1ere analyse

[Jack_Burton]

Re bonjour,

 

Imprime ces instructions ou sauvegarde les dans un fichier texte de façon à pouvoir les consulter en mode sans échec.

 

1/ *Télécharge et installe EasyCleaner de Toni Helenius: http://personal.inet.fi/business/toniarts/ecleane.htm

 

*Télécharge About:Buster : http://downloads.subratam.org/AboutBuster.zip

Dézippe dans un répertoire dédié place un raccourci sur le bureau et mets à jour

 

 

*Télécharge la version d'essai d'Ewido ici :

 

http://www.ewido.net/fr/

 

et l'installer (important: pendant l'installation, sur la page "Additional Options" décocher les deux options "Install background guard" et "Install scan via context menu").

 

Démarrer ewido. Cliquer sur mise à jour, attendre la fin de cette mise à jour puis, fermer le programme.

 

 

2/ Redémarre en mode sans échec.

(au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuyer sur la touche [F8] ou [F5] jusqu'à l'affichage du menu des options avancées de Windows. Sélectionner "Mode sans échec" et appuyer sur [Entrée].)

 

3/ Vérifie d'avoir accès à tous les fichiers

Démarrer, Poste de travail ou autre dossier, Menu Outils, Option des dossiers, onglet Affichage :

Activer la case : Afficher les fichiers et dossiers cachés

Désactiver la case : Masquer les extensions des fichiers dont le type est connu

Désactiver la case : Masquer les fichiers protégés du système d'exploitation

Puis Appliquer

 

4/ Relance un scan HijackThis, clique sur "Do a system scan only" et coche les lignes ci-dessous (si présentes) :

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

 

F3 - REG:win.ini: run=C:\WINDOWS\inet20099\winlogon.exe

 

O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

 

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20099\winlogon.exe

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20099\winlogon.exe

 

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

 

O18 - Protocol: bw+0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

 

O18 - Protocol: offline-8876480 - {4C35BB5E-A10E-46E4-99A1-947DC5453CB7} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

 

O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)<---je suppose que ce sont des restes de ton ancien antivirus puisque tu utilises a présent Avast

 

Ferme toutes les fenêtres sauf HijackThis et "Fix Checked".

 

5/ Supprime le(s) fichier(s) incriminé(s) [s'il(s) existe(nt) encore] par l'Explorateur Windows :

 

-C:\WINDOWS\inet20099<---supprime tout le dossier

-C:\Norman<---supprime tout le dossier (reste de Norman Antivirus)

 

6/ Exécute About:Buster à deux reprises

 

7/ lancer Ewido et cliquer sur scanner puis sur scan complet du système.

 

Si des fichiers infectés sont trouvés, garder l'option par défaut Supprimer (avec la ligne "Créer des copies de sauvegarde cryptées dans la quarantaine" cochée).

 

A la fin du scan, Sauver le rapport (Fichier/Enregistrer sous...)

 

8/ Execute EasyCleaner: Utilise les fonctions "Inutiles" et "Registre" seulement. Ne touche pas à la fonction "doublons".

 

9/ Redémarre l'ordinateur en mode normal et poste un nouveau rapport HijackThis à titre de vérification accompagné du rapport généré par Ewido

 

Remarque : dans les lignes 018, il faut toutes les cocher sauf celle-ci :

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

Il y a un bug dans hijackthis, et la fixer pourrait empécher msn de se lancer

 

Je ne vois aucun parfeu (firewall) sur ce rapport! C est pourtant indispensable pour assurer sa protection! Je te conseille fortement d en installer un! Tu en trouveras 3 gratuits et performants dans "les consignes de sécurité" en bas pres de ma signature, avec des tutos pour les configurer!

Dans la mesure ou tu utilises Avast en antivirus, je te conseille de choisir Kerio en firewall (ZoneAlarm étant incompatible avec cet antivirus)

Modifié le 9 janvier 2006 par Jack_Burton