Désinfécter un ordinateur

blueandyellow · le 30 juin 2008

Bonjour !

L'ordinateur familiale de mes parents est infecté. J'aurais besoin de conseils pour le réparer. Pourriez vous m'aider, s'il vous plaît ?

Voici les rapports d'Avira Antivir et d'Hijackthis :

1) RAPPORT Avira Antivir Personal

Avira AntiVir Personal

Report file date: lundi 30 juin 2008 15:49

Scanning for 1369578 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: XP

Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:42:09

ANTIVIR2.VDF : 7.0.5.20 142336 Bytes 30/06/2008 13:42:10

ANTIVIR3.VDF : 7.0.5.25 18432 Bytes 30/06/2008 13:42:11

Engineversion : 8.1.0.59

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21

AESCRIPT.DLL : 8.1.0.44 278907 Bytes 30/06/2008 13:42:27

AESCN.DLL : 8.1.0.22 119157 Bytes 30/06/2008 13:42:26

AERDL.DLL : 8.1.0.20 418165 Bytes 30/06/2008 13:42:25

AEPACK.DLL : 8.1.1.6 364918 Bytes 30/06/2008 13:42:24

AEOFFICE.DLL : 8.1.0.20 192891 Bytes 30/06/2008 13:42:22

AEHEUR.DLL : 8.1.0.32 1274231 Bytes 30/06/2008 13:42:21

AEHELP.DLL : 8.1.0.15 115063 Bytes 30/06/2008 13:42:16

AEGEN.DLL : 8.1.0.29 307573 Bytes 30/06/2008 13:42:15

AEEMU.DLL : 8.1.0.6 430451 Bytes 30/06/2008 13:42:13

AECORE.DLL : 8.1.0.31 168310 Bytes 30/06/2008 13:42:12

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: lundi 30 juin 2008 15:49

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'Watch.exe' - '1' Module(s) have been scanned

Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned

Scan process 'PollingModule.exe' - '1' Module(s) have been scanned

Scan process 'Inactivity.exe' - '1' Module(s) have been scanned

Scan process 'Toaster.exe' - '1' Module(s) have been scanned

Scan process 'ComComp.exe' - '1' Module(s) have been scanned

Scan process 'EspaceWanadoo.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'skypePM.exe' - '1' Module(s) have been scanned

Scan process 'OSD.exe' - '1' Module(s) have been scanned

Scan process 'ntvdm.exe' - '1' Module(s) have been scanned

Scan process 'TOOLBAR.EXE' - '1' Module(s) have been scanned

Scan process 'MulMouse.exe' - '1' Module(s) have been scanned

Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned

Scan process 'hpohmr08.exe' - '1' Module(s) have been scanned

Scan process 'MagicKey.exe' - '1' Module(s) have been scanned

Scan process 'Skype.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'OpWareSE4.exe' - '1' Module(s) have been scanned

Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned

Scan process 'mdm.exe' - '1' Module(s) have been scanned

Scan process 'realsched.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'Athan.exe' - '1' Module(s) have been scanned

Scan process 'WkUFind.exe' - '1' Module(s) have been scanned

Scan process 'VProperty.exe' - '1' Module(s) have been scanned

Scan process 'dragdiag.exe' - '1' Module(s) have been scanned

Scan process 'qttask.exe' - '1' Module(s) have been scanned

Scan process 'ADeck.exe' - '1' Module(s) have been scanned

Scan process 'VTTimer.exe' - '1' Module(s) have been scanned

Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

55 processes with 55 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '47' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\Propriétaire\Local Settings\Application Data\oqapmmcwc.exe

[DETECTION] Is the Trojan horse TR/Dropper.Gen

[NOTE] The file was moved to '48c9e56c.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s1ao..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48c9e5b6.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s1c8..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48cbe5ba.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s1ds..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48cce5bd.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s1io.1.exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48d1e5c0.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s24c..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '489ce5c3.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s250..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '489de5c5.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s26g..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '489ee5c8.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s284..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48a0e5cd.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s2d0.4.exe

[DETECTION] Contains detection pattern of the dropper DR/Agent.ZM.3

[NOTE] The file was moved to '48cce5d0.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s2ig..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48d1e5d3.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s2tg

[DETECTION] Contains detection pattern of the dropper DR/NewWeb.AR.2

[NOTE] The file was moved to '489ae616.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s31c

[DETECTION] Contains detection pattern of the dropper DR/NewWeb.AR.2

[NOTE] The file was moved to '489be618.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s3fs..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48cee5e7.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s3ko.3

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48d3e5e7.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s3n4.4.exe

[DETECTION] Contains detection pattern of the dropper DR/Vapsup.awu.1

[NOTE] The file was moved to '48d6e5e8.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s3po..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '48d8e5e8.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\s46s..exe

[DETECTION] Is the Trojan horse TR/Agent.AFRM

[NOTE] The file was moved to '489ee5e9.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\se8.7

[DETECTION] Is the Trojan horse TR/Drop.BHQ

[NOTE] The file was moved to '48a0e61b.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\sek

[DETECTION] Is the Trojan horse TR/Dldr.Agent.9876

[NOTE] The file was moved to '48dbe612.qua'!

C:\Documents and Settings\Propriétaire\Local Settings\Temp\sj8..exe

[DETECTION] Contains detection pattern of the dropper DR/NewWeb.AR.1

[NOTE] The file was moved to '48a0e621.qua'!

C:\Documents and Settings\Propriétaire\Mes documents\Downloads\bleach heat the soul 4 psp hentai anime.zip

[0] Archive type: ZIP

--> setup.exe

[DETECTION] Contains detection pattern of the dropper DR/TrafficSol.M.1

[NOTE] The file was moved to '48cde706.qua'!

C:\Documents and Settings\Propriétaire\Mes documents\Downloads\bleach heat the soul 4 psp.zip

[0] Archive type: ZIP

--> setup.exe

[DETECTION] Contains detection pattern of the dropper DR/BHO.HA

[NOTE] The file was moved to '49a38a97.qua'!

C:\Program Files\InternetGameBox\InternetGameBox.exe

[DETECTION] Is the Trojan horse TR/Dldr.NaviPro.A

[NOTE] The file was moved to '48dce8e1.qua'!

C:\System Volume Information\_restore{C25DF845-89CB-484C-9032-1BBAE34B1721}\RP1203\A0289381.exe

[DETECTION] Is the Trojan horse TR/Dropper.Gen

[NOTE] The file was moved to '489aeaf5.qua'!

C:\System Volume Information\_restore{C25DF845-89CB-484C-9032-1BBAE34B1721}\RP1203\A0289388.exe

[DETECTION] Is the Trojan horse TR/Dldr.NaviPro.A

[NOTE] The file was moved to '489aeafc.qua'!

C:\WINDOWS\system32\nse92.dll

[DETECTION] Is the Trojan horse TR/Downloader.Gen

[NOTE] The file was moved to '48cded19.qua'!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

End of the scan: lundi 30 juin 2008 16:28

Used time: 38:48 min

The scan has been done completely.

5643 Scanning directories

234142 Files were scanned

27 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

27 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

234115 Files not concerned

3330 Archives were scanned

2 Warnings

27 Notes

2) RAPPORT HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:49:41, on 30/06/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\windows\Explorer.EXE

C:\WINDOWS\System32\FTRTSVC.exe

C:\windows\system32\VTTimer.exe

C:\Program Files\VIAudioi\SBADeck\ADeck.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\PROGRA~1\PHILIP~1\VProperty.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\Athan\Athan.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe

C:\windows\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\windows\system32\svchost.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Ensemble clavier et souris sans fil Labtec\MagicKey.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Ensemble clavier et souris sans fil Labtec\MulMouse.exe

C:\OLIFAXVX\TOOLBAR.EXE

C:\windows\system32\ntvdm.exe

C:\Program Files\Ensemble clavier et souris sans fil Labtec\OSD.EXE

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\windows\System32\svchost.exe

C:\Program Files\Wanadoo\EspaceWanadoo.exe

C:\Program Files\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Wanadoo\Watch.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: PaltalkWebLogin - {502C3BA4-2C3E-4317-BC29-C0445E82B1F9} - C:\Program Files\Common Files\Paltalk\PaltalkWebLogin.dll

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Program Files\Adssite Advanced Toolbar\toolbar.dll

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [ToUcamVProperty] C:\PROGRA~1\PHILIP~1\VProperty.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [hid_start] C:\windows\System32\Rundll32.exe "C:\windows\system32\gzmrotate.dll" DllVerify

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE

O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE

O4 - Global Startup: Activer l'ensemble clavier et souris sans fil Labtec.lnk = C:\Program Files\Ensemble clavier et souris sans fil Labtec\MagicKey.exe

O4 - Global Startup: EPSON Status Monitor 3 Environment Check(4).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV04.EXE

O4 - Global Startup: hp psc 1000 series.lnk = ?

O4 - Global Startup: hpoddt01.exe.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?defd190b346d4f1a9b4d775c15a52d6f

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?defd190b346d4f1a9b4d775c15a52d6f

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe

O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1104997927397

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 11534 bytes

En vous remerciant pour l'intérêt que vous porterez à ma demande. Mes salutations !

pear · le 30 juin 2008

Bonjour,

Tout est en quarantaine, les ris risques sont donc minimes.

Copier/coller ce qui suit dans le bloc notes,

sans ligne blanche au début.

Enregistrez sur le bureau sous regis.reg.

Cliquez droit sur le fichier ->fusionner

Acceptez la modification du Régistre:

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\CLSID\{41C29B07-6F91-4966-91BE-2E2841643C83}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41C29B07-6F91-4966-91BE-2E2841643C83}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{41C29B07-6F91-4966-91BE-2E2841643C83}"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"hid_start"=-

c:\windows\system32\rundll32.exe

Ils étaient dans restauration système, fichiers temp et ceslignes à supprimer:

C:\Documents and Settings\Propriétaire\Mes documents\Downloads\bleach heat the soul 4 psp hentai anime.zip

C:\Documents and Settings\Propriétaire\Mes documents\Downloads\bleach heat the soul 4 psp.zip

Et ceci , en principe par Ajout/Suppression de programmes

C:\Program Files\InternetGameBox\InternetGameBox.exe

c:\program files\adssite advanced toolbar\toolbar.dll

Videz les fichiers temporaires avac Ccleaner, Easycleaner ou AtfCleaner.

Désinstallez la Restauration Système.

Poste de Travail->Propriétés->Restauration Système.

Cocher la case "Désactiver la Restauration sur tous les lecteurs".

Vous la décocherez ensuite.

Un nouveau point de restauration sera créé.

Java n'est pas à jour,donc moins sécurisé.

Rendez vous là:

Java Runtime Environment (JRE) 6 Update 6

http://java.sun.com/javase/downloads/index.jsp

Download Now

S'ouvre une nouvelle page.

Vous descendrez là:

Java Runtime Environment (JRE) 6 Update 6

Clic sur Download

Nouvelle page.

Sélectionnez votre platform->Windows

Cochez "I agree to the java..."

clic sur continue

Nouvelle page

Cochez:

Windows Online Installation

Cochez la flèche orange

" Cochez ici"jre-6u6-windows-i586-p-iftw.exe

Cela fait, supprimez les installations java antérieures par "Ajout/Suppression de Programmes"

Il y a trop de toolbars:

Wanadoo, Google,Olifax,Windows life...

Une seule suffit.

Dans Hijackthis,cochez ces lignes puis clic sur Fix checked

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

Postez ensuite un nouvel Hijackthis

blueandyellow · le 4 juillet 2008

Bonjour !

J'ai bien reçu votre premier message est je vous en remercie

En revanche je n'ai pas pu effectuer tout ce que vous m'avez conseillé. Je suis plutôt débutant en informatique.

Je n'ai pas fait cette démarche ci-dessous, parce que je n'ai pas su comment m'y prendre précisément, j'ai bien copier les lignes dans le bloc notes de windows et enregistrer le fichier sur le bureau, mais en faisant un clic droit on ne propose pas l'option fusionner ???

Copier/coller ce qui suit dans le bloc notes,

sans ligne blanche au début.

Enregistrez sur le bureau sous regis.reg.

Cliquez droit sur le fichier ->fusionner

Acceptez la modification du Régistre:

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\CLSID\{41C29B07-6F91-4966-91BE-2E2841643C83}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41C29B07-6F91-4966-91BE-2E2841643C83}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{41C29B07-6F91-4966-91BE-2E2841643C83}"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"hid_start"=-

Ici je n'ai pas su quoi faire avec les fichier ci dessous ???

c:\windows\system32\rundll32.exe

Ils étaient dans restauration système, fichiers temp et ceslignes à supprimer:

C:\Documents and Settings\Propriétaire\Mes documents\Downloads\bleach heat the soul 4 psp hentai anime.zip

C:\Documents and Settings\Propriétaire\Mes documents\Downloads\bleach heat the soul 4 psp.zip

Et ceci , en principe par Ajout/Suppression de programmes

C:\Program Files\InternetGameBox\InternetGameBox.exe

c:\program files\adssite advanced toolbar\toolbar.dll

En revanche j'ai installé ccleaner et vidé les fichiers temporaires

Mais je n'ai pas touché à la réstauration système par peur de faire un grosse erreur

J'ai bien mis à jour Java (Java Runtime Environment (JRE) 6 Update 6)

Je n'ai pas trouver l'endroit où supprimer les toolbars. Je suis pourtant allé dans panneau de configuration - ajout et suppresion de programme - mais pas possible de les supprimer. Y'a t'il une autre méthode ?

Dans Hijackthis, j'ai cochez les lignes ci dessous puis j'ai cliqué sur Fix checked

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

Voiçi mon nouveau rapport Hijackthis, merci de m'aider à l'interpreter, à bientôt :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:45:19, on 04/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\windows\Explorer.EXE

C:\windows\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\windows\system32\VTTimer.exe

C:\Program Files\VIAudioi\SBADeck\ADeck.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\PROGRA~1\PHILIP~1\VProperty.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\windows\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Ensemble clavier et souris sans fil Labtec\MagicKey.exe

C:\Program Files\Ensemble clavier et souris sans fil Labtec\MulMouse.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\OLIFAXVX\TOOLBAR.EXE

C:\windows\system32\ntvdm.exe

C:\Program Files\Ensemble clavier et souris sans fil Labtec\OSD.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\windows\system32\svchost.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\windows\System32\svchost.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\Hpqdirec.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Propriétaire\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: PaltalkWebLogin - {502C3BA4-2C3E-4317-BC29-C0445E82B1F9} - C:\Program Files\Common Files\Paltalk\PaltalkWebLogin.dll

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [ToUcamVProperty] C:\PROGRA~1\PHILIP~1\VProperty.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"