pop up en masse [RESOLU]

Un jour j'ai viré mon macromedia flash player 8 pour voir,je n'avais plus une seule "pop up" mais plus une seule animation non plus ... ;-)

salut ! :-D

utilise la barre de navigation internet Google ! il y a un antipopup intégré !

sinon je vais analyser ton log HJT ! je reviens dans 2 minutes !
a tout de suite ! ;-)

ok^^, merci de maider
PS: j'ai essayé avec la barre google, mais rien y fait, jutilise en ce moment kasperla no pop-up et pop-up stopper, mais elles ne blokent pas tou. c grave , j'alucine le nombre d epop up, a la minute, meme sans lancer des pages internet.
merci

voila, jai fait ce qui été demandé, voici le raport panda

Incident Statut Analyse

Adware:Adware/Lop No Désinfecté C:\Documents and Settings\All Users\Application Data\1objkindhelp\load chic.exe
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\All Users\Application Data\1objkindhelp\this wave.exe
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\clement\Application Data\Media chic math\meal option.exe
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\clement\Application Data\mfcdseek\1 Vc Internet.exe
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\clement\Application Data\mfcdseek\dxpsiibs.exe
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\clement\Application Data\mfcdseek\Longloud.exe
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\clement\Application Data\mfcdseek\software hold gram hide.exe
Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\clement\Application Data\Mozilla\Firefox\Profiles\rhuvu4au.default\cookies.txt[]
Adware:Adware/CWS.Searchmeup No Désinfecté C:\Documents and Settings\clement\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-11037cf4.zip[GetAccess.class]
Adware:Adware/CWS.Searchmeup No Désinfecté C:\Documents and Settings\clement\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-11037cf4.zip[Installer.class]
Virus:Exploit/ByteVerify Désinfecté C:\Documents and Settings\clement\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-11037cf4.zip[NewSecurityClassLoader.class]
Virus:Exploit/ByteVerify Désinfecté C:\Documents and Settings\clement\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-bae16f0-11037cf4.zip[NewURLClassLoader.class]
Virus:Exploit/ByteVerify Désinfecté C:\Documents and Settings\clement\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv661.jar-897c2ff-225393c1.zip[Matrix.class]
Virus:Exploit/ByteVerify Désinfecté C:\Documents and Settings\clement\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv661.jar-897c2ff-225393c1.zip[Dummy.class]
Spyware:Cookie/YieldManager No Désinfecté C:\Documents and Settings\clement\Cookies\clement@ad.yieldmanager[2].txt
Spyware:Cookie/adultfriendfinder No Désinfecté C:\Documents and Settings\clement\Cookies\clement@adultfriendfinder[1].txt
Spyware:Cookie/Cassava No Désinfecté C:\Documents and Settings\clement\Cookies\clement@cassava[1].txt
Spyware:Cookie/fe.lea.lycos No Désinfecté C:\Documents and Settings\clement\Cookies\clement@fe.lea.lycos[1].txt
Spyware:Cookie/Itrack No Désinfecté C:\Documents and Settings\clement\Cookies\clement@ilead.itrack[1].txt
Spyware:Cookie/Toplist No Désinfecté C:\Documents and Settings\clement\Cookies\clement@toplist[2].txt
Spyware:Cookie/Advnt No Désinfecté C:\Documents and Settings\clement\Cookies\clement@www.advnt01[1].txt
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\162a9ee3.exe
Virus:W32/Gaobot.HNW.worm Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\3B3.tmp
Adware:adware/dyfuca No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\cfout.txt
Adware:Adware/CommAd No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\cmdinst.exe
Spyware:Cookie/2o7.net No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@2o7[1].txt
Spyware:Cookie/888 No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@888[1].txt
Spyware:Cookie/888 No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@888[2].txt
Spyware:Cookie/YieldManager No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@ad.yieldmanager[2].txt
Spyware:Cookie/Hbmediapro No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@adopt.hbmediapro[2].txt
Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@adtech[2].txt
Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@advertising[1].txt
Spyware:Cookie/Falkag No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@as-eu.falkag[2].txt
Spyware:Cookie/Falkag No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@as1.falkag[2].txt
Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@atdmt[2].txt
Spyware:Cookie/Azjmp No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@azjmp[2].txt
Spyware:Cookie/Belnk No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@belnk[1].txt
Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@bluestreak[1].txt
Spyware:Cookie/Btgrab No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@btg.btgrab[2].txt
Spyware:Cookie/Cassava No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@cassava[1].txt
Spyware:Cookie/Twain-Tech No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@cliks[1].txt
Spyware:Cookie/cs.sexcounter No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@cs.sexcounter[2].txt
Spyware:Cookie/Belnk No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@dist.belnk[2].txt
Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@doubleclick[1].txt
Spyware:Cookie/FastClick No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@fastclick[2].txt
Spyware:Cookie/Comclick No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@fl01.ct2.comclick[2].txt
Spyware:Cookie/Linksynergy No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@linksynergy[1].txt
Spyware:Cookie/Lop No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@lop[1].txt
Spyware:Cookie/FastClick No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@media.fastclick[2].txt
Spyware:Cookie/Mediaplex No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@mediaplex[1].txt
Spyware:Cookie/OfferOptimizer No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@offeroptimizer[1].txt
Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@realmedia[2].txt
Spyware:Cookie/WUpd No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@revenue[1].txt
Spyware:Cookie/Server.iad.Liveperson No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@server.iad.liveperson[2].txt
Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@serving-sys[2].txt
Spyware:Cookie/Reliablestats No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@stats1.reliablestats[2].txt
Spyware:Cookie/Tradedoubler No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@tradedoubler[2].txt
Spyware:Cookie/Valueclick No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@valueclick[1].txt
Spyware:Cookie/Weborama No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@weborama[2].txt
Spyware:Cookie/WinFixer No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@winfixer[2].txt
Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@xiti[1].txt
Spyware:Cookie/Adserver No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@z1.adserver[1].txt
Spyware:Cookie/Zedo No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Cookies\clement@zedo[1].txt
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\ICD15.tmp\UERSV_0001_LPNetInstaller.exe
Dialerialer.BGL No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\ICD8.tmp\games.inf
Dialerialer.BGL No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\ICD9.tmp\games.inf
Adware:Adware/Lop No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\sta2A.exe
Adware:Adware/Look2Me No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\temp.fr7A98
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Documents and Settings\clement\Local Settings\Temp\Temporary Internet Files\Content.IE5\4GA0OKOZ\WinFixer2005ScannerInstallFRA[1].cab[UWFX5V_0001_N57M1412NetInstaller.exe]
Outil indésirable:Application/Zango No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\0123S9IZ\bridge-c32[1].cab
Adware:Adware/WUpd No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\0123S9IZ\bridge-c32[1].cab[MediaGatewayX.dll]
Adware:Adware/WinAD No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\0123S9IZ\MediaGateway[1].exe
Adware:Adware/CommAd No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\C7Z7KT49\installer[1].exe
Adware:Adware/IST.ISTBar No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\C7Z7KT49\istdownload[1].exe
Adware:Adware/IST.ISTBar No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\C7Z7KT49\istsvc[1].exe
Adware:Adware/nCase No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\GD2JGDEZ\AppWrap[1].exe
Adware:Adware/Look2Me No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\GD2JGDEZ\AppWrap[2].exe
Adware:Adware/ISearch No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\TLSSVBIS\MTE3NDI6ODoxNg[1].exe
Adware:Adware/nCase No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\WN5RY2ZH\AppWrap[1].exe
Adware:Adware/Look2Me No Désinfecté C:\Documents and Settings\clement\Local Settings\Temporary Internet Files\Content.IE5\ZV1RFDGW\Installer[1].exe
Adware:Adware/DollarRevenue No Désinfecté C:\drsmartloadb.exe
Adware:Adware/Superbar No Désinfecté C:\GDiVX Player\SuperBarInstall.exe
Adware:Adware/Look2Me No Désinfecté C:\Installer.exe
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\48025B7A-8B97-4F13-883C-D21E22\26D3C310-9D67-47E2-A404-16478A
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\48025B7A-8B97-4F13-883C-D21E22\916471FA-5B0B-4F9B-AD2A-30F141
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\48025B7A-8B97-4F13-883C-D21E22\CFC2C6AB-318B-4599-AC36-A16373
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\48025B7A-8B97-4F13-883C-D21E22\DE6B2995-44F4-4B56-898D-37C64F
Adware:Adware/TopRebates No Désinfecté C:\Microsoft AntiSpyware\Quarantine\515CC234-72D2-4EAB-9EB3-59D319\122037AF-FCFA-44F7-8339-D4E699
Adware:Adware/TopRebates No Désinfecté C:\Microsoft AntiSpyware\Quarantine\515CC234-72D2-4EAB-9EB3-59D319\63BE1C7C-483E-4323-815E-F78A7A
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\5595E689-A70C-43B7-B17D-AB7231\29077AA1-4668-47E8-BC1B-EDE1C6
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\5595E689-A70C-43B7-B17D-AB7231\2EDC5AA2-83D2-4BCB-BB89-940515
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\5595E689-A70C-43B7-B17D-AB7231\96074E4B-B8AD-41E3-A83A-67F74C
Outil indésirable:Application/Winfixer2005 No Désinfecté C:\Microsoft AntiSpyware\Quarantine\5595E689-A70C-43B7-B17D-AB7231\BA6DDB7D-B1E8-48F8-8D2D-55847E

nouveau log HJT

Logfile of HijackThis v1.99.1
Scan saved at 22:32:08, on 23/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\MessengerPlus! 3\MsgPlus.exe
C:\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Free Download Manager\fdm.exe
C:\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.zunxqddykugr.com/YzuPnq [...] 652r0u.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Overnet] C:\Overnet\eDonkey2000.exe -t
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Type Bin Vga Bend] C:\Documents and Settings\All Users\Application Data\Bash Ping Type Bin\EggsAnte.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IziLock] C:\IziLock\izilock.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [Free Download Manager] C:\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [UPWAIT] C:\DOCUME~1\clement\APPLIC~1\mfcdseek\Longloud.exe
O4 - HKCU\..\Run: [Skype] "C:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signupte [...] -devel.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect1.gravity.co.kr/npr [...] /npkcx.cab
O16 - DPF: {E06D802B-DB46-11CF-B4D1-00805F6CBBEA} - http://www.neo-gestrim.com/login.p [...] C5kbGw=lfA
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\g222lcfo1f2c.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

hé bin!!! Bon, la je suis au taff jusqua 16 heure, des que j'arrive chez moi, je fait ce que tu me conseil. Encore une fois merci beaucoup de m'aider.

PS: je m'interesse pas mal a l'informatique et je voudrais savoir comment tu analyse les ligne de hijackthis pour detecter ce qui est bien et pas bien?
Merci!!
A ce soir!!

jai telecharger luninstaller, mais avec koi doije louvrir, quand je clike dessus, licone ouvrir avec aparé. Donc, que doisje faire ?

ca marche pas, jai meme pas de .exe!

toujours pas mieu, autant de popup. Je sais pas comment ca se fait

nouvo raport d'hjt, merci ^^

Logfile of HijackThis v1.99.1
Scan saved at 21:16:25, on 25/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\MessengerPlus! 3\MsgPlus.exe
C:\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Free Download Manager\fdm.exe
C:\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oxsnzpuisz.net/YzuPnqlS [...] 652r0u.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Free Download Manager] C:\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [UPWAIT] C:\DOCUME~1\clement\APPLIC~1\mfcdseek\Longloud.exe
O4 - HKCU\..\Run: [Skype] "C:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signupte [...] -devel.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect1.gravity.co.kr/npr [...] /npkcx.cab
O16 - DPF: {E06D802B-DB46-11CF-B4D1-00805F6CBBEA} - http://www.neo-gestrim.com/login.p [...] C5kbGw=lfA
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\hrr8059ue.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

ok, je fait ca ce soir.
De plus, depuis quelque jour je commence a serieusement m'intersser au netoyage de l'ordi et notament a l'interpretation des raport hjt. J'ai lu les topic en rapport , ca fait quand meme une quarantaine de page, mais je voudraise savoir quel base de donnée tu utilise pour interpreter les ligne. Jen ai trouver une bonne pour les tartup list mais jharive pas trop antrouver pour le reste, si tu peu me donner les lien de celle que tu utilise ca mederé bien, merci beraucou et a ce soir ^^

ca ne marche pas l2mfix, je te pose quand meme le premeir rapport , mais toe que tu ma dit de faire na pas fonctionné.


L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\n62u0gf9e62.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{58D0C405-D408-A08E-9BB4-8DFE9A139E5B}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{A4C225D4-B96B-479F-8737-605497C00D38}"=""
"{9D83DFD8-E630-4A01-8C02-2E67552CC15B}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9D83DFD8-E630-4A01-8C02-2E67552CC15B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9D83DFD8-E630-4A01-8C02-2E67552CC15B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9D83DFD8-E630-4A01-8C02-2E67552CC15B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9D83DFD8-E630-4A01-8C02-2E67552CC15B}\InprocServer32]
@="C:\\WINDOWS\\system32\\kudusl.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:
Locate .tmp files:
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 3877-B064

R‚pertoire de C:\WINDOWS\System32

26/01/2006 16:45 234ÿ981 kudusl.dll
26/01/2006 16:45 236ÿ877 t6r8lg9u16.dll
26/01/2006 15:58 234ÿ055 h0j40a1qed.dll
26/01/2006 10:45 234ÿ981 n62u0gf9e62.dll
25/01/2006 18:52 235ÿ371 dn4401hqe.dll
25/01/2006 12:57 236ÿ969 q8rqli9518.dll
25/01/2006 10:16 234ÿ027 k6pm0g71e6.dll
24/01/2006 21:04 236ÿ483 q0ps0a77ed.dll
24/01/2006 20:47 233ÿ804 gpjml3111.dll
11/01/2006 16:13 <REP> dllcache
12/03/2005 11:03 <REP> Microsoft
05/01/2002 03:40 487ÿ424 msvcp70.dll
10 fichier(s) 2ÿ604ÿ972 octets
2 R‚p(s) 31ÿ682ÿ043ÿ904 octets libres

je pense avoir reussi avec kill2me, jai plus les lien dans mes favoris que jarivé pas a virer.
En revanche jai toujours pas mal de pop-up. mais bien moinss!!!
tient je poste un raport hjt essaye de voir si tu trouve quelque chose d'anormal, moi jai commencé et jai rien trouvé.
merci ^^


Logfile of HijackThis v1.99.1
Scan saved at 17:35:54, on 26/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\MessengerPlus! 3\MsgPlus.exe
C:\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\FREEDO~1\fdm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oxsnzpuisz.net/YzuPnqlS [...] 652r0u.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKCU\..\Run: [Skype] "C:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6 [...] vSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6 [...] /cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signupte [...] -devel.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect1.gravity.co.kr/npr [...] /npkcx.cab
O16 - DPF: {E06D802B-DB46-11CF-B4D1-00805F6CBBEA} - http://www.neo-gestrim.com/login.p [...] C5kbGw=lfA
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\j06mlaj11do.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

essaie Spy Sweeper (version d'évaluation 14 jours)
parfois il réussit à supprimer Look2ME.

MON ORDI VAS MIEUUUUUU!!!!!
il a trouvé et suprimer look2me, plus de pub!!
MERCIIIIIII!
je poste quand meme un dernier log HJT pour verifier.


Logfile of HijackThis v1.99.1
Scan saved at 20:09:42, on 27/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ewido anti-malware\ewidoctrl.exe
C:\ewido anti-malware\ewidoguard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\MessengerPlus! 3\MsgPlus.exe
C:\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Spy Sweeper\WRSSSDK.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oxsnzpuisz.net/YzuPnqlS [...] 652r0u.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKCU\..\Run: [Skype] "C:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6 [...] vSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6 [...] /cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537 [...] scan53.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signupte [...] -devel.cab
O16 - DPF: {92E7E45A-D8C8-480E-AF99-176E43997CAA} (Aurigma Image Uploader 3.5 Combo Control) - http://www.pixdiscount.fr/clients/ImageUploader3.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect1.gravity.co.kr/npr [...] /npkcx.cab
O16 - DPF: {E06D802B-DB46-11CF-B4D1-00805F6CBBEA} - http://www.neo-gestrim.com/login.p [...] C5kbGw=lfA
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\lvn6095se.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Petite question Esteban
comment reconnaitre Look2me,
je sais qu'il se situe dans le ligne 20 mais comment faire la difference avec la ligne legitime.

Merci pour la precision ;-)