Pub intempestive

Salut,

fais ceci pour commencer :

Télécharges et installes le logiciel HijackThis :

ici : ftp://ftp.commentcamarche.com/download/HJTInstall.exe
ou ici : http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici : https://www.clubic.com/telecharger-fiche17891-hijackthis.html

1- Cliques sur le setup pour lancer l'installe : laisses toi guider et ne modifies pas les paramètres d'installation .
A la fin de l'installe , le prg ce lance automatiquement : fermes le en cliquant sur la croix rouge .
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme : "C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .
Supprimes le raccourcis stp ...

Important :
Renommer le prg HijackThis (pour contrer une éventuelle infection Vundo):
Rends toi sur ton PC ici "C:\ program files\Trend Micro\HijackThis\HijackThis.exe"<---cliques droit sur ce dernier et choisis "renommer" : tapes monjack et valides .
Puis cliques droit sur "monjack.exe" et choisis "envoyer vers" -> le bureau ( créer un raccourci ).

tuto pour utilisation
Regardes ici, c'est parfaitement expliqué en images (merci balltrap34) :
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm
( Ne fixes encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement )

2-!! Déconnectes toi et fermes toute tes applications en cours !!

Cliques sur le raccourci du bureau pour lancer le prg :
fais un scan "monjack" (ou HijackThis renommé) en cliquant sur : "Do a system scan and save a logfile"

---> Postes le rapport généré pour analyse ...

ok

voici mon rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:47:43, on 15/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: {83e7d49a-5f9a-96a8-bd14-c7d8defdfe18} - {81efdfed-8d7c-41db-8a69-a9f5a94d7e38} - C:\WINDOWS\system32\qlfxan.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} - C:\WINDOWS\system32\urqQgffF.dll (file missing)
O2 - BHO: (no name) - {FD417378-F411-4B77-BBEE-4893BB670D4C} - C:\WINDOWS\system32\ljJDSIyW.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] "C:\WINDOWS\RTHDCPL.EXE"
O4 - HKLM\..\Run: [Alcmtr] "C:\WINDOWS\ALCMTR.EXE"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [bcc12435] rundll32.exe "C:\WINDOWS\system32\mjwxlotn.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: qlfxan.dll
O20 - Winlogon Notify: ljJDSIyW - C:\WINDOWS\SYSTEM32\ljJDSIyW.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ok ...

plusieurs infections ...

Commences par ceci :

Télécharges ToolBar S&D ( de Eric_71/Team IDN ) :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

* double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
* Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
* Choisis l'option 1 ( "recherche") et tapes "entrée" .
* Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
de son contenu dans ta prochaine réponse ...
( le rapport est en outre sauvegardé ici -> C:\TB.txt )

voici le rapport

-----------\\ ToolBar S&D 1.2.2 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz )
BIOS : Default System BIOS
USER : Sam ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)
Firewall : ZoneAlarm Security Suite Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total : 73 Go Free : 63 Go
D:\ (Local Disk) - NTFS - Total : 159 Go Free : 154 Go
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (USB)
K:\ (USB)

"C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
Option : [1] ( 15/10/2008|14:56 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar
C:\Program Files\AskSBar\SrchAstt

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.com/?gws_rd=ssl"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"

--------------------\\ Recherche d'autres infections

C:\WINDOWS\system32\FffgQqru.ini
C:\WINDOWS\system32\FffgQqru.ini2
[b]==> VUNDO <==/b

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Sam\Bureau\sauvegarde\zone alarm\Keygen
C:\DOCUME~1\Sam\Bureau\sauvegarde\zone alarm\Keygen\ZoneAlarm Internet Security Suite Keygen.exe

1 - "C:\ToolBar SD\TB_1.txt" - 15/10/2008|15:00 - Option : [1]

-----------\\ Fin du rapport a 15:00:00,29

a l'aide!!!!!!!!!!!!!!!

Bien on continue :

Des crack infecté à nettoyer :

1- Télécharges OTMoveIt3 (de Old_Timer) sur ton Bureau.

http://oldtimer.geekstogo.com/OTMoveIt3.exe

! Déconnectes toi et fermes toute tes applications en cours !

Double cliques sur "OTMoveIt3.exe" pour ouvrir le prg .
Puis copies ce qui se trouve en citation ci-dessous,

:Processes
explorer.exe

:Services

:Reg

:Files
C:\Documents and Settings\Sam\Bureau\sauvegarde\zone alarm\Keygen\ZoneAlarm Internet Security Suite Keygen.exe
C:\Documents and Settings\Sam\Bureau\sauvegarde\zone alarm\Keygen

:Commands
[emptytemp]
[start explorer]
[Reboot]

et colles le dans le cadre de gauche de OTMoveIt3 :
Paste Instructions for items to be moved.
(ne touche à rien d'autre !)

-> cliques sur MoveIt! pour lancer la suppression.
-> laisses travailler l'outil ...

( Note : ton bureau va disparaitre puis réapparaitre, c'est normal .)

-> une fois finis , un petite fenêtre s'ouvre : cliques sur " Yes " .

Ton PC va redémarrer de lui même ...

-->Postes le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
( " xxxx2008_xxxxxx.log " )

2- Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse et attends la suite ...

je n'ai rien c'est vide

au secours!!!!!!!!!

passes à l'étape 2 alors ... et postes moi les rapports demandés ...

voici le apport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:55:16, on 15/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6A7DEB50-2591-4847-B9FC-C0A5AE2388C2} - C:\WINDOWS\system32\tuvSmkli.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: {6d4ac849-b191-570a-66a4-c90f0d5be9fa} - {af9eb5d0-f09c-4a66-a075-191b948ca4d6} - C:\WINDOWS\system32\eqcvmz.dll
O2 - BHO: (no name) - {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} - C:\WINDOWS\system32\urqQgffF.dll (file missing)
O2 - BHO: (no name) - {FD417378-F411-4B77-BBEE-4893BB670D4C} - C:\WINDOWS\system32\ljJDSIyW.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] "C:\WINDOWS\RTHDCPL.EXE"
O4 - HKLM\..\Run: [Alcmtr] "C:\WINDOWS\ALCMTR.EXE"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [bcc12435] rundll32.exe "C:\WINDOWS\system32\jwtpmmgs.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: eqcvmz.dll
O20 - Winlogon Notify: ljJDSIyW - C:\WINDOWS\SYSTEM32\ljJDSIyW.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

Eu non ... tu as oublier qulque chose ... -_-

donc je répette :

Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse et attends la suite ...

-----------\\ ToolBar S&D 1.2.2 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz )
BIOS : Default System BIOS
USER : Sam ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)
C:\ (Local Disk) - NTFS - Total : 73 Go Free : 63 Go
D:\ (Local Disk) - NTFS - Total : 159 Go Free : 154 Go
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (USB)
K:\ (USB)

"C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
Option : [1] ( 15/10/2008|17:04 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar
C:\Program Files\AskSBar\SrchAstt
C:\DOCUME~1\Sam\LOCALS~1\Temp\ICD1.tmp

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.com/?gws_rd=ssl"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"

--------------------\\ Recherche d'autres infections

C:\WINDOWS\system32\FffgQqru.ini
C:\WINDOWS\system32\FffgQqru.ini2
C:\WINDOWS\system32\ilkmSvut.ini
C:\WINDOWS\system32\ilkmSvut.ini2
[b]==> VUNDO <==/b

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Sam\Local Settings\Temporary Internet Files\Content.IE5\5SUGR81I\keyGen[1].htm
C:\DOCUME~1\Sam\Local Settings\Temporary Internet Files\Content.IE5\NS7SOS2A\keyGen[1].htm

1 - "C:\ToolBar SD\TB_1.txt" - 15/10/2008|15:00 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 15/10/2008|17:08 - Option : [1]

-----------\\ Fin du rapport a 17:08:14,32

Bon ... Continue avec ceci maintenant :

Télécharges VirtumundoBegone sur ton bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

!! Ce déconnecter et fermer toute ces applications le temps de la manipe !!

Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau .
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).

Postes le rapport VBG accompagné d'un nouveau rapport Hijackthis pour analyse ...

bonjour

voici mes 2 rapports

[10/16/2008, 11:13:43] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Sam\Bureau\VirtumundoBeGone.exe" )
[10/16/2008, 11:13:51] - Detected System Information:
[10/16/2008, 11:13:51] - Windows Version: 5.1.2600, Service Pack 2
[10/16/2008, 11:13:51] - Current Username: Sam (Admin)
[10/16/2008, 11:13:51] - Windows is in NORMAL mode.
[10/16/2008, 11:13:51] - Searching for Browser Helper Objects:
[10/16/2008, 11:13:51] - BHO 1: {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - No filename found. Continuing.
[10/16/2008, 11:13:51] - BHO 2: {243B17DE-77C7-46BF-B94B-0B5F309A0E64} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\mnyside
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\mnyside, continuing.
[10/16/2008, 11:13:51] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/16/2008, 11:13:51] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/16/2008, 11:13:51] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[10/16/2008, 11:13:51] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/16/2008, 11:13:51] - BHO 7: {af9eb5d0-f09c-4a66-a075-191b948ca4d6} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\eqcvmz
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\eqcvmz, continuing.
[10/16/2008, 11:13:51] - BHO 8: {D92FA155-1849-4C89-9CEF-EAC9F19F97D9} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\tuvSmkli
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\tuvSmkli, continuing.
[10/16/2008, 11:13:51] - BHO 9: {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\urqQgffF
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\urqQgffF, continuing.
[10/16/2008, 11:13:51] - BHO 10: {FD417378-F411-4B77-BBEE-4893BB670D4C} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\ljJDSIyW
[10/16/2008, 11:13:51] - Found: HKLM\...\Winlogon\Notify\ljJDSIyW - This is probably Virtumundo.
[10/16/2008, 11:13:51] - Assigning {FD417378-F411-4B77-BBEE-4893BB670D4C} MSEvents Object
[10/16/2008, 11:13:52] - BHO list has been changed! Starting over...
[10/16/2008, 11:13:52] - BHO 1: {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - No filename found. Continuing.
[10/16/2008, 11:13:52] - BHO 2: {243B17DE-77C7-46BF-B94B-0B5F309A0E64} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\mnyside
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\mnyside, continuing.
[10/16/2008, 11:13:52] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/16/2008, 11:13:52] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/16/2008, 11:13:52] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[10/16/2008, 11:13:52] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/16/2008, 11:13:52] - BHO 7: {af9eb5d0-f09c-4a66-a075-191b948ca4d6} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\eqcvmz
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\eqcvmz, continuing.
[10/16/2008, 11:13:52] - BHO 8: {D92FA155-1849-4C89-9CEF-EAC9F19F97D9} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\tuvSmkli
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\tuvSmkli, continuing.
[10/16/2008, 11:13:52] - BHO 9: {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\urqQgffF
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\urqQgffF, continuing.
[10/16/2008, 11:13:52] - BHO 10: {FD417378-F411-4B77-BBEE-4893BB670D4C} (MSEvents Object)
[10/16/2008, 11:13:52] - ALERT: Found MSEvents Object!
[10/16/2008, 11:13:52] - Finished Searching Browser Helper Objects
[10/16/2008, 11:13:52] - *** Detected MSEvents Object
[10/16/2008, 11:13:52] - Trying to remove MSEvents Object...
[10/16/2008, 11:13:53] - Terminating Process: IEXPLORE.EXE
[10/16/2008, 11:13:53] - Terminating Process: RUNDLL32.EXE
[10/16/2008, 11:13:53] - Disabling Automatic Shell Restart
[10/16/2008, 11:13:53] - Terminating Process: EXPLORER.EXE
[10/16/2008, 11:14:58] - Suspending the NT Session Manager System Service
[10/16/2008, 11:14:58] - Terminating Windows NT Logon/Logoff Manager
[10/16/2008, 11:14:59] - Re-enabling Automatic Shell Restart
[10/16/2008, 11:14:59] - File to disable: C:\WINDOWS\system32\ljJDSIyW.dll
[10/16/2008, 11:14:59] - Renaming C:\WINDOWS\system32\ljJDSIyW.dll -> C:\WINDOWS\system32\ljJDSIyW.dll.vir
[10/16/2008, 11:14:59] - File successfully renamed!
[10/16/2008, 11:14:59] - Removing HKLM\...\Browser Helper Objects\{FD417378-F411-4B77-BBEE-4893BB670D4C}
[10/16/2008, 11:14:59] - Removing HKCR\CLSID\{FD417378-F411-4B77-BBEE-4893BB670D4C}
[10/16/2008, 11:14:59] - Adding Kill Bit for ActiveX for GUID: {FD417378-F411-4B77-BBEE-4893BB670D4C}
[10/16/2008, 11:14:59] - Deleting ATLEvents/MSEvents Registry entries
[10/16/2008, 11:14:59] - Removing HKLM\...\Winlogon\Notify\ljJDSIyW
[10/16/2008, 11:14:59] - Searching for Browser Helper Objects:
[10/16/2008, 11:14:59] - BHO 1: {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - No filename found. Continuing.
[10/16/2008, 11:14:59] - BHO 2: {243B17DE-77C7-46BF-B94B-0B5F309A0E64} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\mnyside
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\mnyside, continuing.
[10/16/2008, 11:14:59] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/16/2008, 11:14:59] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/16/2008, 11:14:59] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[10/16/2008, 11:14:59] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/16/2008, 11:14:59] - BHO 7: {af9eb5d0-f09c-4a66-a075-191b948ca4d6} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\eqcvmz
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\eqcvmz, continuing.
[10/16/2008, 11:14:59] - BHO 8: {D92FA155-1849-4C89-9CEF-EAC9F19F97D9} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\tuvSmkli
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\tuvSmkli, continuing.
[10/16/2008, 11:14:59] - BHO 9: {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\urqQgffF
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\urqQgffF, continuing.
[10/16/2008, 11:14:59] - Finished Searching Browser Helper Objects
[10/16/2008, 11:14:59] - Finishing up...
[10/16/2008, 11:14:59] - A restart is needed.
[10/16/2008, 11:15:07] - Attempting to Restart via STOP error (Blue Screen!)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:09, on 16/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: {6d4ac849-b191-570a-66a4-c90f0d5be9fa} - {af9eb5d0-f09c-4a66-a075-191b948ca4d6} - C:\WINDOWS\system32\eqcvmz.dll
O2 - BHO: (no name) - {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} - C:\WINDOWS\system32\urqQgffF.dll (file missing)
O2 - BHO: (no name) - {EC442773-5C70-494A-86ED-067E1415A07E} - C:\WINDOWS\system32\tuvSmkli.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] "C:\WINDOWS\RTHDCPL.EXE"
O4 - HKLM\..\Run: [Alcmtr] "C:\WINDOWS\ALCMTR.EXE"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [bcc12435] rundll32.exe "C:\WINDOWS\system32\jwtpmmgs.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: eqcvmz.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

bonjour

voici mes 2 rapports

[10/16/2008, 11:13:43] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Sam\Bureau\VirtumundoBeGone.exe" )
[10/16/2008, 11:13:51] - Detected System Information:
[10/16/2008, 11:13:51] - Windows Version: 5.1.2600, Service Pack 2
[10/16/2008, 11:13:51] - Current Username: Sam (Admin)
[10/16/2008, 11:13:51] - Windows is in NORMAL mode.
[10/16/2008, 11:13:51] - Searching for Browser Helper Objects:
[10/16/2008, 11:13:51] - BHO 1: {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - No filename found. Continuing.
[10/16/2008, 11:13:51] - BHO 2: {243B17DE-77C7-46BF-B94B-0B5F309A0E64} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\mnyside
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\mnyside, continuing.
[10/16/2008, 11:13:51] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/16/2008, 11:13:51] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/16/2008, 11:13:51] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[10/16/2008, 11:13:51] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/16/2008, 11:13:51] - BHO 7: {af9eb5d0-f09c-4a66-a075-191b948ca4d6} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\eqcvmz
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\eqcvmz, continuing.
[10/16/2008, 11:13:51] - BHO 8: {D92FA155-1849-4C89-9CEF-EAC9F19F97D9} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\tuvSmkli
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\tuvSmkli, continuing.
[10/16/2008, 11:13:51] - BHO 9: {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\urqQgffF
[10/16/2008, 11:13:51] - Key not found: HKLM\...\Winlogon\Notify\urqQgffF, continuing.
[10/16/2008, 11:13:51] - BHO 10: {FD417378-F411-4B77-BBEE-4893BB670D4C} ()
[10/16/2008, 11:13:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:51] - Checking for HKLM\...\Winlogon\Notify\ljJDSIyW
[10/16/2008, 11:13:51] - Found: HKLM\...\Winlogon\Notify\ljJDSIyW - This is probably Virtumundo.
[10/16/2008, 11:13:51] - Assigning {FD417378-F411-4B77-BBEE-4893BB670D4C} MSEvents Object
[10/16/2008, 11:13:52] - BHO list has been changed! Starting over...
[10/16/2008, 11:13:52] - BHO 1: {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - No filename found. Continuing.
[10/16/2008, 11:13:52] - BHO 2: {243B17DE-77C7-46BF-B94B-0B5F309A0E64} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\mnyside
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\mnyside, continuing.
[10/16/2008, 11:13:52] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/16/2008, 11:13:52] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/16/2008, 11:13:52] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[10/16/2008, 11:13:52] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/16/2008, 11:13:52] - BHO 7: {af9eb5d0-f09c-4a66-a075-191b948ca4d6} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\eqcvmz
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\eqcvmz, continuing.
[10/16/2008, 11:13:52] - BHO 8: {D92FA155-1849-4C89-9CEF-EAC9F19F97D9} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\tuvSmkli
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\tuvSmkli, continuing.
[10/16/2008, 11:13:52] - BHO 9: {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} ()
[10/16/2008, 11:13:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:13:52] - Checking for HKLM\...\Winlogon\Notify\urqQgffF
[10/16/2008, 11:13:52] - Key not found: HKLM\...\Winlogon\Notify\urqQgffF, continuing.
[10/16/2008, 11:13:52] - BHO 10: {FD417378-F411-4B77-BBEE-4893BB670D4C} (MSEvents Object)
[10/16/2008, 11:13:52] - ALERT: Found MSEvents Object!
[10/16/2008, 11:13:52] - Finished Searching Browser Helper Objects
[10/16/2008, 11:13:52] - *** Detected MSEvents Object
[10/16/2008, 11:13:52] - Trying to remove MSEvents Object...
[10/16/2008, 11:13:53] - Terminating Process: IEXPLORE.EXE
[10/16/2008, 11:13:53] - Terminating Process: RUNDLL32.EXE
[10/16/2008, 11:13:53] - Disabling Automatic Shell Restart
[10/16/2008, 11:13:53] - Terminating Process: EXPLORER.EXE
[10/16/2008, 11:14:58] - Suspending the NT Session Manager System Service
[10/16/2008, 11:14:58] - Terminating Windows NT Logon/Logoff Manager
[10/16/2008, 11:14:59] - Re-enabling Automatic Shell Restart
[10/16/2008, 11:14:59] - File to disable: C:\WINDOWS\system32\ljJDSIyW.dll
[10/16/2008, 11:14:59] - Renaming C:\WINDOWS\system32\ljJDSIyW.dll -> C:\WINDOWS\system32\ljJDSIyW.dll.vir
[10/16/2008, 11:14:59] - File successfully renamed!
[10/16/2008, 11:14:59] - Removing HKLM\...\Browser Helper Objects\{FD417378-F411-4B77-BBEE-4893BB670D4C}
[10/16/2008, 11:14:59] - Removing HKCR\CLSID\{FD417378-F411-4B77-BBEE-4893BB670D4C}
[10/16/2008, 11:14:59] - Adding Kill Bit for ActiveX for GUID: {FD417378-F411-4B77-BBEE-4893BB670D4C}
[10/16/2008, 11:14:59] - Deleting ATLEvents/MSEvents Registry entries
[10/16/2008, 11:14:59] - Removing HKLM\...\Winlogon\Notify\ljJDSIyW
[10/16/2008, 11:14:59] - Searching for Browser Helper Objects:
[10/16/2008, 11:14:59] - BHO 1: {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - No filename found. Continuing.
[10/16/2008, 11:14:59] - BHO 2: {243B17DE-77C7-46BF-B94B-0B5F309A0E64} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\mnyside
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\mnyside, continuing.
[10/16/2008, 11:14:59] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[10/16/2008, 11:14:59] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/16/2008, 11:14:59] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[10/16/2008, 11:14:59] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/16/2008, 11:14:59] - BHO 7: {af9eb5d0-f09c-4a66-a075-191b948ca4d6} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\eqcvmz
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\eqcvmz, continuing.
[10/16/2008, 11:14:59] - BHO 8: {D92FA155-1849-4C89-9CEF-EAC9F19F97D9} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\tuvSmkli
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\tuvSmkli, continuing.
[10/16/2008, 11:14:59] - BHO 9: {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} ()
[10/16/2008, 11:14:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/16/2008, 11:14:59] - Checking for HKLM\...\Winlogon\Notify\urqQgffF
[10/16/2008, 11:14:59] - Key not found: HKLM\...\Winlogon\Notify\urqQgffF, continuing.
[10/16/2008, 11:14:59] - Finished Searching Browser Helper Objects
[10/16/2008, 11:14:59] - Finishing up...
[10/16/2008, 11:14:59] - A restart is needed.
[10/16/2008, 11:15:07] - Attempting to Restart via STOP error (Blue Screen!)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:09, on 16/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: {6d4ac849-b191-570a-66a4-c90f0d5be9fa} - {af9eb5d0-f09c-4a66-a075-191b948ca4d6} - C:\WINDOWS\system32\eqcvmz.dll
O2 - BHO: (no name) - {E55D18AF-1E0E-4B6F-953F-7C9EC0DC359C} - C:\WINDOWS\system32\urqQgffF.dll (file missing)
O2 - BHO: (no name) - {EC442773-5C70-494A-86ED-067E1415A07E} - C:\WINDOWS\system32\tuvSmkli.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] "C:\WINDOWS\RTHDCPL.EXE"
O4 - HKLM\..\Run: [Alcmtr] "C:\WINDOWS\ALCMTR.EXE"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [bcc12435] rundll32.exe "C:\WINDOWS\system32\jwtpmmgs.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: eqcvmz.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

pouvez-vous m'aider?

Merci

Salut,

fais ceci dans l'ordre :

1- Re -refais ceci stp ,

Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Je répette , choisis l'OPTION 2 !

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
pour analyse ...

une fois ce rapport posté , fais la suite :

2- Télécharges MalwareByte's :
ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
ou ici : http://www.malwarebytes.org/mbam.php

Installes le ( choisis bien "francais" ; ne modifies pas les paramètres d'installe ) et mets le à jour .

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

Potasses le tuto pour te familiariser avec le prg :
https://forum.pcastuces.com/sujet.asp?f=31&s=3
https://www.androidworld.fr/
( cela dis, il est très simple d'utilisation ).

Impératif : Démarrer en mode sans echec .

/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\

Comment aller en Mode sans échec :
1) Redémarres ton ordi .
2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" .
3) Tu tapotes jusqu' à l'apparition de l'écran avec les options de démarrage .
4) Choisis la première option : Sans Échec , et valides en tapant sur [Entrée] .
5) Choisis ton compte habituel ( et pas Administrateur ).
attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...

Lances Malwarebyte's .

Fais un scan dit "complet" ( sélectionnes bien tous tes disks avant le scan ! ) et supprimes tout ce qu'il peut trouver, c'est à dire :
-->Laisses le scan se terminer,puis à la fin tu cliques sur "résultat" .
-->Vérifies que tous les objets infectés soient validés, puis cliques sur " suppression " .

Redémarres ton PC ( mode normal ).

Postes le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date) accompagné d'un nouvel hijackthis ( fait en mode normal ) ...

voici le rapport

-----------\\ ToolBar S&D 1.2.2 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz )
BIOS : Default System BIOS
USER : Sam ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)
C:\ (Local Disk) - NTFS - Total : 73 Go Free : 63 Go
D:\ (Local Disk) - NTFS - Total : 159 Go Free : 154 Go
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (USB)
K:\ (USB)

"C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
Option : [2] ( 16/10/2008|11:39 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskSBar\bar
Supprime! - C:\Program Files\AskSBar\SrchAstt
Supprime! - C:\DOCUME~1\Sam\LOCALS~1\Temp\ICD1.tmp
Supprime! - C:\Program Files\AskSBar

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\Sam\LOCALS~1\Temp\nsg8.tmp
C:\DOCUME~1\Sam\LOCALS~1\Temp\nslA.tmp
C:\DOCUME~1\Sam\LOCALS~1\Temp\nslB.tmp

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.com/?gws_rd=ssl"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

C:\WINDOWS\system32\FffgQqru.ini
C:\WINDOWS\system32\FffgQqru.ini2
C:\WINDOWS\system32\ilkmSvut.ini
C:\WINDOWS\system32\ilkmSvut.ini2
[b]==> VUNDO <==/b

1 - "C:\ToolBar SD\TB_1.txt" - 15/10/2008|15:00 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 15/10/2008|17:08 - Option : [1]
3 - "C:\ToolBar SD\TB_3.txt" - 16/10/2008|11:41 - Option : [2]

-----------\\ Fin du rapport a 11:41:45,57

Enfin !!! Impec ... la suite maintenant ... ;)