pb msn spy

Bonjour,

Fais bien TOUT ce qui suit.

- Télécharge Hijackthis de Merjin
- Mets le dans un dossier ou sur ton bureau
-- Clique Droit sur Hijackthis :
-> Choisis " Renommer "
-> Tape Scanner.exe puis valide

- Lance l'application
- Choisis l'option Do a system scan and save a logfile
-- Le Bloc-Notes s'ouvre :
-> Edition / Sélectionner Tout
-> Edition / Copier
- Colle le rapport ici.

Aide sur Hijackthis

merci, j'essaye tout de suite

Logfile of HijackThis v1.99.1
Scan saved at 15:06:36, on 23/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Avast\aswUpdSv.exe
D:\Avast\ashServ.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Avast\ashMaiSv.exe
D:\Avast\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
D:\Avast\ashDisp.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\Program Files\MSN Spy Monitor\common\mwsvcmsn.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Spy Monitor\common\wmsnproc.exe
C:\Program Files\PSCS\data\sysmon32.exe
C:\Program Files\PSCS\data\symserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\carine\Bureau\Scanner.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.sony-europe.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [avast!] D:\Avast\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [winmsnsvc] C:\WINDOWS\system32\winmsnsvc.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [QuickTime Task] "D:\Quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [symreg] C:\WINDOWS\system32\symreg.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MSOFFI~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?6c42909f02674b5493f2f0f8de387d69
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?6c42909f02674b5493f2f0f8de387d69
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSOFFI~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Avast\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Avast\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Avast\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Avast\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe

Re,

Télécharge puis installe AVG Anti-Spyware (AVG AS)
Une fois AVG AS lancé, clique sur "Mise à jour"
Ferme le programme.

Redémarre en mode sans échec

Relance AVG AS puis choisis l'onglet "Analyse"
Puis l'onglet "Paramètres"
Sous la question "Comment réagir ?", clique sur "Actions recommandées" et choisis "Quarantaine"
Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système"

/!\ Si un fichier est infecté en fin d'analyse /!\
Clique sur "Appliquer toutes les actions "

Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous"
Enregistre ce fichier texte sur ton bureau.

Redémarre normalement
Copie/Colle le rapport ici.

merci je le fais tout de suite

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 19:32:59 23/10/2006

+ Résultat de l'analyse:



C:\Documents and Settings\All Users\Documents\setup.exe -> Proxy.Horst.ko : Nettoyé et sauvegardé (mise en quarantaine).
:mozilla.145:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.75:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.77:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.78:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.83:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.86:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.87:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.88:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.89:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.90:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.91:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.92:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.129:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.130:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.41:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.42:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.43:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.123:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.7:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Nettoyé.
:mozilla.29:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.31:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.124:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.125:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.126:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.127:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.128:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@as1.falkag[2].txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.76:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.79:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.80:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.118:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.119:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.120:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.121:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.73:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.11:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.12:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.13:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.10:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.6:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.8:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.9:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.74:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.


Fin du rapport

Re,

Reposte un rapport Hijackthis.

re,

Logfile of HijackThis v1.99.1
Scan saved at 10:33:18, on 24/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Avast\aswUpdSv.exe
D:\Avast\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Avast\ashMaiSv.exe
D:\Avast\ashWebSv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\ezSP_Px.exe
D:\Avast\ashDisp.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\MSN Spy Monitor\common\mwsvcmsn.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Spy Monitor\common\wmsnproc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\PSCS\data\sysmon32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PSCS\data\symserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\carine\Bureau\Scanner.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.sony-europe.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [avast!] D:\Avast\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [winmsnsvc] C:\WINDOWS\system32\winmsnsvc.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [QuickTime Task] "D:\Quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [symreg] C:\WINDOWS\system32\symreg.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MSOFFI~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?6c42909f02674b5493f2f0f8de387d69
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?6c42909f02674b5493f2f0f8de387d69
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSOFFI~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Avast\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Avast\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:\Avast\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:\Avast\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe

il est toujours là  

Bonjour,

1/ Télécharge et installe CCleaner

2/ Redémarre en mode sans échec (Pour cela : démarrer le PC en tapotant sur la touche F8 du clavier jusqu'à ce que le menu des options avancées de Windows apparaisse puis avec les touches fléchées du clavier, sélectionner Mode sans échec puis appuyer sur la touche Entrée...)
Attention tu n'as pas accès à Internet dans ce mode donc note ou imprime les consignes qui suivent.

3/ Lance HijackThis
puis --> Do a system scan only
coche les lignes indiquées ci-dessous
puis --> Fix checked
puis oui à la question de confirmation

O4 - HKLM\..\Run: [winmsnsvc] C:\WINDOWS\system32\winmsnsvc.exe

O4 - HKLM\..\Run: [QuickTime Task] "D:\Quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [symreg] C:\WINDOWS\system32\symreg.exe

4/ Assure-toi que tu as accès aux fichiers cachés.
(Démarrer->Poste de travail->Outils->Options des dossiers...->Affichage
"Afficher les fichiers et dossiers cachés" ->coché
"Masquer les extensions des fichiers dont le type est connu" ->décoché
"Masquer les fichiers protégés du système d'exploitation" ->décoché)

5/ ensuite supprime les fichiers et/ou dossiers suivants si présents :

C:\WINDOWS\system32\winmsnsvc.exe
C:\WINDOWS\system32\symreg.exe
C:\Program Files\MSN Spy Monitor\ --> le dossier

6/ Lance CCleaner puis bouton Analyse ensuite Bouton Lancer le Nettoyage

7/ Redémarre normalement et poste un nouveau rapport HijackThis.

8/ Ces 2 processus sont suspects.
C:\Program Files\PSCS\data\sysmon32.exe
C:\Program Files\PSCS\data\symserv.exe

analyse-les sur http://virusscan.jotti.org/ ou sur http://www.virustotal.com pour savoir s'ils sont infectieux.
Poste le résultat stp.

ok merci, j'essaye

Voici le rapport pour :

C:\Program Files\PSCS\data\symserv.exe

STATUS: FINISHED
Complete scanning result of "symserv.exe_", received in VirusTotal at 10.24.2006, 12:25:57 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.32 10.24.2006 no virus found
Authentium 4.93.8 10.24.2006 no virus found
Avast 4.7.892.0 10.23.2006 no virus found
AVG 386 10.23.2006 no virus found
BitDefender 7.2 10.24.2006 no virus found
CAT-QuickHeal 8.00 10.23.2006 no virus found
ClamAV devel-20060426 10.23.2006 no virus found
DrWeb 4.33 10.24.2006 no virus found
eTrust-InoculateIT 23.73.34 10.23.2006 no virus found
eTrust-Vet 30.3.3154 10.24.2006 no virus found
Ewido 4.0 10.24.2006 no virus found
Fortinet 2.82.0.0 10.24.2006 no virus found
F-Prot 3.16f 10.24.2006 no virus found
F-Prot4 4.2.1.29 10.24.2006 no virus found
Ikarus 0.2.65.0 10.24.2006 no virus found
Kaspersky 4.0.2.24 10.24.2006 no virus found
McAfee 4879 10.23.2006 no virus found
Microsoft 1.1609 10.24.2006 no virus found
NOD32v2 1.1828 10.24.2006 no virus found
Norman 5.80.02 10.24.2006 no virus found
Panda 9.0.0.4 10.24.2006 Suspicious file
Sophos 4.10.0 10.24.2006 no virus found
TheHacker 6.0.1.104 10.23.2006 no virus found
UNA 1.83 10.24.2006 no virus found
VBA32 3.11.1 10.23.2006 no virus found
VirusBuster 4.3.7:9 10.23.2006 no virus found

Aditional Information
File size: 32768 bytes
MD5: 8f61f974c59c6660a79a3c0eecfa0b6b
SHA1: d173f554b05adf6661a2a53cbceaf1b401a6f0fa

Voici le rapport pour :
C:\Program Files\PSCS\data\sysmon32.exe


Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1
File to upload & scan: Virus

Service
Service load:
0% 100%
File: sysmon32.exe_
Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 1c4fba0d630f31306b943dfd5c2241d2
Packers detected:
-
Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found BACKDOOR.Trojan (probable variant)
F-Prot Antivirus
Found Possibly a new variant of W32/VB-Backdoor-TWNF-based!Maximus
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

re, j'ai tout bien suivi  

Voici le rapport

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 19:32:59 23/10/2006

+ Résultat de l'analyse:



C:\Documents and Settings\All Users\Documents\setup.exe -> Proxy.Horst.ko : Nettoyé et sauvegardé (mise en quarantaine).
:mozilla.145:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.75:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.77:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.78:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.83:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.86:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.87:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.88:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.89:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.90:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.91:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.92:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.129:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.130:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.41:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.42:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.43:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.123:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.7:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Nettoyé.
:mozilla.29:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.31:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.124:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.125:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.126:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.127:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.128:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@as1.falkag[2].txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.76:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.79:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.80:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.118:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.119:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.120:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.121:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.73:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.11:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.12:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.13:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.10:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.6:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.8:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.9:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\carine\Cookies\carine@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.74:C:\Documents and Settings\carine\Application Data\Mozilla\Firefox\Profiles\euc7la7p.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.


Fin du rapport

Re,

Télécharge Blacklight (F-Secure), clique sur " I ACCEPT " en bas de la page :
Clique sur le premier " Download " afin de télécharger le programme
Sauvegarde le sur ton Bureau
Double-clique blbeta.exe et accepte la licence; clique Scan puis Next.

A la fin du scan, NE TOUCHE A RIEN !

Tu verras un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).
Nous devons analyser ce rapport, ferme donc le BlackLight.

Poste le rapport sur le forum.

Aide sur BlackLight de Malekal_Morte

voici le rapport

10/27/06 11:56:06 [Info]: BlackLight Engine 1.0.47 initialized
10/27/06 11:56:06 [Info]: OS: 5.1 build 2600 (Service Pack 2)
10/27/06 11:56:06 [Note]: 7019 4
10/27/06 11:56:06 [Note]: 7005 0
10/27/06 11:56:15 [Note]: 7006 0
10/27/06 11:56:15 [Note]: 7011 1296
10/27/06 11:56:15 [Note]: 7026 0
10/27/06 11:56:15 [Note]: 7026 0
10/27/06 11:56:46 [Note]: FSRAW library version 1.7.1020

Re,

Fais ce qu'il y a écrit ici :
http://www.malekal.com/Trojan-Proxy.Win32.Horst.php

re, ok je le fais tout se suite. merci