + un rapport hijackthis fais apres passage de smithfraud option 2 stp
            1. Angel83
              la je suis en mode normal j ai l arriere plan du bureau ki est tout blanc

              voici le nveau rapport smithfraud

              SmitFraudFix v2.323

              Scan done at 5:43:51.60, Sun 06/01/2008
              Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
              OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
              The filesystem type is FAT32
              Fix run in safe mode

              »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
              !!!Attention, following keys are not inevitably infected!!!

              SrchSTS.exe by S!Ri
              Search SharedTaskScheduler's .dll

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
              "{B5AC49A2-94F2-42BD-F434-2604812C897D}"="Hkjr94jdfdgj"

              [HKEY_CLASSES_ROOT\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
              @="C:\WINDOWS\system32\hdxjd4g.dll"

              [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
              @="C:\WINDOWS\system32\hdxjd4g.dll"

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
              "{B5AF0562-94F3-42BD-F434-2604812C797D}"="Hjkfj93dffd"

              [HKEY_CLASSES_ROOT\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
              @="C:\WINDOWS\system32\djki397g.dll"

              [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
              @="C:\WINDOWS\system32\djki397g.dll"

              »»»»»»»»»»»»»»»»»»»»»»»» Killing process

              »»»»»»»»»»»»»»»»»»»»»»»» hosts

              127.0.0.1 localhost

              »»»»»»»»»»»»»»»»»»»»»»»» VACFix

              VACFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri
              C:\WINDOWS\boqnrwdmqed.dll deleted.
              C:\WINDOWS\atfxqogp.dll deleted.
              C:\WINDOWS\vltdfabw.dll deleted.
              C:\WINDOWS\vregfwlx.dll deleted.

              »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

              S!Ri's WS2Fix: LSP not Found.

              »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

              GenericRenosFix by S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

              C:\WINDOWS\privacy_danger\ Deleted
              C:\WINDOWS\xmpstean.exe Deleted
              C:\WINDOWS\Tasks\At?.job Deleted

              »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

              IEDFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

              404Fix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» DNS

              Description: VIA Compatable Fast Ethernet Adapter - Packet Scheduler Miniport
              DNS Server Search Order: 192.168.250.254

              HKLM\SYSTEM\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{F7A81E81-F60B-4565-9A80-8C9C71951DE6}: DhcpNameServer=85.255.113.75,85.255.112.40
              HKLM\SYSTEM\CS2\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS3\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.113.75 85.255.112.40
              HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
              HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254

              »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

              »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
              !!!Attention, following keys are not inevitably infected!!!

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
              "system"=""

              »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

              Registry Cleaning done.

              »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
              !!!Attention, following keys are not inevitably infected!!!

              SrchSTS.exe by S!Ri
              Search SharedTaskScheduler's .dll

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
              "{B5AC49A2-94F2-42BD-F434-2604812C897D}"="Hkjr94jdfdgj"

              [HKEY_CLASSES_ROOT\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
              @="C:\WINDOWS\system32\hdxjd4g.dll"

              [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
              @="C:\WINDOWS\system32\hdxjd4g.dll"

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
              "{B5AF0562-94F3-42BD-F434-2604812C797D}"="Hjkfj93dffd"

              [HKEY_CLASSES_ROOT\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
              @="C:\WINDOWS\system32\djki397g.dll"

              [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
              @="C:\WINDOWS\system32\djki397g.dll"

              »»»»»»»»»»»»»»»»»»»»»»»» End

              HIJACK

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 06:04: VIRUS ALERT!, on 6/1/2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\Explorer.EXE
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              C:\Documents and Settings\LocalService\cftmon.exe
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\Program Files\Internet Explorer\IEXPLORE.EXE
              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
              F3 - REG:win.ini: run="C:\WINDOWS\system32\winupdate.exe"
              O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
              O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
              O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
              O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
              O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
              O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\wwww\cftmon.exe
              O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
              O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
              O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
              O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
              O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
              O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
              O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
              O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
              O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
              O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
              O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
              O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
              O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
              O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
              O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
              O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
              O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
              O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
              O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
              O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
              O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
              O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
              O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
              O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
              O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
              O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
              O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
          3. Utilisateur anonyme
            Telecharge malwarebytes

            -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

            Tu l´instale; le programme va se mettre automatiquement a jour.

            Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

            Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

            Puis click sur "rechercher".

            Laisse le scanner le pc...

            Si des elements on ete trouvés > click sur supprimer la selection.

            si il t´es demandé de redemarrer > click sur "yes".

            A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

            Copie et colle le rapport stp.

            ps : les rapport sont aussi rangé dans l onglet rapport/log
            1. Angel83
              Malwarebytes' Anti-Malware 1.14
              Version de la base de données: 811

              6:50:43 AM 6/1/2008
              mbam-log-6-1-2008 (06-50-43).txt

              Type de recherche: Examen complet (C:\|D:\|)
              Eléments examinés: 53865
              Temps écoulé: 8 minute(s), 49 second(s)

              Processus mémoire infecté(s): 1
              Module(s) mémoire infecté(s): 2
              Clé(s) du Registre infectée(s): 31
              Valeur(s) du Registre infectée(s): 18
              Elément(s) de données du Registre infecté(s): 2
              Dossier(s) infecté(s): 3
              Fichier(s) infecté(s): 91

              Processus mémoire infecté(s):
              C:\WINDOWS\system32\drivers\spools.exe (Trojan.Agent) -> Unloaded process successfully.

              Module(s) mémoire infecté(s):
              C:\WINDOWS\system32\wvUomNGX.dll (Trojan.Vundo) -> Unloaded module successfully.
              C:\WINDOWS\system32\geBqPHbc.dll (Trojan.Vundo) -> Unloaded module successfully.

              Clé(s) du Registre infectée(s):
              HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvuomngx (Trojan.Vundo) -> Delete on reboot.
              HKEY_CLASSES_ROOT\luapvs.tchongabho (Trojan.BHO) -> Quarantined and deleted successfully.
              HKEY_CLASSES_ROOT\CLSID\{cf26fac0-7d4e-46d8-ae64-b277b11443ac} (Trojan.BHO) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf26fac0-7d4e-46d8-ae64-b277b11443ac} (Trojan.BHO) -> Quarantined and deleted successfully.
              HKEY_CLASSES_ROOT\CLSID\{b5ac49a2-94f2-42bd-f434-2604812c897d} (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b5ac49a2-94f2-42bd-f434-2604812c897d} (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_CLASSES_ROOT\CLSID\{b5af0562-94f3-42bd-f434-2604812c797d} (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b5af0562-94f3-42bd-f434-2604812c797d} (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{def85c80-216a-43ab-af70-1665edbe2780} (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_CLASSES_ROOT\CLSID\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Adware.Search Toolbar) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Adware.Search Toolbar) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ICF (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qandr (Rootkit.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Google Online Services (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\IQSoftware (Rogue.Multiple) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
              HKEY_CLASSES_ROOT\CLSID\{b8b46f64-6b40-4b7f-b014-3b3509ddd86a} (Trojan.Vundo) -> Delete on reboot.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8b46f64-6b40-4b7f-b014-3b3509ddd86a} (Trojan.Vundo) -> Delete on reboot.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
              HKEY_CLASSES_ROOT\atfxqogp.bwxd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              HKEY_CLASSES_ROOT\atfxqogp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ICF (Rootkit.Agent) -> Quarantined and deleted successfully.

              Valeur(s) du Registre infectée(s):
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
              HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InstallProgram (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{b5ac49a2-94f2-42bd-f434-2604812c897d} (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{b5af0562-94f3-42bd-f434-2604812c797d} (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\run\runwinlogon (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\herjek (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40a69435 (Trojan.Vundo) -> Quarantined and deleted successfully.
              HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
              HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.

              Elément(s) de données du Registre infecté(s):
              HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebqphbc -> Delete on reboot.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-640-1532467-23731) -> Quarantined and deleted successfully.

              Dossier(s) infecté(s):
              C:\Program Files\XP Antivirus (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
              C:\Documents and Settings\All Users\Application Data\Adsl Software Limited (Rogue.MalWarrior) -> Quarantined and deleted successfully.
              C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect (Rogue.MalWarrior) -> Quarantined and deleted successfully.

              Fichier(s) infecté(s):
              C:\WINDOWS\system32\wvUomNGX.dll (Trojan.Vundo) -> Delete on reboot.
              C:\Documents and Settings\Administrator\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\WINDOWS\Temp\setup_526_1_.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll (Trojan.BHO) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\winsrc.dll (Adware.Search Toolbar) -> Quarantined and deleted successfully.
              C:\porno.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\pbdv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\vrym534.exe (Trojan.DownLoader) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\vrym656.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\WINDOWS\Temp\4EC0.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\WINDOWS\Temp\56F9.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\WINDOWS\Temp\A2-tmpaASI.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe (Rogue.Installer) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\ie_updates3r.exe1 (Trojan.Downloader) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\3858054990.exe (Trojan.FakeALert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\csrssc.exe (Trojan.FakeALert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\2464944552.exe (Trojan.FakeALert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\A82.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\4CE1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\728E.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temp\2AB8.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temporary Internet Files\Content.IE5\I1Q50XUV\wmvcodec2.03[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Temporary Internet Files\Content.IE5\I1Q50XUV\ggg3[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011186.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011213.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011215.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011227.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011231.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011235.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011250.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011254.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP31\A0011261.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP31\A0011357.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP31\A0011367.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0011368.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0011376.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0011378.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012375.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012377.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012425.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012429.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0013423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0013425.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP33\A0013427.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP34\A0013428.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP35\A0013429.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP35\A0013431.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP36\A0013435.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP37\A0013436.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP37\A0013541.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP38\A0013542.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013544.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013645.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013646.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013647.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013649.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP42\A0013665.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP47\A0014907.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP47\A0014957.dll (Trojan.Qqpass) -> Quarantined and deleted successfully.
              C:\FOUND.000\FILE0004.CHK (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\FOUND.000\FILE0010.CHK (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\Program Files\XP Antivirus\xpa.exe.tmp (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
              C:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\svcp.csv (Malware.Trace) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\ieupdates.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\WINDOWS\herjek.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\drivers\spools.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\wscmp.dll.tmp (Trojan.Zlob) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\lqqylmhp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\update32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\wscmp.dll (Adware.BHO) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\geBqPHbc.dll (Trojan.Vundo) -> Delete on reboot.
              C:\WINDOWS\system32\found.exe.exe (Worm.Zhelatin) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\winsub.xml (Malware.Trace) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Local Settings\Tempboome20.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\WINDOWS\Temp\printsrv32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\Documents and Settings\LocalService\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Desktop\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
              C:\Documents and Settings\wwww\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
              C:\WINDOWS\system32\svchost.t__ (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
              C:\WINDOWS\SVCHOST.INI (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
              1. Utilisateur anonyme
                pas couché ??

                Redémarre le pc si ça n a pas été fais
                réouvre malewarebyte
                va sur quarantaine
                supprime tout

                Télécharge clean.zip, de Malekal
                http://www.malekal.com/download/clean.zip

                (1) Dézippe-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.

                (2) Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd

                une fenêtre noire va apparaître pendant un instant, laisse la ouverte.

                (3) Choisis l'option 1 puis patiente
                Poste le rapport obtenu

                pour retrouver le rapport : double clique sur > C > double clique sur " rapport_clean txt.
                et copie/colle le sur ta prochaine réponse .

                Ne passe pas à l'option 2 sans notre avis !
                1. Angel83
                  Non j etais pas encore couchee, je vois que toi aussi lol

                  voici le rapport clean

                  Sun 06/01/2008 a 18:08:52.14

                  *** Recherche C:

                  *** Recherche C:\WINDOWS\

                  *** Recherche C:\WINDOWS\system32
                  C:\WINDOWS\system32\mcrh.tmp FOUND

                  *** Recherche C:\Program Files
                  *** End of the report !
                  1. Utilisateur anonyme
                    Salut,

                    réouvre clean, passe l option 2

                    et envoi le rapport clean stp + un rapport hijackthis fais apes passage de clean option 2 stp

                    1. Angel83
                      rapport clean

                      Script executed in Safe Mode
                      Rapport clean par Malekal_morte - http://www.malekal.com
                      Script executed in Safe Mode Sun 06/01/2008 a 20:59:00.98

                      Microsoft Windows XP [Version 5.1.2600]

                      *** Suppression C:

                      *** Suppression C:\WINDOWS\

                      *** Suppression C:\WINDOWS\system32
                      tentative de suppression de C:\WINDOWS\system32\mcrh.tmp

                      *** Suppression C:\Program Files

                      *** Deletion of the registry keys successful..

                      rapport hijackthis

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 9:04:35 PM, on 6/1/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                      Boot mode: Safe mode with network support

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\WINDOWS\system32\rundll32.exe
                      C:\WINDOWS\system32\rundll32.exe
                      C:\WINDOWS\system32\rundll32.exe
                      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                      R3 - Default URLSearchHook is missing
                      O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                      O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                      O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
                      O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                      O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\nhhwkseq.dll",b
                      O4 - HKLM\..\Run: [BM4395a7a9] Rundll32.exe "C:\WINDOWS\system32\rwihhocq.dll",s
                      O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
                      O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
                      O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
                      O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
                      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  2. Utilisateur anonyme
                    Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                    -> Double clique combofix.exe.
                    -> Tape sur la touche 1 (Yes) pour démarrer le scan.
                    -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

                    NOTE : Le rapport se trouve également ici : C:\Combofix.txt

                    Avant d'utiliser ComboFix :

                    -> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

                    -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

                    Une fois fait, sur ton bureau double-clic sur Combofix.exe.

                    - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

                    /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

                    - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

                    - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

                    -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

                    -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

                    -> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

                    1. Angel83
                      voila!

                      ComboFix 08-05-29.1 - Administrator 2008-06-01 21:28:17.1 - [color=red][b]FAT32[/b][/color]x86 NETWORK
                      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.40 [GMT -7:00]
                      Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

                      [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
                      .

                      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
                      C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
                      C:\Documents and Settings\LocalService\Application Data\sp1
                      C:\Documents and Settings\LocalService\Application Data\sp1\a.tmp
                      C:\Documents and Settings\wwww\Start Menu\Programs\Antivirus 2008 PRO
                      C:\Documents and Settings\wwww\Start Menu\Programs\Antivirus 2008 PRO\antivirus-2008pro.lnk
                      C:\Program Files\Antivirus 2008 PRO
                      C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe
                      C:\Program Files\Antivirus 2008 PRO\vscan.tsi
                      C:\Program Files\Antivirus 2008 PRO\zlib.dll
                      C:\smp.bat
                      C:\WINDOWS\BM4395a7a9.xml
                      C:\WINDOWS\cookies.ini
                      C:\WINDOWS\pskt.ini
                      C:\WINDOWS\system32\atfnecog.exe
                      C:\WINDOWS\system32\cbHPqBeg.ini
                      C:\WINDOWS\system32\cbHPqBeg.ini2
                      C:\WINDOWS\system32\efcCrRhI.dll
                      C:\WINDOWS\system32\gdeycwil.dll
                      C:\WINDOWS\system32\geBqPHbc.dll
                      C:\WINDOWS\system32\hecxqgou.dll
                      C:\WINDOWS\system32\IhRrCcfe.ini
                      C:\WINDOWS\system32\IhRrCcfe.ini2
                      C:\WINDOWS\system32\kjcmgbch.dll
                      C:\WINDOWS\system32\kksduwmv.dll
                      C:\WINDOWS\system32\liwcyedg.ini
                      C:\WINDOWS\system32\nhhwkseq.dll
                      C:\WINDOWS\system32\opmjllug.dll
                      C:\WINDOWS\system32\phmlyqql.ini
                      C:\WINDOWS\system32\qeskwhhn.ini
                      C:\WINDOWS\system32\qtBIOqru.ini
                      C:\WINDOWS\system32\qtBIOqru.ini2
                      C:\WINDOWS\system32\rwihhocq.dll
                      C:\WINDOWS\system32\sxvntdci.dll
                      C:\WINDOWS\system32\urqOIBtq.dll
                      C:\WINDOWS\system32\vmwudskk.ini
                      C:\WINDOWS\system32\voscenvv.exe
                      C:\WINDOWS\system32\wvUomNGX.dll

                      ----- BITS: Possible infected sites -----

                      hxxp://statsboat.com
                      .
                      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      -------\Legacy_GOOGLE_ONLINE_SERVICES
                      -------\Legacy_ICF
                      -------\Service_ksnhtr

                      ((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
                      .

                      2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
                      2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
                      2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
                      2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                      2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
                      2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                      2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
                      2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                      2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                      2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                      2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
                      2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
                      2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
                      2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                      2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                      2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                      2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
                      2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
                      2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                      2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
                      2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
                      2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
                      2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
                      2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
                      2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
                      2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
                      2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
                      2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
                      2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                      2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
                      2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
                      2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
                      2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
                      2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
                      2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
                      2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
                      2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
                      2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp

                      .
                      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
                      .

                      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      *Note* empty entries & legit default entries are not shown
                      REGEDIT4

                      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
                      C:\WINDOWS\boqnrwdmqed.dll

                      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
                      2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

                      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
                      2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                      "{6813E51A-D108-4693-972A-0490411C4878}"= "C:\WINDOWS\atfxqogp.dll" [ ]

                      [HKEY_CLASSES_ROOT\clsid\{6813e51a-d108-4693-972a-0490411c4878}]
                      [HKEY_CLASSES_ROOT\atfxqogp.1]
                      [HKEY_CLASSES_ROOT\TypeLib\{DC225FE6-B048-46B4-8AEE-D720C14B6F66}]
                      [HKEY_CLASSES_ROOT\atfxqogp]

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "Tok-Cirrhatus-3444"="C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe" [ ]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
                      "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
                      "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "Tok-Cirrhatus"="" []
                      "run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]

                      [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                      "DisableCMD"= 0 (0x0)

                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                      "vidc.MJPG"= m3jpeg32.dll
                      "vidc.dmb1"= m3jpeg32.dll

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                      "AntiVirusDisableNotify"=dword:00000001
                      "UpdatesDisableNotify"=dword:00000001
                      "FirewallOverride"=dword:00000001

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=

                      S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]

                      .
                      **************************************************************************

                      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-06-01 21:35:06
                      Windows 5.1.2600 Service Pack 2 FAT NTAPI

                      scanning hidden processes ...

                      scanning hidden autostart entries ...

                      scanning hidden files ...

                      scan completed successfully
                      hidden files: 0

                      **************************************************************************

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
                      "C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
                      .
                      --------------------- DLLs Loaded Under Running Processes ---------------------

                      PROCESS: C:\WINDOWS\explorer.exe
                      -> ?:\WINDOWS\system32\comctl32.dll
                      .
                      ------------------------ Other Running Processes ------------------------
                      .
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      .
                      **************************************************************************
                      .
                      Completion time: 2008-06-01 21:35:51 - machine was rebooted
                      ComboFix-quarantined-files.txt 2008-06-02 04:35:48

                      Pre-Run: 4,906,164,224 bytes free
                      Post-Run: 5,652,496,384 bytes free

                      164
                  3. Utilisateur anonyme
                    super

                    refais un scan hijackthis et post le rapport stp
                    1. Angel83
                      here it is

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 9:45:06 PM, on 6/1/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                      Boot mode: Safe mode with network support

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\WINDOWS\explorer.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\Program Files\internet explorer\iexplore.exe
                      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                      O2 - BHO: QXK Olive - {4F7764DC-5B4A-44B9-B629-E889E542C545} - C:\WINDOWS\boqnrwdmqed.dll (file missing)
                      O2 - BHO: (no name) - {8CA667BF-F25B-40FA-94FF-EE529946A9D1} - C:\WINDOWS\system32\shellstyl.dll
                      O2 - BHO: (no name) - {C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8} - C:\WINDOWS\system32\shellstyl.dll
                      O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
                      O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                      O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
                      O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                      O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
                      O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
                      O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
                      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  4. Utilisateur anonyme
                    Rends toi sur ce site :

                    https://www.virustotal.com/gui/

                    Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\kdrhk.exe

                    Clique sur Send File.

                    Un rapport va s'élaborer ligne à ligne.

                    Attends la fin. Il doit comprendre la taille du fichier envoyé.

                    Sauvegarde le rapport avec le bloc-note.

                    Copie le dans ta réponse.

                    fais de meme pour ce fichier : C:\WINDOWS\system32\shellstyl.dll

                    1. Angel83
                      voici le rapport pour shellstl.dll

                      par contre je trouve pas l autre fichier

                      File shellstyl.dll received on 06.01.2008 19:48:49 (CET)
                      Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED

                      Result: 12/31 (38.71%)
                      Loading server information...
                      Your file is queued in position: ___.
                      Estimated start time is between ___ and ___ .
                      Do not close the window until scan is complete.
                      The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
                      If you are waiting for more than five minutes you have to resend your file.
                      Your file is being scanned by VirusTotal in this moment,
                      results will be shown as they're generated.
                      Compact Print results
                      Your file has expired or does not exists.
                      Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

                      You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
                      Email:

                      Antivirus Version Last Update Result
                      AhnLab-V3 2008.5.30.1 2008.05.30 -
                      AntiVir 7.8.0.26 2008.06.01 TR/ATRAPS.Gen
                      Authentium 5.1.0.4 2008.06.01 -
                      Avast 4.8.1195.0 2008.05.31 -
                      AVG 7.5.0.516 2008.05.31 Downloader.Delf.12.AN
                      BitDefender 7.2 2008.06.01 Trojan.Spy.BZub.NHY
                      CAT-QuickHeal 9.50 2008.05.31 -
                      ClamAV 0.92.1 2008.06.01 -
                      DrWeb 4.44.0.09170 2008.06.01 Trojan.DownLoader.56883
                      eSafe 7.0.15.0 2008.06.01 -
                      eTrust-Vet 31.4.5837 2008.05.30 Win32/Kvol!generic
                      Ewido 4.0 2008.06.01 -
                      F-Prot 4.4.4.56 2008.06.01 -
                      F-Secure 6.70.13260.0 2008.06.01 -
                      Fortinet 3.14.0.0 2008.06.01 -
                      GData 2.0.7306.1023 2008.06.01 -
                      Ikarus T3.1.1.26.0 2008.06.01 Virus.Trojan.Win32.Pakes.cdw
                      Kaspersky 7.0.0.125 2008.06.01 -
                      McAfee 5307 2008.05.30 -
                      Microsoft 1.3520 2008.06.01 Trojan:Win32/Boaxxe.B
                      NOD32v2 3150 2008.06.01 a variant of Win32/Agent.NSG
                      Norman 5.80.02 2008.05.30 -
                      Panda 9.0.0.4 2008.06.01 Suspicious file
                      Prevx1 V2 2008.06.01 Fraudulent Security Program
                      Rising 20.46.62.00 2008.06.01 Trojan.Clicker.Win32.Delf.mm
                      Sophos 4.29.0 2008.06.01 -
                      Sunbelt 3.0.1139.1 2008.05.29 -
                      Symantec 10 2008.06.01 -
                      VBA32 3.12.6.6 2008.06.01 -
                      VirusBuster 4.3.26:9 2008.06.01 -
                      Webwasher-Gateway 6.6.2 2008.06.01 Trojan.ATRAPS.Gen
                      Additional information
                      File size: 88576 bytes
                      MD5...: 253d9b5924390c53899d125a5f4d79dd
                      SHA1..: 66fd4c25631f0242a3cfe984630870f2ff0446f8
                      SHA256: 30eff06bb3100512a8541894cbabce46f4d6af314766fcfbb1b9853101c5f3ae
                      SHA512: d68dd46b71644d3af48c0e0d1304e6772db77e0d76ee7fd56755480b21cb0515
                      d120b7ea28d5793faee04bf94018d37f46bd2187bd428c78d0b3cb9ef718861e
                      PEiD..: -
                      PEInfo: PE Structure information

                      ( base data )
                      entrypointaddress.: 0x43a840
                      timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
                      machinetype.......: 0x14c (I386)

                      ( 3 sections )
                      name viradd virsiz rawdsiz ntrpy md5
                      UPX0 0x1000 0x25000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
                      UPX1 0x26000 0x15000 0x14c00 7.89 feb73d01fe0c2f653bd0f2ad39f81e16
                      .rsrc 0x3b000 0x1000 0xa00 3.60 f223b7beea8cb0242ef360cdd34bdeaf

                      ( 7 imports )
                      > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
                      > advapi32.dll: RegCloseKey
                      > ole32.dll: IsEqualGUID
                      > oleaut32.dll: LoadTypeLib
                      > shell32.dll: SHGetMalloc
                      > user32.dll: SetTimer
                      > wininet.dll: InternetCrackUrlA

                      ( 5 exports )
                      DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, InitEntry0

                      Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=3CA7402B00B974C55AE401D438677E00ECDDE81E
                      packers (Kaspersky): PE_Patch.UPX, UPX
                      packers (F-Prot): UPX
                  5. balltrap34 Contributeur sécurité
                    salut
                    atention se qui suit est exclusivement reserver a cette ordinateur il ne faut absolument pas l utyiliser pour un autre sous peine de planter le pc

                    normalement tu as deja telecharger combofix et il doit etre sur ton bureau

                    ouvre le bloc note et colle ce qui est en gras ci dessous

                    Files::
                    C:\WINDOWS\system32\kdrhk.exe
                    C:\WINDOWS\system32\shellstyl.dll
                    C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe
                    C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll
                    C:\WINDOWS\boqnrwdmqed.dll
                    C:\WINDOWS\system32\umovsb.tmp
                    C:\bxqhsfpe.exe
                    C:\WINDOWS\system32\sex3.ico
                    C:\WINDOWS\system32\sex2.ico.tmp
                    C:\WINDOWS\system32\sex1.ico.tmp
                    C:\WINDOWS\system32\winsrc.dll.tmp
                    C:\WINDOWS\system32\sex3.ico.tmp
                    C:\WINDOWS\system32\iodrfeup.tmp
                    C:\WINDOWS\emop.exe

                    Registry::
                    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
                    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
                    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
                    [-HKEY_CLASSES_ROOT\CLSID\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
                    [-HKEY_CLASSES_ROOT\CLSID\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
                    [-HKEY_CLASSES_ROOT\CLSID\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
                    [-HKEY_CLASSES_ROOT\clsid\{6813e51a-d108-4693-972a-0490411c4878}]
                    [-HKEY_CLASSES_ROOT\atfxqogp.1]
                    [-HKEY_CLASSES_ROOT\TypeLib\{DC225FE6-B048-46B4-8AEE-D720C14B6F66}]
                    [-HKEY_CLASSES_ROOT\atfxqogp]
                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "Tok-Cirrhatus-3444"=-
                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "C:\WINDOWS\system32\kdrhk.exe"=-
                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                    "Tok-Cirrhatus"=-

                    enregistre le et donne lui comme nom CFScript.txt

                    [list]Fais un glisser/déposer de ce fichier [b]CFScript/b sur le fichier ComboFix.exe comme sur la capture
                    [img]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif/img[list]
                    [*]Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) ,[b] tape 1/b puis valide.
                    [*]Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
                    [*]Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
                    [*]Si le fichier ne s'ouvre pas, il se trouve ici > C:\[b]ComboFix.txt/b/list
                    1. Angel83
                      ComboFix 08-05-29.1 - Administrator 2008-06-02 2:58:57.2 - [color=red][b]FAT32[/b][/color]x86 NETWORK
                      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.68 [GMT -7:00]
                      Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
                      Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

                      [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
                      .

                      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      C:\Documents and Settings\wwww\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk

                      .
                      ((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
                      .

                      2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
                      2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
                      2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
                      2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                      2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
                      2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                      2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
                      2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                      2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                      2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                      2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
                      2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
                      2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
                      2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                      2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                      2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                      2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
                      2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
                      2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                      2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
                      2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
                      2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
                      2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
                      2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
                      2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
                      2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
                      2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
                      2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
                      2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                      2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
                      2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
                      2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
                      2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
                      2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
                      2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
                      2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
                      2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
                      2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp

                      .
                      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
                      .

                      ((((((((((((((((((((((((((((( snapshot@2008-06-01_21.35.28.70 )))))))))))))))))))))))))))))))))))))))))
                      .
                      - 2008-06-02 04:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                      + 2008-06-02 09:35:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                      .
                      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      *Note* empty entries & legit default entries are not shown
                      REGEDIT4

                      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F06C515-7084-4700-B436-AFBF63A3C519}]
                      2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
                      "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
                      "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]

                      [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                      "DisableCMD"= 0 (0x0)

                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                      "vidc.MJPG"= m3jpeg32.dll
                      "vidc.dmb1"= m3jpeg32.dll

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                      "AntiVirusDisableNotify"=dword:00000001
                      "UpdatesDisableNotify"=dword:00000001
                      "FirewallOverride"=dword:00000001

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=

                      S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]

                      *Newly Created Service* - CATCHME
                      .
                      **************************************************************************

                      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-06-02 03:00:25
                      Windows 5.1.2600 Service Pack 2 FAT NTAPI

                      scanning hidden processes ...

                      scanning hidden autostart entries ...

                      scanning hidden files ...

                      scan completed successfully
                      hidden files: 0

                      **************************************************************************

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
                      "C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
                      .
                      Completion time: 2008-06-02 3:00:54
                      ComboFix-quarantined-files.txt 2008-06-02 10:00:54
                      ComboFix2.txt 2008-06-02 04:35:54

                      Pre-Run: 5,652,193,280 bytes free
                      Post-Run: 5,648,465,920 bytes free

                      105
                  6. Utilisateur anonyme
                    re

                    fais ce qui est expliqué par balltrap post 27 stp
                    1. Angel83
                      ComboFix 08-05-29.1 - Administrator 2008-06-02 2:58:57.2 - [color=red][b]FAT32[/b][/color]x86 NETWORK
                      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.68 [GMT -7:00]
                      Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
                      Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

                      [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
                      .

                      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      C:\Documents and Settings\wwww\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk

                      .
                      ((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
                      .

                      2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
                      2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
                      2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
                      2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                      2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
                      2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                      2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
                      2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                      2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
                      2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
                      2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
                      2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
                      2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
                      2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
                      2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
                      2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
                      2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
                      2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
                      2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                      2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
                      2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
                      2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
                      2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
                      2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
                      2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
                      2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
                      2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
                      2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
                      2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                      2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
                      2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
                      2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
                      2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
                      2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
                      2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
                      2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
                      2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
                      2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp

                      .
                      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
                      .

                      ((((((((((((((((((((((((((((( snapshot@2008-06-01_21.35.28.70 )))))))))))))))))))))))))))))))))))))))))
                      .
                      - 2008-06-02 04:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                      + 2008-06-02 09:35:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                      .
                      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      *Note* empty entries & legit default entries are not shown
                      REGEDIT4

                      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F06C515-7084-4700-B436-AFBF63A3C519}]
                      2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
                      "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
                      "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]

                      [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                      "DisableCMD"= 0 (0x0)

                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                      "vidc.MJPG"= m3jpeg32.dll
                      "vidc.dmb1"= m3jpeg32.dll

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                      "AntiVirusDisableNotify"=dword:00000001
                      "UpdatesDisableNotify"=dword:00000001
                      "FirewallOverride"=dword:00000001

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=

                      S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]

                      *Newly Created Service* - CATCHME
                      .
                      **************************************************************************

                      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-06-02 03:00:25
                      Windows 5.1.2600 Service Pack 2 FAT NTAPI

                      scanning hidden processes ...

                      scanning hidden autostart entries ...

                      scanning hidden files ...

                      scan completed successfully
                      hidden files: 0

                      **************************************************************************

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
                      "C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
                      .
                      Completion time: 2008-06-02 3:00:54
                      ComboFix-quarantined-files.txt 2008-06-02 10:00:54
                      ComboFix2.txt 2008-06-02 04:35:54

                      Pre-Run: 5,652,193,280 bytes free
                      Post-Run: 5,648,465,920 bytes free

                      105
                  • 1
                  • 2

                  Discussions similaires

                  Softonic,est-ce un virus ?
                  techmel1

                  6 réponses
                  Chrome://newtab
                  Nova

                  14 réponses
                  Désinstaller Softonic
                  Diguimette

                  5 réponses
                  Supprimer New Tab
                  tysaozon

                  8 réponses
                  Bouton pause/break
                  frans003

                  3 réponses