Alertes de Norton intempestives

Essaie Sbybot, vois mon sujet pour plus de détails

J'ai installé Spyboot et je l'ai lancé. Il a trouvé 7 éléments et j'ai tout supprimé. Mais le problème persiste. Une autre alerte du même type est apparue.
De plus Norton détecte fréquemment (5 fois ce matin) des trojan. Je les supprime à chaque fois mais d'autres apparaissent.

Essaie le scan en ligne alors url=http://www.bitdefender.fr/scan/license.php]Lien Direct[/url]

L'analyse de bitdefender est en cours. Par contre, tu peux m'expliquer pourquoi Spyboot trouve toujours : CoolWWWSearch. Je le supprime à chaque fois, mais je le retrouve. C'est normal ?

Le temps estimé de l'analyse est de 8 heures. On peut essayer quelque chose d'autres en attendant ?

Spybot à une fonction imuniser, faut l'utiliser, des fois sa marche ;-)

salut ev7000

-télécharge Ccleaner
nettoie tout ce qu'il trouve

-télécharge Ewido
mets le à jour

-télécharge Hijackthis

redémarre le pc en mode sans échec (appuis sur F8 au démarrage jusqu'au panneau d'accueil)

fais un scan Ewido et enregistre le rapport sur le bureau puis fais un scan Hijackthis et poste le rapport sur le bureau et envoie nous tes 2 rapports

bonjour voila les liens
http://www.ewido.net/en/ faire les mise a jours

http://www.filehippo.com/download_ccleaner/

http://www.infos-du-net.com/telecharger/tele454.html

@ ++ claude

OK merci beaucoup.
J'ai libéré 340 M de place sur l'ordinateur grâce à CCleaner. Je vais continuer à installer les programmes nécessaires. Puis je vous dirai si ça a marché.

340 Mega quand même

c'est bon signe ça!!

maintenant fais Ewido+Hijackthis

Voilà le rapport ewido :

---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 18:45:01, 17/04/2006
+ Somme de contrôle: 51C4791E

+ Résultats du scan:

[236] C:\WINDOWS\system32\wintsg32.dll -> Trojan.Agent.qt : Nettoyer et sauvegarder
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\Portal\1DEF5331.ocx -> Adware.MediaTickets : Nettoyer et sauvegarder
:mozilla.35:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
:mozilla.36:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
:mozilla.37:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder
:mozilla.69:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
:mozilla.70:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
:mozilla.71:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
:mozilla.72:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
:mozilla.73:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
:mozilla.74:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Falkag : Nettoyer et sauvegarder
:mozilla.75:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Adition : Nettoyer et sauvegarder
:mozilla.76:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Adition : Nettoyer et sauvegarder
:mozilla.81:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Doubleclick : Nettoyer et sauvegarder
:mozilla.82:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Mediaplex : Nettoyer et sauvegarder
:mozilla.83:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder
:mozilla.84:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Valueclick : Nettoyer et sauvegarder
:mozilla.85:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Valueclick : Nettoyer et sauvegarder
:mozilla.89:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Komtrack : Nettoyer et sauvegarder
:mozilla.90:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Komtrack : Nettoyer et sauvegarder
:mozilla.96:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.97:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder
:mozilla.112:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Adtech : Nettoyer et sauvegarder
:mozilla.113:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Adtech : Nettoyer et sauvegarder
:mozilla.115:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder
:mozilla.116:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder
:mozilla.117:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Comclick : Nettoyer et sauvegarder
:mozilla.119:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
:mozilla.120:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
:mozilla.121:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
:mozilla.122:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Hitbox : Nettoyer et sauvegarder
:mozilla.129:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\50nxh2xe.default\cookiesnew.txt -> TrackingCookie.Atdmt : Nettoyer et sauvegarder
:mozilla.20:C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\widsf0in.Utilisateur par défaut\cookies.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder
C:\Documents and Settings\HP_Administrateur\Mes documents\Stephane\MSN Messenger\Fichiers reçus\Messenger Plus! - Setup.exe/sponsor.exe -> Downloader.Swizzor.ag : Nettoyer et sauvegarder
C:\WINDOWS\system32\wintsg32.dll -> Trojan.Agent.qt : Nettoyer et sauvegarder


::Fin du rapport



et voici le rapport HiJackthis :


Logfile of HijackThis v1.99.1
Scan saved at 18:52:48, on 17/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
C:\Program Files\Ewido anti-malware\ewidoguard.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\PROGRA~1\WinTV\hcwP1Utl.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.voila.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NI.UWFX5V_0001_0802] "C:\Program Files\WinFixer\WFI_FRA.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [hcwPVRReset] C:\PROGRA~1\WinTV\hcwP1Utl.exe -Quiet -ResetHardware -NotifyResetFailure -KeepTrying
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinsta...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab312...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam01.lugano.ch/activex/AxisCamControl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDown...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.ca...
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.msnjeux.com/online2/MSN_INTL_FRANCE/zuma/zyl...
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown....
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: wintsg32 - wintsg32.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\Ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe





Voilà.

et bien tu en avais des merdes


mais il en reste encore quelques unes

vas sur www.pandasoftware.com
appuis sur panda activescan en bas à gauche, mais fais le avec internet explorer car il ne peut le faire qu'avec lui

fais le scan et poste le rapport sur le forum

J'ai fait une analyse rapide parce que j'avais pas le temps sinon. Ca change quelque chose ou non ?
En tout cas, voici le rapport spyXposer :

Adware:adware/block-checker
Signalé
Registre Windows

J'espère qu'il sera utile malgré tout.

PS : Si vraiment il faut faire une analyse complète, je peux la faire quand même.

oui il est nécessaire de faire l'analyse complète sur www.pandasoftware.com

Je te dirai demain alors.
Bonne soirée.

ok

à demain

bonjour
les ligne a fixe avec hijack this
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
passer
http://telechargement.zebulon.fr/259-smitfraudfix.html
@ ++ claude

Bonjour,
J'ai fait ActiveScan avec www.pandasoftware.com (full scan) et voici le rapport :


Adware:adware/block-checker Not disinfected Windows Registry

Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@weborama[2].txt

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\widsf0in.Utilisateur par défaut\cookies.txt[]

Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@weborama[2].txt

Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe

Dialer ialer.DPC Not disinfected C:\WINDOWS\Temp\Del201.tmp

Dialer ialer.DPC Not disinfected C:\WINDOWS\Temp\win1FF.tmp.exe

Voilà.

Bonjour Carlasne, j'ai fait ce que tu m'as dit (à part que je n'ai trouvé qu'une seule fois la ligne
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com )

Bonjour,

Supprime ce dossier

C:\hp\bin\KillIt.exe
C:\WINDOWS\Temp\<- vide le dossier

Reposte un log Hijackthis

Puis fais un scan en ligne Kaspersky
Colle le rapport

Bonjour, voici le log Hijackthis :


Logfile of HijackThis v1.99.1
Scan saved at 15:26:54, on 18/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\PROGRA~1\WinTV\hcwP1Utl.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.voila.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NI.UWFX5V_0001_0802] "C:\Program Files\WinFixer\WFI_FRA.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [hcwPVRReset] C:\PROGRA~1\WinTV\hcwP1Utl.exe -Quiet -ResetHardware -NotifyResetFailure -KeepTrying
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinsta...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab312...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam01.lugano.ch/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDown...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.ca...
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.msnjeux.com/online2/MSN_INTL_FRANCE/zuma/zyl...
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown....
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: wintsg32 - wintsg32.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\Ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Le scan de Kaspersky est en cours.

Salut,

1/ Télécharge et installe CCleaner

http://www.clubic.com/telecharger-fiche14492-ccleaner-c...

Télécharge, installe et mets à jour ewido

http://www.infos-du-net.com/telecharger/Ewido-Security-...

2/ Redémarre en mode sans échec (Pour cela : démarrer le PC en tapotant sur la touche F8 du clavier jusqu'à ce que le menu des options avancées de Windows apparaisse puis avec les touches fléchées du clavier, sélectionner Mode sans échec puis appuyer sur la touche Entrée...)
Attention tu n'as pas accès à Internet dans ce mode donc note ou imprime les consignes qui suivent.

3/ Lance HijackThis
puis --> Do a system scan only
coche les lignes indiquées ci-dessous
puis --> Fix checked
puis oui à la question de confirmation

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.voila.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about :blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NI.UWFX5V_0001_0802] "C:\Program Files\WinFixer\WFI_FRA.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinsta...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab312...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam01.lugano.ch/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDown...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.ca...
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.msnjeux.com/online2/MSN_INTL_FRANCE/zuma/zyl...
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown....
O20 - Winlogon Notify: wintsg32 - wintsg32.dll (file missing)

4/ Assure-toi que tu as accès aux fichiers cachés.
(Démarrer->Poste de travail->Outils->Options des dossiers...->Affichage
"Afficher les fichiers et dossiers cachés" ->coché
"Masquer les extensions des fichiers dont le type est connu" ->décoché
"Masquer les fichiers protégés du système d'exploitation" ->décoché)

5/ ensuite supprime les fichiers et/ou dossiers suivants si présents :

C:\Program Files\WinFixer <== le dossier

6/ / Lance CCleaner puis bouton Analyse ensuite Bouton Lancer le Nettoyage

7/ Lance ewido (Scan complet du système) et supprime tout ce qu'il trouve. Sauvegarde le rapport sur le bureau.

8/ Redémarre normalement et poste le rapport Ewido et un nouveau rapport HijackThis.

Salut Bob,
je finis l'analyse de Kaspersky puis je commence tes instructions. Mais dois-je vraiment refaire l'analyse ewido ( je l'ai déjà faite, avec le mode sans échec ) ?

Re,

Oui fait le je sais c'est long !

Peut tu poster ton rapport Kaspersky avant de commencer ma procedure ? merci

c'est le plus important

et reposte ton rapport Hijackthis en pièce jointe s'il te plait car direct sur le foum, c'est très chiant à lire

Bonjour,

Comment je fais pour poster le rapport en pièce jointe ? J'ai le fichier Hijackthis.log sur le bureau mais je ne sais pas comment le mettre en pièce jointe.

Salut,

voici le rapport Kaspersky ( désolé je ne sais pas comment le mettre en pièce jointe ) :

KASPERSKY ON-LINE SCANNER REPORT
Tuesday, April 18, 2006 6:38:19 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 18/04/2006
Kaspersky Anti-Virus database records: 177291
Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
Scan Statistics
Total number of scanned objects 149080
Number of viruses found 11
Number of infected objects 66
Number of suspicious objects 3
Duration of the scan process 02:38:05

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0EC70AF8.tmp Infected: Net-Worm.Win32.Mytob.u skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0EE504D7.tmp Infected: Net-Worm.Win32.Mytob.u skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/19 Sep 2004 10:43 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Sun, 19 Sep 2004 12:45:22 +0200]/UNNAMED/details.scr Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/19 Sep 2004 10:43 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Sun, 19 Sep 2004 12:45:22 +0200]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/19 Sep 2004 10:43 from Mail Delivery System:Mail delivery failed.eml Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/16 Sep 2004 15:35 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Thu, 16 Sep 2004 17:37:11 +0200]/UNNAMED/details.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/16 Sep 2004 15:35 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Thu, 16 Sep 2004 17:37:11 +0200]/UNNAMED/details.zip Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/16 Sep 2004 15:35 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Thu, 16 Sep 2004 17:37:11 +0200]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/16 Sep 2004 15:35 from Mail Delivery System:Mail delivery failed.eml Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/17 Aug 2004 14:45 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Tue, 17 Aug 2004 16:56:56 +0200]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/17 Aug 2004 14:45 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Tue, 17 Aug 2004 16:56:56 +0200]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/17 Aug 2004 14:45 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Tue, 17 Aug 2004 16:56:56 +0200]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/17 Aug 2004 14:45 from Mail Delivery System:Mail delivery failed.eml/[From cadima@cadima.com][Date Tue, 17 Aug 2004 16:56:56 +0200]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst/Rech.Kellys/17 Aug 2004 14:45 from Mail Delivery System:Mail delivery failed.eml Infected: Email-Worm.Win32.NetSky.q skipped
C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys\backup.pst Mail MS Mail: infected - 10, suspicious - 2 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP374\A0043885.exe Suspicious: Type_Win32 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP394\A0045665.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP394\A0045665.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP394\A0045665.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046097.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046097.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046097.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046103.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046103.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046103.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046104.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046104.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046104.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046105.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046105.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046105.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046106.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046106.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046106.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046107.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046107.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046107.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046108.exe/stream Infected: Trojan-Downloader.Win32.IstBar.no skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046108.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP398\A0046108.exe UPX: infected - 1 skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP426\A0047735.exe Infected: Trojan-Downloader.Win32.Small.adk skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP427\A0049162.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP427\A0049163.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP427\A0049164.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP427\A0049165.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP427\A0049167.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP427\A0049170.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP428\A0049275.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP428\A0049407.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP428\A0049410.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP428\A0049416.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP428\A0049431.dll Infected: Trojan-Downloader.Win32.IstBar.ff skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049702.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049707.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049708.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049709.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049710.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049715.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049716.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049717.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP431\A0049718.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP432\A0049814.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP432\A0049815.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP432\A0049816.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP432\A0049818.exe Infected: Trojan-Dropper.Win32.Agent.aiq skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP432\A0049819.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP432\A0049820.exe Infected: Trojan-Downloader.Win32.Small.axy skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP433\A0050276.exe Infected: Trojan-Downloader.Win32.Zlob.le skipped
C:\System Volume Information\_restore{F4F1F86F-DDEA-4499-AE45-67D5345A230B}\RP433\A0050432.dll Infected: Trojan.Win32.Agent.qt skipped
Scan process completed.





PS : Je n'ai pas encore commencé la procédure.

1/ Desactive puis reactive la restauration du systeme
Aide

2/ Vide ce dossier

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine

3/ Supprime ces fichiers ou dossier

C:\Documents and Settings\HP_Administrateur\Mes documents\Legal\CD\Disque 1 (Ord. de bureau)\Disque 1 (Ord. de bureau)\Mails Outlook\Rech.Kellys

Pour le log HJT mets le direct sur le forum

Salut Angeldark,
J'ai fait tout ce que tu m'as dit de faire.
Voici le log Hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 19:50:51, on 18/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\PROGRA~1\WinTV\hcwP1Utl.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Jeux\Steam\Steam.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.voila.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&lo...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&loca...
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NI.UWFX5V_0001_0802] "C:\Program Files\WinFixer\WFI_FRA.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [hcwPVRReset] C:\PROGRA~1\WinTV\hcwP1Utl.exe -Quiet -ResetHardware -NotifyResetFailure -KeepTrying
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinsta...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab312...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://www.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam01.lugano.ch/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst....
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDown...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.ca...
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.msnjeux.com/online2/MSN_INTL_FRANCE/zuma/zyl...
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown....
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: wintsg32 - wintsg32.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\Ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe





Maintenant, je commence la procédure.

as-tu encore les problèmes ???

sinon le log Hijackthis a l'air bon

Voilà

J'ai fini toute la procédure de Bob.
Ewido n'a rien trouvé, voici le rapport :

---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 22:24:34, 18/04/2006
+ Somme de contrôle: 32D316BC

+ Résultats du scan:

Pas de fichiers infectés trouvés!


::Fin du rapport



et voici le nouveau rapport HijackThis :


Logfile of HijackThis v1.99.1
Scan saved at 22:29:31, on 18/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\PROGRA~1\WinTV\hcwP1Utl.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [hcwPVRReset] C:\PROGRA~1\WinTV\hcwP1Utl.exe -Quiet -ResetHardware -NotifyResetFailure -KeepTrying
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\Ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe


Voilà.


Je n'ai plus de problème !! Un grand merci à vous tous. Par contre, on m'avait dit que j'avais beaucoup de problèmes en voyant un rapport HijackThis. Reste-t-il encore des spywares ou virus ?

de rien

c'est bon maintenant tu n'as plus rien

Bonjour,
tout d'abord merci infiniment de votre aide

Alors maintenant j'ai plein de programmes (Ewido, HijackThis, CCleaner, ICleaner, Microsoft Antispyware, AdAware, Spybot)
Que dois-je garder ? Que dois-je désinstaller ?

slt,
si tu estimes que tu en as plus besoin , tu les vires.
mais perso je garderais:
-Ad-Aware
-Spybot
-Ewido
-Ccleaner
pour les 3 premier faire les MAJ et
des scans regulier
et avec Ccleaner un petit nettoyage de ton pc par semaine.
mais c'est que mon avis.

si j'étais toi

je garderais Ewido, ad-aware, Ccleaner et Hijackthis

Ok, merci pour tout.