Real Virus • page 2

[Chrislall]

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1445
Windows 5.1.2600 Service Pack 3

02/12/2008 17:24:39
mbam-log-2008-12-02 (17-24-39).txt

Type de recherche: Examen complet (C:|)
Eléments examinés: 374217
Temps écoulé: 2 hour(s), 30 minute(s), 0 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 9
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
C:WINDOWSsystem32frmwrk32.exe (Trojan.FakeAlert) -> Failed to unload process.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunFramework Windows (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit (Trojan.Agent) -> Data: c:windowssystem32userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit (Trojan.Agent) -> Data: system32userinit.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktopNoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesactivedesktopNoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerNoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerNoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerNoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerNoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Il y avait une fichier infecté, mais j'ai fait les suppressions recommandées d'une liste de et le reste est parti au redemarrage.
J'ai retrouvé mon bureau vide !!! On est sur le bon chemin. Maintenant je vais faire le hijackthis que tu m'as demandé. Voir ci-dessous le rapport mbam


Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:System Volume Information\_restore{47D18132-A6FA-4CBC-9333-D19F3F53B02A}RP107A0019290.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:WINDOWSsystem32warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:WINDOWSsystem32ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:WINDOWSsystem32frmwrk32.exe (Trojan.FakeAlert) -> Delete on reboot.

[Chrislall]

Dis-moi s'il te plait ce que je dois faire de la fenêtre hijackthis toujours ouverte. Merci


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:34:55, on 02/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWiFiinS24EvMon.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32LVCOMSX.EXE
C:WINDOWSsystem32ElkCtrl.exe
C:Program FilesBrotherBrmfcmonBrMfcWnd.exe
C:Program FilesJavajre1.6.0_07injusched.exe
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:WINDOWSsystem32agrsmsvc.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesIntelWiFiinEvtEng.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesBrotherControlCenter3rccMCtl.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesIncrediMailinIMApp.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesBrotherBrmfcmonBrMfimon.exe
C:Documents and SettingsChristianBureauSniffle.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:Program FilesTechSmithSnagIt 9SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:Program FilesRealRealPlayer pbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07inssv.dll
O2 - BHO: AL2Spy Class - {DC200356-0864-4F66-8964-5D43A19300F5} - C:WINDOWSAUTOLO~1AL2DLL.dll (file missing)
O3 - Toolbar: Barre de Traduction IdiomaX - {477A7A3C-8B11-4B02-ADD1-7A01C4D00FA2} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:Program FilesTechSmithSnagIt 9SnagItIEAddin.dll
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [LVCOMSX] C:WINDOWSsystem32LVCOMSX.EXE
O4 - HKLM..Run: [LogitechCameraService(E)] C:WINDOWSsystem32ElkCtrl.exe /automation
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [BrMfcWnd] C:Program FilesBrotherBrmfcmonBrMfcWnd.exe /AUTORUN
O4 - HKLM..Run: [ControlCenter3] C:Program FilesBrotherControlCenter3rctrcen.exe /autorun
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07injusched.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [SpywareCleaner] C:WINDOWSsystem32SpywareRemover.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [IncrediMail] C:Program FilesIncrediMailinIncMail.exe /c
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra button: Montrer/Cacher la Barre de Traduction - {FE768A8F-9F88-4511-B28B-552ED2F6B500} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O10 - Broken Internet access because of LSP provider 'c:program filesonjourmdnsnsp.dll' missing
O15 - Trusted Zone: http://www.incredimail.com
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005 ... scan53.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwarede ... _0_3_1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL ... 586-jc.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:WINDOWSsystem32agrsmsvc.exe
O23 - Service: ASKService - Unknown owner - C:Program FilesAskBarDisarinAskService.exe (file missing)
O23 - Service: ASKUpgrade - Unknown owner - C:Program FilesAskBarDisarinASKUpgrade.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:Program FilesBonjourmDNSResponder.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:Program FilesFichiers communsBOONTY SharedServiceBoonty.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:Program FilesIntelWiFiinEvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:Program FilesFichiers communsMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesFichiers communsLogishrdBluetoothLBTServ.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:Program Filesma-config.commaconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 - Service: NMIndexingService - Nero AG - C:Program FilesFichiers communsNeroLibNMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:WINDOWSsystem32IoctlSvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:Program FilesIntelWiFiinS24EvMon.exe

--
End of file - 9092 bytes

[r@in | b0w]

Tu supprimes les lignes:

O2 - BHO: AL2Spy Class - {DC200356-0864-4F66-8964-5D43A19300F5} - C:WINDOWSAUTOLO~1AL2DLL.dll (file missing)
O4 - HKLM..Run: [SpywareCleaner] C:WINDOWSsystem32SpywareRemover.exe
O4 - HKCU..Run: [IncrediMail] C:Program FilesIncrediMailinIncMail.exe /c
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O10 - Broken Internet access because of LSP provider 'c:program filesonjourmdnsnsp.dll' missing
O23 - Service: ASKService - Unknown owner - C:Program FilesAskBarDisarinAskService.exe (file missing)
O23 - Service: ASKUpgrade - Unknown owner - C:Program FilesAskBarDisarinASKUpgrade.exe (file missing


_ Tu as encore le rogue SpywareRemover.

Tu télécharges RogueRemover.

Tu le lances ensuite avec un double-clic, une fenêtre d'avertissement s'ouvrira pour chercher des mises-à-jour, tu cliques sur Ok.

S'il y a des MAJ (mises-à-jour) disponibles, tu cliques sur le bouton Ok puis sur Download.
Sinon, simplement Ok.

Tu arriveras sur l'accueil de l'utilitaire, tu cliques sur Scan tout simplement.
A la fin et si des éléments sont détectés, tu les laisses cochés puis tu cliques sur Remove selected.
Une fenêtre d'avertissement t'informera ensuite que tu vas transmettre des informations au sujet de ton infection, tu cliques sur Yes pour le faire, sachant qu'il n'y a pas de données personnelles.

Par la suite, tu vas chercher le rapport ici: C:Program FilesRogueRemover.

Tu copies-colles le rapport dans ton prochain message.

[Chrislall]

Je ne comprends pas, après le scan il me dit : congratulations, rogueremover did not detect any itemps ???????
Donc il n'y a pas de rapport à cause de ça, je pense.
Merci encore, vraiment sympa

[r@in | b0w]

Ok.

Tu redémarres en Mode sans échec et tu supprimes le fichier C:WINDOWSsystem32SpywareRemover.exe.

Tu fais ensuite un nouveau scan HiJackThis & un scan Mbam.

[Chrislall]

Re J'ai supprimé en mode sans echec le fichier Spyware remover.exe
_________________________________________________________

J'ai eu cette réponse la, lorsque j'ai voulu fixer dans hijackthis ???

Hijackthis cannot repair O10 Winsock LSP entries.
You should use LSPFix for that, which is available from http://www.cexx.org/lspfix.htm.
If the O10 item belongs to Webhancer, New.Net or CommonName, Spybot S&D can remobe it automatically.

NOUVEAU HIJACKTHIS ----------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:17:25, on 03/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWiFiinS24EvMon.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
C:WINDOWSsystem32agrsmsvc.exe
C:Program FilesIntelWiFiinEvtEng.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32LVCOMSX.EXE
C:WINDOWSsystem32ElkCtrl.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:Program FilesBrotherBrmfcmonBrMfcWnd.exe
C:Program FilesJavajre1.6.0_07injusched.exe
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:Program FilesBrotherControlCenter3rccMCtl.exe
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesBrotherBrmfcmonBrMfimon.exe
C:Program FilesIncrediMailinIMApp.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsChristianBureauSniffle.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:Program FilesTechSmithSnagIt 9SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:Program FilesRealRealPlayer pbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07inssv.dll
O3 - Toolbar: Barre de Traduction IdiomaX - {477A7A3C-8B11-4B02-ADD1-7A01C4D00FA2} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:Program FilesTechSmithSnagIt 9SnagItIEAddin.dll
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [LVCOMSX] C:WINDOWSsystem32LVCOMSX.EXE
O4 - HKLM..Run: [LogitechCameraService(E)] C:WINDOWSsystem32ElkCtrl.exe /automation
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [BrMfcWnd] C:Program FilesBrotherBrmfcmonBrMfcWnd.exe /AUTORUN
O4 - HKLM..Run: [ControlCenter3] C:Program FilesBrotherControlCenter3rctrcen.exe /autorun
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07injusched.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [SpywareCleaner] C:WINDOWSsystem32SpywareRemover.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra button: Montrer/Cacher la Barre de Traduction - {FE768A8F-9F88-4511-B28B-552ED2F6B500} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O10 - Broken Internet access because of LSP provider 'c:program filesonjourmdnsnsp.dll' missing
O15 - Trusted Zone: http://www.incredimail.com
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005 ... scan53.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwarede ... _0_3_1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL ... 586-jc.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:WINDOWSsystem32agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:Program FilesBonjourmDNSResponder.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:Program FilesFichiers communsBOONTY SharedServiceBoonty.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:Program FilesIntelWiFiinEvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:Program FilesFichiers communsMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesFichiers communsLogishrdBluetoothLBTServ.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:Program Filesma-config.commaconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 - Service: NMIndexingService - Nero AG - C:Program FilesFichiers communsNeroLibNMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:WINDOWSsystem32IoctlSvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:Program FilesIntelWiFiinS24EvMon.exe

--
End of file - 8697 bytes
JE FAIS LE Mbam ET JE TE L'ENVOIE... demain ! Bonne nuit !

[Chrislall]

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1450
Windows 5.1.2600 Service Pack 3

03/12/2008 07:02:24
mbam-log-2008-12-03 (07-02-24).txt

Type de recherche: Examen complet (C:|)
Eléments examinés: 341072
Temps écoulé: 2 hour(s), 8 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1450
Windows 5.1.2600 Service Pack 3

03/12/2008 07:02:24
mbam-log-2008-12-03 (07-02-24).txt

Type de recherche: Examen complet (C:|)
Eléments examinés: 341072
Temps écoulé: 2 hour(s), 8 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

[r@in | b0w]

Bonjour.

Ce n'est pas fini, O4 - HKLM..Run: [SpywareCleaner] C:WINDOWSsystem32SpywareRemover.exe.

Tu l'as supprimé précédemment? Si oui, on va relancer SmitfraudFix.

Si non, tu la supprimes, fais un nouveau scan HiJackThis et si la ligne est encore là, tu vas en Mode sans échec pour la supprimer.

Puis nouveau scan pour constater.

Tiens-nous au jus.

[Chrislall]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:38:56, on 03/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWiFiinS24EvMon.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
C:WINDOWSsystem32agrsmsvc.exe
C:Program FilesIntelWiFiinEvtEng.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32LVCOMSX.EXE
C:WINDOWSsystem32ElkCtrl.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:Program FilesBrotherBrmfcmonBrMfcWnd.exe
C:Program FilesJavajre1.6.0_07injusched.exe
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:Program FilesBrotherControlCenter3rccMCtl.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesBrotherBrmfcmonBrMfimon.exe
C:Program FilesIncrediMailinIMApp.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsChristianBureauSniffle.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:Program FilesTechSmithSnagIt 9SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:Program FilesRealRealPlayer pbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07inssv.dll
O3 - Toolbar: Barre de Traduction IdiomaX - {477A7A3C-8B11-4B02-ADD1-7A01C4D00FA2} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:Program FilesTechSmithSnagIt 9SnagItIEAddin.dll
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [LVCOMSX] C:WINDOWSsystem32LVCOMSX.EXE
O4 - HKLM..Run: [LogitechCameraService(E)] C:WINDOWSsystem32ElkCtrl.exe /automation
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [BrMfcWnd] C:Program FilesBrotherBrmfcmonBrMfcWnd.exe /AUTORUN
O4 - HKLM..Run: [ControlCenter3] C:Program FilesBrotherControlCenter3rctrcen.exe /autorun
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07injusched.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..RunOnce: [Malwarebytes' Anti-Malware] C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe /install /silent
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra button: Montrer/Cacher la Barre de Traduction - {FE768A8F-9F88-4511-B28B-552ED2F6B500} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O10 - Broken Internet access because of LSP provider 'c:program filesonjourmdnsnsp.dll' missing
O15 - Trusted Zone: http://www.incredimail.com
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005 ... scan53.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwarede ... _0_3_1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL ... 586-jc.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:WINDOWSsystem32agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:Program FilesBonjourmDNSResponder.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:Program FilesFichiers communsBOONTY SharedServiceBoonty.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:Program FilesIntelWiFiinEvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:Program FilesFichiers communsMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesFichiers communsLogishrdBluetoothLBTServ.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:Program Filesma-config.commaconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 - Service: NMIndexingService - Nero AG - C:Program FilesFichiers communsNeroLibNMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:WINDOWSsystem32IoctlSvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:Program FilesIntelWiFiinS24EvMon.exe

--
End of file - 8658 bytes


_____________________________________________________________

Fait ensuite en mode 1 "Recherche"

SmitFraudFix v2.380

Rapport fait à 13:41:16,57, 03/12/2008
Executé à partir de C:Documents and SettingsChristianBureauSmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWiFiinS24EvMon.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
C:WINDOWSsystem32agrsmsvc.exe
C:Program FilesIntelWiFiinEvtEng.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32LVCOMSX.EXE
C:WINDOWSsystem32ElkCtrl.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:Program FilesBrotherBrmfcmonBrMfcWnd.exe
C:Program FilesJavajre1.6.0_07injusched.exe
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:Program FilesBrotherControlCenter3rccMCtl.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesBrotherBrmfcmonBrMfimon.exe
C:Program FilesIncrediMailinIMApp.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:


»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem

[r@in | b0w]

Tu supprimes les lignes d'HiJackThis que je te donne ou pas?

Pour le rapport SmitfraudFix, il manque la fin...

[Chrislall]

Oups, excuse-moi ! Voici le rapport total. A+

SmitFraudFix v2.380

Rapport fait à 13:41:16,57, 03/12/2008
Executé à partir de C:Documents and SettingsChristianBureauSmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWiFiinS24EvMon.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
C:WINDOWSsystem32agrsmsvc.exe
C:Program FilesIntelWiFiinEvtEng.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32LVCOMSX.EXE
C:WINDOWSsystem32ElkCtrl.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:Program FilesBrotherBrmfcmonBrMfcWnd.exe
C:Program FilesJavajre1.6.0_07injusched.exe
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:Program FilesBrotherControlCenter3rccMCtl.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesBrotherBrmfcmonBrMfimon.exe
C:Program FilesIncrediMailinIMApp.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:


»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem


»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSWeb


»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem32


»»»»»»»»»»»»»»»»»»»»»»»» C:Documents and SettingsChristian


»»»»»»»»»»»»»»»»»»»»»»»» C:DOCUME~1CHRIST~1LOCALS~1Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:Documents and SettingsChristianApplication Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:DOCUME~1CHRIST~1Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDesktopComponents]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLMSYSTEMCCSServicesTcpip..{F7D42882-11B8-4519-B7CD-67369A023A0D}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS1ServicesTcpip..{F7D42882-11B8-4519-B7CD-67369A023A0D}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS3ServicesTcpip..{F7D42882-11B8-4519-B7CD-67369A023A0D}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCCSServicesTcpipParameters: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS1ServicesTcpipParameters: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS3ServicesTcpipParameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

[r@in | b0w]

Ok, toujours rien de trouvé.

Regarde si l'application C:WINDOWSsystem32SpywareRemover.exe existe toujours ou pas.

[Chrislall]

Non C:WINDOWSsystem32SpywareRemover.exe
n'existe plus....

[r@in | b0w]

Ok.

Tu fais un nouveau scan HiJackThis alors.

[Chrislall]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:23:20, on 03/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelWiFiinS24EvMon.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
C:WINDOWSsystem32agrsmsvc.exe
C:Program FilesIntelWiFiinEvtEng.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINDOWSRTHDCPL.EXE
C:WINDOWSsystem32LVCOMSX.EXE
C:WINDOWSsystem32ElkCtrl.exe
C:Program FilesNeroNero8Nero BackItUpNBService.exe
C:Program FilesBrotherBrmfcmonBrMfcWnd.exe
C:Program FilesJavajre1.6.0_07injusched.exe
C:Program FilesFichiers communsRealUpdate_OB ealsched.exe
C:Program FilesBrotherControlCenter3rccMCtl.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32
vsvc32.exe
C:WINDOWSsystem32IoctlSvc.exe
C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:Program FilesBrotherBrmfcmonBrMfimon.exe
C:Program FilesIncrediMailinIMApp.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesFichiers communsNeroLibNMIndexStoreSvr.exe
C:Program FilesFichiers communsNeroLibNMIndexingService.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsChristianBureauSniffle.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:Program FilesTechSmithSnagIt 9SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:Program FilesRealRealPlayer pbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_07inssv.dll
O3 - Toolbar: Barre de Traduction IdiomaX - {477A7A3C-8B11-4B02-ADD1-7A01C4D00FA2} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:Program FilesTechSmithSnagIt 9SnagItIEAddin.dll
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [LVCOMSX] C:WINDOWSsystem32LVCOMSX.EXE
O4 - HKLM..Run: [LogitechCameraService(E)] C:WINDOWSsystem32ElkCtrl.exe /automation
O4 - HKLM..Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [BrMfcWnd] C:Program FilesBrotherBrmfcmonBrMfcWnd.exe /AUTORUN
O4 - HKLM..Run: [ControlCenter3] C:Program FilesBrotherControlCenter3rctrcen.exe /autorun
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_07injusched.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..RunOnce: [Malwarebytes' Anti-Malware] C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe /install /silent
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_07inssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra button: Montrer/Cacher la Barre de Traduction - {FE768A8F-9F88-4511-B28B-552ED2F6B500} - C:Program FilesFichiers communsIdiomaX SharedCat 6.0TrdIEAddIn.dll
O10 - Broken Internet access because of LSP provider 'c:program filesonjourmdnsnsp.dll' missing
O15 - Trusted Zone: http://www.incredimail.com
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005 ... scan53.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwarede ... _0_3_1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL ... 586-jc.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:WINDOWSsystem32agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:Program FilesBonjourmDNSResponder.exe (file missing)
O23 - Service: Boonty Games - BOONTY - C:Program FilesFichiers communsBOONTY SharedServiceBoonty.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:Program FilesIntelWiFiinEvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:Program FilesFichiers communsMacrovision SharedFLEXnet PublisherFNPLicensingService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:Program FilesFichiers communsLogishrdBluetoothLBTServ.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:program filesfichiers communslogitechlvmvfmLVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:Program Filesma-config.commaconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:Program FilesNeroNero8Nero BackItUpNBService.exe
O23 - Service: NMIndexingService - Nero AG - C:Program FilesFichiers communsNeroLibNMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:WINDOWSsystem32IoctlSvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:Program FilesFichiers communsIntelWirelessCommonRegSrvc.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:Program FilesIntelWiFiinS24EvMon.exe

--
End of file - 8907 bytes