Virtumonde

Salut,
tu trouvera tout ici : http://mickael.barroux.free.fr/securite/vundo.php

ok jvé essayer ça!merci beaucoup dorgane :)

Bonsoir vinoth91,

Tu n'as pas de lignes 02 et 020 et je trouve cela louche.

Renomme le fichier HiJackThis.exe en Scanner.exe. Pour cela, fais un clic droit sur le fichier hijackthis.exe et choisis "renommer" dans la liste
Tape Scanner.exe et appuie sur la touche Entrée.

A te lire

salut à toi.j'ai fait comme com tu ma di lineve26,voici le vrai hijack (il semblerait qu'il y a bien virtumonde).

Logfile of HijackThis v1.99.1
Scan saved at 17:28:03, on 02/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\BTTray.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Downloads\eMule0.48a\emule.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Winamp\winamp.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Antipub\antipub.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\steven\Bureau\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3711A0FD-92E1-45F1-9F77-79F7461B02BB} - C:\WINDOWS\system32\jkklk.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\nnnonmm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} - (no file)
O2 - BHO: (no name) - {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NFSUserSIDGSSLink] C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe REG
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Gadwin PrintScreen 3.1] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll
O20 - Winlogon Notify: nnnonmm - C:\WINDOWS\SYSTEM32\nnnonmm.dll
O20 - Winlogon Notify: xxywwwx - xxywwwx.dll (file missing)
O21 - SSODL: gimmicks - {40dcff6e-af8d-4183-8ebe-a82270ac449e} - (no file)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - ATI Technologies Inc. - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Hummingbird Export (HCLExport) - Hummingbird Ltd. - C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

Bonsoir vinoth91,

Eh oui, les voilà, les lignes.
Ton PC est bien infecté !

1) Télécharge Vundofix (par Atribune) sur ton Bureau.

http://www.atribune.org/ccount/click.php?id=4

* Double-clique VundoFix.exe afin de le lancer.
* Clique sur le bouton Scan for Vundo.
* Lorsque le scan est complété, clique sur le bouton Remove Vundo (uniquement si des fichiers infectieux sont trouvés).
* Une invite te demandera si tu veux supprimer les fichiers, clique YES.
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK.
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

2) Télécharge VirtumundoBeGone sur ton bureau .

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

* Double-clique sur VirtumundoBeGone.exe

* Suis les instructions à l'écran

* Quand le scan est terminé, enregistre le rapport.

* Copie/Colle le ici

3) Télécharger smitfraudfix (de S!Ri) sur le bureau.

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

* Clique sur smitfraudfix.exe
* Choisis l'option 1 et colle dans ta réponse le rapport généré par smitfraudfix. Ce rapport se trouve dans la fenêtre du bloc-note qui s’ouvre.
* Ferme l'application en tapant sur la touche Q.

Reviens avec le rapport Vundofix, celui de Virtumondobegone, celui de Smitfraud ainsi qu'un nouveau log hijackthis.

A te lire

re,
voila les 3 rapports,dis moi ce que tu en pense:
le virtumondeBeGone: (j'en ai fait plusieurs lol)

[10/02/2007, 18:26:00] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\steven\Bureau\VirtumundoBeGone.exe" )
[10/02/2007, 18:26:05] - Detected System Information:
[10/02/2007, 18:26:05] - Windows Version: 5.1.2600, Service Pack 2
[10/02/2007, 18:26:06] - Current Username: steven (Admin)
[10/02/2007, 18:26:06] - Windows is in NORMAL mode.
[10/02/2007, 18:26:06] - Searching for Browser Helper Objects:
[10/02/2007, 18:26:06] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/02/2007, 18:26:06] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/02/2007, 18:26:06] - BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[10/02/2007, 18:26:06] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[10/02/2007, 18:26:06] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[10/02/2007, 18:26:06] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - Checking for HKLM\...\Winlogon\Notify\nnnonmm
[10/02/2007, 18:26:06] - Found: HKLM\...\Winlogon\Notify\nnnonmm - This is probably Virtumundo.
[10/02/2007, 18:26:06] - Assigning {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} MSEvents Object
[10/02/2007, 18:26:06] - BHO list has been changed! Starting over...
[10/02/2007, 18:26:06] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/02/2007, 18:26:06] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/02/2007, 18:26:06] - BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[10/02/2007, 18:26:06] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[10/02/2007, 18:26:06] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[10/02/2007, 18:26:06] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} (MSEvents Object)
[10/02/2007, 18:26:06] - ALERT: Found MSEvents Object!
[10/02/2007, 18:26:06] - BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/02/2007, 18:26:06] - BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - No filename found. Continuing.
[10/02/2007, 18:26:06] - BHO 8: {842B5D86-AF2F-4FF2-91BE-0BC8214439AE} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - Checking for HKLM\...\Winlogon\Notify\jkklk
[10/02/2007, 18:26:06] - Found: HKLM\...\Winlogon\Notify\jkklk - This is probably Virtumundo.
[10/02/2007, 18:26:06] - Assigning {842B5D86-AF2F-4FF2-91BE-0BC8214439AE} MSEvents Object
[10/02/2007, 18:26:06] - BHO list has been changed! Starting over...
[10/02/2007, 18:26:06] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/02/2007, 18:26:06] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/02/2007, 18:26:06] - BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[10/02/2007, 18:26:06] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[10/02/2007, 18:26:06] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[10/02/2007, 18:26:06] - BHO 5: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} (MSEvents Object)
[10/02/2007, 18:26:06] - ALERT: Found MSEvents Object!
[10/02/2007, 18:26:06] - BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/02/2007, 18:26:06] - BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - No filename found. Continuing.
[10/02/2007, 18:26:06] - BHO 8: {842B5D86-AF2F-4FF2-91BE-0BC8214439AE} (MSEvents Object)
[10/02/2007, 18:26:06] - ALERT: Found MSEvents Object!
[10/02/2007, 18:26:06] - BHO 9: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/02/2007, 18:26:06] - BHO 10: {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - No filename found. Continuing.
[10/02/2007, 18:26:06] - BHO 11: {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} ()
[10/02/2007, 18:26:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:06] - No filename found. Continuing.
[10/02/2007, 18:26:06] - Finished Searching Browser Helper Objects
[10/02/2007, 18:26:06] - *** Detected MSEvents Object
[10/02/2007, 18:26:06] - Trying to remove MSEvents Object...
[10/02/2007, 18:26:07] - Terminating Process: IEXPLORE.EXE
[10/02/2007, 18:26:07] - Terminating Process: RUNDLL32.EXE
[10/02/2007, 18:26:07] - Disabling Automatic Shell Restart
[10/02/2007, 18:26:07] - Terminating Process: EXPLORER.EXE
[10/02/2007, 18:26:07] - Suspending the NT Session Manager System Service
[10/02/2007, 18:26:07] - Terminating Windows NT Logon/Logoff Manager
[10/02/2007, 18:26:08] - Re-enabling Automatic Shell Restart
[10/02/2007, 18:26:08] - File to disable: C:\WINDOWS\system32\nnnonmm.dll
[10/02/2007, 18:26:08] - Renaming C:\WINDOWS\system32\nnnonmm.dll -> C:\WINDOWS\system32\nnnonmm.dll.vir
[10/02/2007, 18:26:08] - File successfully renamed!
[10/02/2007, 18:26:08] - Removing HKLM\...\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[10/02/2007, 18:26:08] - Removing HKCR\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[10/02/2007, 18:26:08] - Adding Kill Bit for ActiveX for GUID: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
[10/02/2007, 18:26:08] - Deleting ATLEvents/MSEvents Registry entries
[10/02/2007, 18:26:08] - Removing HKLM\...\Winlogon\Notify\nnnonmm
[10/02/2007, 18:26:08] - Searching for Browser Helper Objects:
[10/02/2007, 18:26:08] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/02/2007, 18:26:08] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/02/2007, 18:26:08] - BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[10/02/2007, 18:26:08] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[10/02/2007, 18:26:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:08] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[10/02/2007, 18:26:08] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[10/02/2007, 18:26:08] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/02/2007, 18:26:08] - BHO 6: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/02/2007, 18:26:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:08] - No filename found. Continuing.
[10/02/2007, 18:26:08] - BHO 7: {842B5D86-AF2F-4FF2-91BE-0BC8214439AE} (MSEvents Object)
[10/02/2007, 18:26:08] - ALERT: Found MSEvents Object!
[10/02/2007, 18:26:08] - BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/02/2007, 18:26:08] - BHO 9: {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} ()
[10/02/2007, 18:26:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:08] - No filename found. Continuing.
[10/02/2007, 18:26:08] - BHO 10: {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} ()
[10/02/2007, 18:26:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:08] - No filename found. Continuing.
[10/02/2007, 18:26:08] - Finished Searching Browser Helper Objects
[10/02/2007, 18:26:08] - *** Detected MSEvents Object
[10/02/2007, 18:26:08] - Trying to remove MSEvents Object...
[10/02/2007, 18:26:09] - Terminating Process: IEXPLORE.EXE
[10/02/2007, 18:26:09] - Terminating Process: RUNDLL32.EXE
[10/02/2007, 18:26:09] - Disabling Automatic Shell Restart
[10/02/2007, 18:26:09] - Terminating Process: EXPLORER.EXE
[10/02/2007, 18:26:09] - Suspending the NT Session Manager System Service
[10/02/2007, 18:26:09] - Terminating Windows NT Logon/Logoff Manager
[10/02/2007, 18:26:09] - Re-enabling Automatic Shell Restart
[10/02/2007, 18:26:09] - File to disable: C:\WINDOWS\system32\jkklk.dll
[10/02/2007, 18:26:09] - Renaming C:\WINDOWS\system32\jkklk.dll -> C:\WINDOWS\system32\jkklk.dll.vir
[10/02/2007, 18:26:09] - File successfully renamed!
[10/02/2007, 18:26:09] - Removing HKLM\...\Browser Helper Objects\{842B5D86-AF2F-4FF2-91BE-0BC8214439AE}
[10/02/2007, 18:26:09] - Removing HKCR\CLSID\{842B5D86-AF2F-4FF2-91BE-0BC8214439AE}
[10/02/2007, 18:26:09] - Adding Kill Bit for ActiveX for GUID: {842B5D86-AF2F-4FF2-91BE-0BC8214439AE}
[10/02/2007, 18:26:09] - Deleting ATLEvents/MSEvents Registry entries
[10/02/2007, 18:26:09] - Removing HKLM\...\Winlogon\Notify\jkklk
[10/02/2007, 18:26:09] - Searching for Browser Helper Objects:
[10/02/2007, 18:26:09] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/02/2007, 18:26:09] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/02/2007, 18:26:09] - BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[10/02/2007, 18:26:09] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[10/02/2007, 18:26:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:09] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[10/02/2007, 18:26:09] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[10/02/2007, 18:26:09] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/02/2007, 18:26:09] - BHO 6: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/02/2007, 18:26:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:09] - No filename found. Continuing.
[10/02/2007, 18:26:09] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/02/2007, 18:26:09] - BHO 8: {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} ()
[10/02/2007, 18:26:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:09] - No filename found. Continuing.
[10/02/2007, 18:26:09] - BHO 9: {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} ()
[10/02/2007, 18:26:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:26:09] - No filename found. Continuing.
[10/02/2007, 18:26:09] - Finished Searching Browser Helper Objects
[10/02/2007, 18:26:09] - Finishing up...
[10/02/2007, 18:26:09] - A restart is needed.
[10/02/2007, 18:26:19] - Attempting to Restart via STOP error (Blue Screen!)

[10/02/2007, 18:42:00] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\steven\Bureau\VirtumundoBeGone.exe" )
[10/02/2007, 18:42:06] - User choose NOT to continue. Exiting...

[10/02/2007, 18:43:40] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\steven\Bureau\VirtumundoBeGone.exe" )
[10/02/2007, 18:43:41] - Detected System Information:
[10/02/2007, 18:43:41] - Windows Version: 5.1.2600, Service Pack 2
[10/02/2007, 18:43:41] - Current Username: steven (Admin)
[10/02/2007, 18:43:41] - Windows is in NORMAL mode.
[10/02/2007, 18:43:41] - Searching for Browser Helper Objects:
[10/02/2007, 18:43:41] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/02/2007, 18:43:41] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/02/2007, 18:43:41] - BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[10/02/2007, 18:43:41] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[10/02/2007, 18:43:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:43:41] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[10/02/2007, 18:43:41] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[10/02/2007, 18:43:41] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/02/2007, 18:43:41] - BHO 6: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/02/2007, 18:43:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:43:41] - No filename found. Continuing.
[10/02/2007, 18:43:41] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/02/2007, 18:43:41] - BHO 8: {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} ()
[10/02/2007, 18:43:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:43:41] - No filename found. Continuing.
[10/02/2007, 18:43:41] - BHO 9: {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} ()
[10/02/2007, 18:43:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:43:41] - No filename found. Continuing.
[10/02/2007, 18:43:41] - Finished Searching Browser Helper Objects
[10/02/2007, 18:43:41] - Finishing up...
[10/02/2007, 18:43:41] - Nothing found! Exiting...

[10/02/2007, 18:54:53] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\steven\Bureau\VirtumundoBeGone.exe" )
[10/02/2007, 18:54:54] - Detected System Information:
[10/02/2007, 18:54:54] - Windows Version: 5.1.2600, Service Pack 2
[10/02/2007, 18:54:54] - Current Username: steven (Admin)
[10/02/2007, 18:54:54] - Windows is in NORMAL mode.
[10/02/2007, 18:54:54] - Searching for Browser Helper Objects:
[10/02/2007, 18:54:54] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)
[10/02/2007, 18:54:54] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[10/02/2007, 18:54:54] - BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[10/02/2007, 18:54:54] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[10/02/2007, 18:54:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:54:54] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[10/02/2007, 18:54:54] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[10/02/2007, 18:54:54] - BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/02/2007, 18:54:54] - BHO 6: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/02/2007, 18:54:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:54:54] - No filename found. Continuing.
[10/02/2007, 18:54:54] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[10/02/2007, 18:54:54] - BHO 8: {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} ()
[10/02/2007, 18:54:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:54:54] - No filename found. Continuing.
[10/02/2007, 18:54:54] - BHO 9: {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} ()
[10/02/2007, 18:54:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/02/2007, 18:54:54] - No filename found. Continuing.
[10/02/2007, 18:54:54] - Finished Searching Browser Helper Objects
[10/02/2007, 18:54:54] - Finishing up...
[10/02/2007, 18:54:54] - Nothing found! Exiting...

le smitfraudfix:

irSmitFraudFix v2.234

Rapport fait à 18:49:32,96, 02/10/2007
Executé à partir de C:\Documents and Settings\steven\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe
C:\windows\system32\ldwxrc.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\BTTray.exe
C:\Program Files\Antipub\antipub.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1 forum.arovax.com
127.0.0.1 bleepingcomputer.com
127.0.0.1 www.bleepingcomputer.com
127.0.0.1 download.bleepingcomputer.com
127.0.0.1 boskak.za.net
127.0.0.1 bullguard.com
127.0.0.1 www.bullguard.com
127.0.0.1 castlecops.com
127.0.0.1 www.castlecops.com
127.0.0.1 compu-docs.com
127.0.0.1 www.compu-docs.com
127.0.0.1 forums.us.dell.com
127.0.0.1 depannetonpc.net
127.0.0.1 www.depannetonpc.net
127.0.0.1 forums.digitaltrends.com
127.0.0.1 ewido.net
127.0.0.1 www.ewido.net
127.0.0.1 greyknight17.com
127.0.0.1 www.greyknight17.com
127.0.0.1 forum.idg.pl
127.0.0.1 infos-du-net.com
127.0.0.1 www.infos-du-net.com
127.0.0.1 innovative-sol.com
127.0.0.1 www.innovative-sol.com
127.0.0.1 help.lockergnome.com
127.0.0.1 mytechsupport.ca
127.0.0.1 www.mytechsupport.ca
127.0.0.1 fileinfo.prevx.com
127.0.0.1 siri.urz.free.fr
127.0.0.1 forums.spybot.info
127.0.0.1 cleanup.stevengould.org
127.0.0.1 stevengould.org
127.0.0.1 www.stevengould.org
127.0.0.1 research.sunbelt-software.com
127.0.0.1 spywareinfo.dk
127.0.0.1 www.spywareinfo.dk
127.0.0.1 superantispyware.com
127.0.0.1 www.superantispyware.com
127.0.0.1 forums.techguy.org
127.0.0.1 www.techsupportforum.com
127.0.0.1 forums.tomcoyote.org

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\dr.exe PRESENT !
C:\WINDOWS\Tasks\At?.job PRESENT !
C:\WINDOWS\Tasks\At??.job PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\RegistryCleanerSetup.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\steven

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\steven\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\steven\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://www.google.fr/logos/Logo_25wht.gif"
"SubscribedURL"="http://www.google.fr/logos/Logo_25wht.gif"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{40dcff6e-af8d-4183-8ebe-a82270ac449e}"="gimmicks"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

ET ENFIN LE HIJACK :

Logfile of HijackThis v1.99.1
Scan saved at 18:56:35, on 02/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\BTTray.exe
C:\Program Files\Antipub\antipub.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\steven\Bureau\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} - (no file)
O2 - BHO: (no name) - {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P ] Need for Speed Carbon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NFSUserSIDGSSLink] C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe REG
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Gadwin PrintScreen 3.1] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: xxywwwx - xxywwwx.dll (file missing)
O21 - SSODL: gimmicks - {40dcff6e-af8d-4183-8ebe-a82270ac449e} - (no file)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - ATI Technologies Inc. - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Hummingbird Export (HCLExport) - Hummingbird Ltd. - C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

Re,

Tu as oublié le rapport de Vundofix. Il me le faut !

En attendant, passons à Smitfraud :

1) Imprimer ceci.

* Redémarrer l'ordinateur en mode sans échec en tapotant sur F5 (ou F8). L'accès à Internet devient alors impossible.
* Double cliquer sur Smitfraudfix.exe.
* Sélectionner 2 pour supprimer les fichiers responsables de l'infection.
* A la question Voulez-vous nettoyer le registre ?], répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection. Le fix déterminera si le fichier wininet.dll est infecté.
* A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.
* Quitter le programme en appuyant sur Q.
* Redémarrer normalement et coller sur le forum le rapport généré.

2) Réparation du fichier Hosts :

Télécharge sur ton bureau RHosts (Merci à S!ri)
http://siri.urz.free.fr/Softs/RHosts.exe
Double-clique sur Rhosts.exe et clique sur "restaurer".

Reviens avec le rapport VundoFix, le rapport Smitfraud ( choix2) et un nouveau log hijackthis.

A te lire (je ne serai là que tard, ce soir).

j'ai essayé de refaire un vundofix mais il ne trouve plus de fichiers infectés!jpense qu'il y a plus virtumonde sur le PC. jvé quand même vérifier avec ad-aware si il est toujours présent,si besoin je ferais ce que tu ma dit en dernier.
Quoiqu'il en soit je te remercie beaucoup pour ton aide. A++++

Bonsoir vinoth91,

Poste-moi le rapport vundofix : j'aimerais le voir afin de fixer la ligne 020.

Mais tu es infecté par smitfraud et il faut que tu passes l'option2 de SmitfraudFix.(Réparation).

D'autre part, ton fichier Hosts est corrompu et il faut le restaurer. Regarde mon post au-dessus.

Relance hijackthis pour un scan seulement et coche hors connexion Internet et toutes fenêtres fermées, sauf hijackthis :

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} - (no file)
O2 - BHO: (no name) - {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O20 - Winlogon Notify: xxywwwx - xxywwwx.dll (file missing)

Clique sur "Fix checked" ("Fixer objet") hors connexion.

La ligne 021 est néfaste mais tu dois passer smitfraud avant de la fixer.

Reviens avec le rapport VundoFix, même négatif, celui de smitfraud (option2) ainsi qu'un nouveau log hijackthis.

A te lire

Bonsoir vinoth91,

Ton sujet n'est pas résolu.

Tu dois passer Smitfraud option 2 (qui répare) et restaurer ton fichier Hosts :

Télécharge sur ton bureau RHosts (Merci à S!ri)
http://siri.urz.free.fr/Softs/RHosts.exe
Double-clique sur Rhosts.exe et clique sur "restaurer".

D'autre part, il y a des lignes à fixer dans ton hijackthis.

Reviens !

Bonjour vinoth91,

J'attends ton rapport Smitfraud en mode sans échec.
Tu me l'as envoyé en MP mais tu ne l'avais pas fait en mode sans échec.

Poste tout ici

@+

salut lineve26,
voici le smitfrauf en mode sans échec:

SmitFraudFix v2.234

Rapport fait à 10:54:03,23, 19/10/2007
Executé à partir de C:\Documents and Settings\steven\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonjour vinoth91,

Excuse-moi mais je suis malade.
Je vais demander un relais.

En attendant, poste un nouveau log hijackthis.

Cordialement

Si personne ne passe, j'essaierai de revenir.

En tout cas, il nous faut un log hijackthis.

Cordialement

salut lineve26,
rétabli toi bien. Vu que cette discussion a commencé il y a 2 semaines je ne pense pas que d'autres personnes passeront voir.
a++

Je mets le dernier rapport Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 17:58:54, on 19/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\BTTray.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Antipub\antipub.exe
C:\Downloads\eMule0.48a\emule.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\steven\Bureau\scanner.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} - (no file)
O2 - BHO: (no name) - {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DXM6Patch_981116] "C:\WINDOWS\p_981116.exe" /Q:A
O4 - HKLM\..\Run: [LVComs] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] "C:\WINDOWS\system32\PSDrvCheck.exe" -CheckReg
O4 - HKLM\..\Run: [USB2Check] "RUNDLL32.EXE" "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NFSUserSIDGSSLink] "C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe" REG
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [LDM] "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
O4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe"
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer = 192.168.1.1
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: xxywwwx - xxywwwx.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: MSI Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - ATI Technologies Inc. - (no file)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Hummingbird Export (HCLExport) - Hummingbird Ltd. - C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Bonsoir vinoth91,

lineve26 m'averti ne pas être en mesure de poursuivre ce topic ( ni aucun autre ).

Je te demande donc un peu de patience, le temps que je relise le tout, et je prenne mon repas.

En attendant,
1°- reviens avec les rapports VundoFix qui se trouvent en C:\vundofix.txt via le "Poste de travail" .
2°- avais-tu fais ceci avant de relancer SmitFraudFix en mode sans échec , option 2 :
Télécharge sur ton bureau RHosts (Merci à S!ri)
http://siri.urz.free.fr/Softs/RHosts.exe
Double-clique sur Rhosts.exe et clique sur "restaurer". ?
Merci de m'apporter cette précision.
3°- poste un nouveau rapport HijackThis, svp.
4°- Télécharge ComboFix.exe (par sUBs) sur ton Bureau:
< http://download.bleepingcomputer.com/sUBs/ComboFix.exe > -1,41 Mo (1.483.997 octets)
- Double clique sur l'icône de ComboFix.exe du bureau, [Exécuter] et suis les invites.
Tape 1 puis [Enter] . Accepter les alertes éventuelles. Laisse se dérouler le scan.
Lorsque le scan sera complété, un rapport apparaîtra sur le bureau. ==>Tu copies et colles ce rapport sur le forum

Merci
Al.

(suite)
à faire après avoir exécuté complètement ce que demandé au post précédent.

A)- Je vois que tu n'as pas fixer les lignes en HJT comme demandé par lineve26 .

Explications:

1)- "Fixer une ligne" avec HJT (=HijackThis) signifie la corriger. C'est-à-dire empêcher la mise en œuvre de cette ligne en supprimant son entrée dans la base de registres. C'est de surcroît une solution très incomplète de camouflage qui, si elle n'est pas complétée par des autres actions propres à chaque infection, laisse croire que tout va bien.

2)- Comment "fixer une ligne" ?
- Relancer HJT, et enfoncer le bouton radio « Do a system Scan only », sur la page/rapport qui s'affiche ( laisse-lui le temps de tout scanner ), cocher ensuite la case devant chaque ligne à fixer.
- Ensuite fermer les programmes en cours, SURTOUT LES LOGICIELS AVEC PROTECTION EN TEMPS REEL, (antivirus, Tea Timer de Spybot S&D, AVG-Antispyware, etc)... ( seul HijackThis doit être ouvert ) , et ensuite Clic [Fix checked]
- Parfois il sera nécessaire de fixer les lignes en Mode sans Echec :
< http://cybersecurite.xooit.com/t88-Demarrer-en-Mode-sans-echec.htm >.

3)- Donc, relance HJT « Do a system Scan only », sur la page/rapport qui s'affiche ( laisse-lui le temps de tout scanner ) coche la case devant ces lignes:

-O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
-O2 - BHO: (no name) - {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} - (no file)
-O2 - BHO: (no name) - {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} - (no file)
-O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
-O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
-O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
-O4 - HKLM\..\Run: [DXM6Patch_981116] "C:\WINDOWS\p_981116.exe" /Q:A
-O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
-O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
-O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
-O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
-O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
-O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
-O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
-O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
-O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
-O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
-O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
-O20 - Winlogon Notify: xxywwwx - xxywwwx.dll (file missing)

Ensuite ferme tes programmes en cours, SURTOUT LES LOGICIELs AVEC PROTECTION EN TEMPS REEL, (antivirus, tea timer, ewido, ad-watch)... ( seul HijackThis doit être ouvert ) , et ensuite Clic [Fix checked]

B)- Je ne connais pas ceci ( peux-tu me dire si tu connais ? ):
O4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe"
Et si tu l'utilises, connais-tu ceci : https://fr.creative.com/ ? (qui pourrait t'aider).

C)- O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
==> on est à la version 8.1 ==> Vas là: < https://get2.adobe.com/reader/otherversions/ >
L'installation d' une nouvelle version désinstallera l' ancienne si besoin est.
Dans le cas contraire rendez-vous dans le panneau de configuration, ajout/suppr. de programmes et désinstaller l' ancienne version si elle existe toujours .

D)- 2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
==> Ce qui veut dire que ta console Java n'est pas à jour !
Une vulnérabilité a été identifiée dans Sun JDK et JRE sur les versions 1.6.0_02; elle pourrait être exploitée par des attaquants distants afin de compromettre un système vulnérable.
Vas chez Java Sun < https://www.java.com/fr/download/manual.jsp > et télécharge la dernière Version 6 Update3.
Après installation et redémarrage, vas dans le "panneau de configuration"/"Ajout-Suppr. de programmes" afin de désinstaller les anciennes versions.
Ceci pour récupérer de l'espace disque et éventuellement pour virer les failles présentes dans ces anciennes versions.
Retourne alors chez Java ci-dessus et clique sur le bouton "Vérifier l'installation" pour t'assurer que tout est en ordre.

Une fois JRE installé, dans votre « console de paramétrage », accessible depuis le « Panneau de configuration », choisir l’onglet "Java", puis dans "paramètres de l'application Java Runtime", clic sur bouton "afficher", vous accédez à cet écran."
Source: http://www.libellules.ch/dotclear/index.php?2007/02/03/1671-java-toutes-petites-astuces
Vous pouvez « Désactiver la console = Ne pas lancer la console » et « Désactiver l'icône de la Systray depuis l'onglet "avancé" ( http://www.java.com/fr/download/help/5000021000.xml ).

E)- C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C'est un prog espion qui soi-disant sert à faire des mises a jour...
... mais rien n'est prouvé et il semblerait qu'il soit plus espion que programme de mise à jour.
-Mais il peut aussi se trouver dans d'autres programmes.
-Le problème majeur étant qu'il provoque une faille de sécurité.

-•Pour résoudre ce type de problèmes en dehors du fait qu'il expose votre vie privée aux fournisseurs:
-Désinstaller "Logitech Desktop Messenger" dans « Panneau de Configuration » > "Ajout/Suppr.de programmes" et le prog « backweb-8876480.exe » disparaîtra.
- Il ne sert pas à grand-chose sinon à bouffer de la mémoire et de la bande passante internet.
- Les mises à jour de logiciels "Logitech" se font aisément à partir des progs eux-mêmes ( en manuel : tu cliques sur la miniature de ta WebCam près de l’horloge ), donc pas de soucis de ce côté.
Une fiche bien détaillée :< http://assiste.com.free.fr/p/parasites/backweb.html >

F)- Dis-moi quelle est ta version de BitDefender ? Est-ce BitDefender Internet Security ?

À demain si tu veux.
Courage
Al

bonjour afideg,
voila ce que j'ai fait suite à tes deux posts:

un rapport vundofix:

VundoFix V6.5.9

Checking Java version...

Java version is 1.4.2.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 08:54:03 18/10/2007

Listing files found while scanning....

No infected files were found.

VundoFix V6.5.9

Checking Java version...

Java version is 1.4.2.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 10:25:13 21/10/2007

Listing files found while scanning....

No infected files were found.

une restauration du fichier host suivie d'un scan smitfraud mode 2 en mode sans échec (on appuie quel bouton pour démarrer en mode sans échec?ça mévitera d'appuyer sur reset comme un barbare :) )

SmitFraudFix v2.234

Rapport fait à 10:52:50,56, 21/10/2007
Executé à partir de C:\Documents and Settings\steven\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

puis un rapport Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 11:08:31, on 21/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\MSI\BToes Logiciel Bluetooth\BTTray.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Antipub\antipub.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\steven\Bureau\scanner.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C0982322-2A6C-4022-92F1-C7CB9F86DCC8} - (no file)
O2 - BHO: (no name) - {DAF96338-9706-4F6B-B9F8-8663EC32D6B2} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DXM6Patch_981116] "C:\WINDOWS\p_981116.exe" /Q:A
O4 - HKLM\..\Run: [LVComs] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] "C:\WINDOWS\system32\PSDrvCheck.exe" -CheckReg
O4 - HKLM\..\Run: [USB2Check] "RUNDLL32.EXE" "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NFSUserSIDGSSLink] "C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe" REG
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe"
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\MSI\BToes Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://drivers1.free.fr/telecharger.php?id=2&version=
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F72394A-CE84-44BA-85BA-0BCFDD6E6759}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A825B2CE-D91E-4400-BCB1-6D63E00EEE7B}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: xxywwwx - xxywwwx.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: MSI Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - ATI Technologies Inc. - (no file)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\MSI\BToes Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Hummingbird Export (HCLExport) - Hummingbird Ltd. - C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

j'avais aussi une question à ta poser afideg, quelle est la politique du site commentçamarche vis à vis du fait que les utilisateurs possèdent des logiciels payant qu'ils ont téléchargés gratuitement? a++

ci-joint le rapport combofix:

ComboFix 07-10-20.6 - steven 2007-10-21 11:19:36.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1489 [GMT 2:00]
Running from: C:\Documents and Settings\steven\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\delphine\Application Data\macromedia\Flash Player\#SharedObjects\7E5K2HTC\www.broadcaster.com
C:\Documents and Settings\delphine\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\delphine\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\delphine\err.log
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\#SharedObjects\6ETNJV47\iforex.com
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\#SharedObjects\6ETNJV47\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\#SharedObjects\6ETNJV47\www.broadcaster.com
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\#SharedObjects\6ETNJV47\www.broadcaster.com\bc_video_vars.sol
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\#SharedObjects\6ETNJV47\www.broadcaster.com\played_list.sol
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\#SharedObjects\6ETNJV47\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\papa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\papa\Application Data\SSEMBL~1
C:\Documents and Settings\papa\err.log
C:\Documents and Settings\steven\err.log
C:\Program Files\Fichiers communs\{4C766~1
C:\Program Files\Fichiers communs\{4C766~2
C:\WINDOWS\dobe~1
C:\WINDOWS\system32\avgwlntf.dll
c:\WINDOWS\system32\ldwxrc.dat
C:\WINDOWS\system32\ldwxrc.dat
c:\windows\system32\ldwxrc.exe
C:\WINDOWS\system32\ldwxrc.exe
C:\WINDOWS\system32\ldwxrc_nav.dat
c:\WINDOWS\system32\ldwxrc_nav.dat
C:\WINDOWS\system32\ldwxrc_navps.dat
c:\WINDOWS\system32\ldwxrc_navps.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CLIENT_IP-IPX
-------\LEGACY_FOPN

((((((((((((((((((((((((((((( Fichiers créés 2007-09-21 to 2007-10-21 ))))))))))))))))))))))))))))))))))))
.

2007-10-21 11:17 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-20 10:34 <REP> d-------- C:\[DVD-R]Top 50 of HARIHARAN [Compress]
2007-10-19 18:59 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-10-19 18:55 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-10-13 00:09 <REP> d-------- C:\Program Files\SpywareBlaster
2007-10-12 19:40 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-10-12 19:36 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-10-12 19:33 164 --a------ C:\install.dat
2007-10-12 19:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2007-10-10 21:28 <REP> d-------- C:\Program Files\Hitman Pro
2007-10-05 18:56 470,048 --a------ C:\WINDOWS\system32\drivers\ar5211.sys
2007-10-05 18:56 470,048 --a------ C:\WINDOWS\system32\ar5211.sys
2007-10-05 18:40 <REP> d-------- C:\Program Files\RALINK
2007-10-05 18:40 <REP> d-------- C:\Documents and Settings\steven\Application Data\InstallShield
2007-10-05 17:44 385,024 --a------ C:\WINDOWS\system32\athcfg11.dll
2007-10-05 17:44 249,856 --a------ C:\WINDOWS\system32\wgapi.dll
2007-10-05 17:44 237,568 --a------ C:\WINDOWS\system32\wcapi.dll
2007-10-05 17:44 77,824 --a------ C:\WINDOWS\system32\athcfg11res.dll
2007-10-05 17:44 36,864 --a------ C:\WINDOWS\system32\acs.exe
2007-10-05 17:44 21,419 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2007-10-05 16:45 1,396,835 --a------ C:\WINDOWS\system32\AegisE5.dll
2007-10-05 16:45 315,392 --a------ C:\WINDOWS\system32\AegisI5.exe
2007-10-03 20:30 <REP> d-------- C:\Program Files\Neuf
2007-10-02 22:11 <REP> d-------- C:\Documents and Settings\delphine\Application Data\Bitdefender
2007-10-02 21:41 <REP> d-------- C:\Documents and Settings\papa\Application Data\Bitdefender
2007-10-02 21:02 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-10-02 20:35 <REP> d-------- C:\Documents and Settings\steven\Application Data\Bitdefender
2007-10-02 20:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2007-10-02 20:32 <REP> d-------- C:\bitdefender
2007-10-02 20:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-10-02 18:49 4,130 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-02 18:48 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-02 18:48 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-02 18:48 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-02 18:48 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-02 18:48 25,088 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-09-30 15:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-09-30 10:38 <REP> d-------- C:\Documents and Settings\steven\Application Data\Samsung
2007-09-30 10:35 174,592 --a------ C:\WINDOWS\system32\framedyn.dll
2007-09-30 10:34 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-09-30 10:33 <REP> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2007-09-30 10:33 <REP> d-------- C:\Program Files\Samsung
2007-09-30 10:33 94,000 --a------ C:\WINDOWS\system32\drivers\ssm_mdm.sys
2007-09-30 10:33 58,320 --a------ C:\WINDOWS\system32\drivers\ssm_bus.sys
2007-09-30 10:33 8,336 --a------ C:\WINDOWS\system32\drivers\ssm_mdfl.sys
2007-09-30 10:33 6,176 --a------ C:\WINDOWS\system32\drivers\ssm_cmnt.sys
2007-09-30 10:33 6,176 --a------ C:\WINDOWS\system32\drivers\ssm_cm.sys
2007-09-30 10:33 5,840 --a------ C:\WINDOWS\system32\drivers\ssm_whnt.sys
2007-09-30 10:33 5,840 --a------ C:\WINDOWS\system32\drivers\ssm_wh.sys
2007-09-29 09:56 <REP> d-------- C:\Documents and Settings\steven\Application Data\CyberLink
2007-09-29 09:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2007-09-29 05:21 9,854,976 --a------ C:\WINDOWS\system32\atioglx2.dll
2007-09-29 05:07 356,352 --a------ C:\WINDOWS\system32\ATIDEMGX.dll
2007-09-29 04:58 143,360 --a------ C:\WINDOWS\system32\atipdlxx.dll
2007-09-29 04:58 26,112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2007-09-29 04:55 53,248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2007-09-29 04:49 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-09-29 04:47 172,032 --a------ C:\WINDOWS\system32\atiok3x2.dll
2007-09-29 04:36 3,107,788 --a------ C:\WINDOWS\system32\ativvaxx.dat
2007-09-29 04:36 3,107,788 --a------ C:\WINDOWS\system32\ativva5x.dat
2007-09-29 04:36 972,072 --a------ C:\WINDOWS\system32\ativva6x.dat
2007-09-29 04:23 5,435,392 --a------ C:\WINDOWS\system32\atioglxx.dll
2007-09-29 04:20 17,408 --a------ C:\WINDOWS\system32\atitvo32.dll
2007-09-28 22:02 <REP> d-------- C:\Program Files\CyberLink
2007-09-28 21:42 <REP> d-------- C:\Cyberlink.PowerDVD.Ultra.Deluxe.v7.3.Multilingual.Incl.Keygen-ViRiLiTY
2007-09-28 19:11 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2007-09-28 18:30 <REP> d-------- C:\VundoFix Backups
2007-09-26 22:29 <REP> d-------- C:\divx

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-19 20:30 --------- d-----w C:\Program Files\Logitech
2007-10-19 16:57 --------- d-----w C:\Program Files\ATI Technologies
2007-10-19 16:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-18 21:01 5,767,168 ----a-w C:\Documents and Settings\élodie\NTUSER.DAT
2007-10-12 23:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-12 22:13 --------- d-----w C:\Documents and Settings\steven\Application Data\Lavasoft
2007-10-12 22:09 --------- d-----w C:\Program Files\Lavasoft
2007-10-12 19:23 --------- d-----w C:\Documents and Settings\steven\Application Data\Winamp
2007-10-11 12:58 --------- d-----w C:\Documents and Settings\delphine\Application Data\Winamp
2007-10-10 20:46 --------- d-----w C:\Program Files\MSI
2007-10-10 19:15 --------- d-----w C:\Program Files\Winamp
2007-10-02 13:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-02 05:39 287,254 ----a-w C:\WINDOWS\system32\nnnonmm.dll.vir
2007-09-30 15:58 78,415 ----a-w C:\WINDOWS\system32\drivers\klif.cab
2007-09-30 07:56 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-09-30 07:29 --------- d-----w C:\Program Files\Antipub
2007-09-29 14:55 --------- d-----w C:\Program Files\BitComet
2007-09-29 09:58 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2007-09-29 05:46 47,376 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
2007-09-29 03:06 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-09-29 03:05 2,456,064 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-09-29 02:58 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-09-29 02:58 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-09-29 02:57 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-09-29 02:56 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-09-29 02:47 3,130,720 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-09-29 02:36 1,593,600 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-09-29 02:22 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-09-29 02:19 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-09-29 02:14 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-09-28 17:55 --------- d-----w C:\Program Files\DivX
2007-09-28 15:23 --------- d-----w C:\Program Files\eMule
2007-09-24 20:27 --------- d-----w C:\Program Files\Java
2007-09-17 18:23 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-09-17 18:23 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-09-17 18:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-09-17 18:22 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
2007-09-11 23:14 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-08-21 00:26 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-08-21 00:26 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-08-15 22:33 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-08-15 22:33 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 22:33 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-08-15 22:33 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-08-15 22:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-08-15 22:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-08-15 22:31 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-08-15 22:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-08-15 22:30 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-26 23:06 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-07-26 23:06 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-07-26 23:06 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-07-24 07:57 266,304 ----a-w C:\WINDOWS\system32\jkklk.dll.vir
2007-07-24 07:48 86,016 ----a-w C:\WINDOWS\system32\wvusstr.exe
2007-07-24 07:48 66,068 ----a-w C:\WINDOWS\system32\ritywmwr.exe
2007-07-23 21:06 66,068 ----a-w C:\WINDOWS\system32\fhxhuepp.exe
2007-07-23 07:56 66,068 ----a-w C:\WINDOWS\system32\qomwbanu.exe
2007-07-22 14:46 66,068 ----a-w C:\WINDOWS\system32\dhelhdnu.exe
2007-07-21 14:45 66,068 ----a-w C:\WINDOWS\system32\lvvtqkog.exe
2007-07-21 13:47 66,068 ----a-w C:\WINDOWS\system32\usirdaad.exe
2007-04-22 10:34 390 ----a-w C:\Documents and Settings\steven\kill-fluent-SCANNAYA-1280.bat
2006-11-05 14:54 390 ----a-w C:\Documents and Settings\steven\kill-fluent-SCANNAYA-6028.bat
2006-07-18 13:41 1,019,094 --sha-r C:\Program Files\serial.tde
2006-05-28 16:46 397,306 --sha-r C:\Program Files\wunauclt.zip
2006-05-28 16:46 397,306 --sha-r C:\Program Files\wunauclt.tbe
2002-07-26 16:02 153,088 ----a-w C:\Program Files\UNWISE.EXE
2006-08-26 13:29:58 12,208 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C0982322-2A6C-4022-92F1-C7CB9F86DCC8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DAF96338-9706-4F6B-B9F8-8663EC32D6B2}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-17 20:25]
"DXM6Patch_981116"="C:\WINDOWS\p_981116.exe" [1998-11-30 18:04]
"BluetoothAuthenticationAgent"="rundll32.exe" [2004-08-04 00:55 C:\WINDOWS\system32\rundll32.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 02:36]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 00:26]
"USB2Check"="RUNDLL32.exe" [2004-08-04 00:55 C:\WINDOWS\system32\rundll32.exe]
"USBToolTip"="C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2006-01-23 16:42]
"SoundMan"="SOUNDMAN.EXE" [2006-06-21 06:42 C:\WINDOWS\soundman.exe]
"VirtualCloneDrive"="C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2004-08-20 12:28]
"I downloaded pirated Software from P2P "="Need for Speed Carbon" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"NFSUserSIDGSSLink"="C:\Program Files\Hummingbird\Connectivity\11.00\NFS Maestro\HumGSS.exe" [2005-09-21 07:47]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-10-12 19:31]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49]
"Autoconfigurateur WiFi Neuf"="C:\Program Files\Neuf\Kit\WiFi\9wifi.exe" [2007-09-09 01:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-09-13 14:17]
"CTZDetec.exe"="C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" [2007-05-15 20:25]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxywwwx]
xxywwwx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl
R2 CTDevice_Srv;CT Device Query service;C:\Program Files\Creative\Shared Files\CTDevSrv.exe
R2 HCLExport;Hummingbird Export;"C:\WINDOWS\system32\Hummingbird\Connectivity\11.00\NFS Maestro\expserv.exe"
R2 HCLNFS;HCLNFS;\??\C:\WINDOWS\system32\drivers\hclnfs.sys
R2 HPFECP13;HPFECP13;C:\WINDOWS\system32\drivers\HPFECP13.sys
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys
R3 PPPoEWin;PPPoEWin Miniport;C:\WINDOWS\system32\DRIVERS\PPPoEWin.SYS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8c86cab5-f40b-11da-a7df-806d6172696f}]
AutoRun\command - F:\ASUSACPI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FE827D64-FD1F-40B4-86B1-F3683B7D7959}]
"C:\Program Files\Hummingbird\Connectivity\11.00\Accessories\HumSettings.exe" INSTALL=ALL
.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-21 11:25:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-21 11:26:16 - machine was rebooted
.
--- E O F ---

B) CREATIVE MEDIA LITE c'est le logiciel du lecteur MP3 portable à ma soeur.

C) et D) les mises à jour ont été faites sans problèmes pour JAVA j'ai pas réussi a trouver la version JAVA de base comme indiqué sur le tutorial que tu ma filé j'ai juste activé la version 1.6.0_03

E) ce logiciel desktop messenger est bizarre,je sais si c'est vraiment celui de ma webcam: de toute façon je viens de le supprimer,je réinstallerais celui de la cam si besoin.

F)c'est bitdefender antivirus plus v10 (y a un antivirus,un firewall,un antispam)

Je pense avoir fait tout ce qu'il faut. Quoiqu'il en soit merci beaucoup de ton aide. :)