virus Dialer "ENTER": rapport hijackthis

bonjour a tous

je suis nouveau ici grâce (ou a cause) d une connection pirate qui se lance meme apres nettoyage des dialer que l' antivirus (CLamwin) ou les antispyware (ad aware et ewido ) trouvent. La connection apparait sous le nom ENTER. Elle lance des .exe dont les noms changent mais je ne sais pas d ou elle les lance.


je vous soumet les rapports des scan Hijackthis puis Ewido

aidez moi c est pour l ordi d une super nana

voila son rapport hijackthis qu on a refait quand la connection Enter etait réapparue, apres nous vous mettons le rapport ewido (et on installe Kerio, que je vais mettre aussi sur mon ordi)

Logfile of HijackThis v1.99.1
Scan saved at 19:26:05, on 19/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\services.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\LaCie\Backup Software\LaCieBackup.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\jw221ho6.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://spanish.ircfast.com/index.p [...] 6&sid=1501
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LaCie Backup] C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
O23 - Service: Services an controller-settings - Unknown owner - C:\WINDOWS\services.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe


Et voici le rapport EWIDO

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 20:20:45 19/11/2006

+ Scan result:



C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : No action taken.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8RA8OUGD\adult1[1].exe -> Dialer.PlayGames.l : No action taken.
C:\jw221ho6.exe -> Dialer.PlayGames.l : No action taken.
:mozilla.51:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.52:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.57:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.58:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Laure\Cookies\laure@112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Laure\Cookies\laure@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
:mozilla.65:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.66:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.49:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.53:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.54:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.55:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.56:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.48:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.16:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Bluestreak : No action taken.
:mozilla.121:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.10:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Comclick : No action taken.
:mozilla.11:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Comclick : No action taken.
:mozilla.9:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Comclick : No action taken.
:mozilla.12:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.81:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Estat : No action taken.
:mozilla.92:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.93:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.94:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.95:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.96:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.13:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.14:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.15:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.111:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.30:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Laure\Cookies\laure@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.122:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Revenue : No action taken.
:mozilla.24:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.25:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.26:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\Laure\Cookies\laure@tacoda[1].txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.85:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.86:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.87:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.88:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.27:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Weborama : No action taken.
:mozilla.28:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Weborama : No action taken.
:mozilla.29:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Weborama : No action taken.
:mozilla.83:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
:mozilla.116:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.119:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.120:C:\Documents and Settings\Laure\Application Data\Netscape\NSB\Profiles\o5pwf5fb.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\Laure\Cookies\laure@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken.


::Report end


à bientot

juste une question, c'est quoi ton antivirus?

connais pas
avg free, ça te tentes pas pour voir?