Recherche impossible sur Google et impossibl de lancer yahoo

Dans IE ou Firefox, il m'est impossible de faire des recherches, sauf dans maps et actualités. Antivirus Kapersky, Spyboot lancé avec Virtumundo effacé, puis Fix Reg, OTMoveIt2.exe, VirtumundoBeGone et HiJackThis dernière version. Merci de m'aider.

Salut

Tu avais donc une infection Vundo ?
Poste ton rapport HijackThis stp.

A+

Voici mon rapport, merci de votre aide

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:31:49, on 25/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\igfxtray.exe
D:\WINDOWS\System32\hkcmd.exe
D:\WINDOWS\System32\igfxpers.exe
D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
D:\Program Files\Synaptics\SynTP\SynTPEnh.exe
D:\WINDOWS\System32\TPSMain.exe
D:\WINDOWS\AGRSMMSG.exe
D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Synaptics\SynTP\Toshiba.exe
D:\PROGRA~1\MICROS~3\wcescomm.exe
D:\WINDOWS\System32\TPSBattM.exe
D:\PROGRA~1\MICROS~3\rapimgr.exe
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
D:\WINDOWS\system32\PDFCreatorMessages.exe
D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
D:\Program Files\WinRAR\WinRAR.exe
D:\DOCUME~1\ToshAMC\LOCALS~1\Temp\Rar$EX00.828\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [igfxtray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] D:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [THotkey] D:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [SynTPEnh] D:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{264A1E05-99D0-4968-BA04-EC09FA6FA882}: NameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{264A1E05-99D0-4968-BA04-EC09FA6FA882}: NameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{264A1E05-99D0-4968-BA04-EC09FA6FA882}: NameServer = 192.168.1.254
O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - D:\WINDOWS\System32\acs.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd - D:\WINDOWS\system32\PDFCreatorMessages.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - D:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

--
End of file - 5010 bytes

Salut

HJT est dans un dossier temporaire, mets le dans un dossier qui lui est propre à la racine de ton disque système du type : C:\HijackThis et refais un scan, édite ton précédent message pour mettre le nouveau rapport à la place de l'ancien.

A+

Voici la copie selon instructions

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:56, on 26/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\igfxtray.exe
D:\WINDOWS\System32\hkcmd.exe
D:\WINDOWS\System32\igfxpers.exe
D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
D:\Program Files\Synaptics\SynTP\SynTPEnh.exe
D:\WINDOWS\System32\TPSMain.exe
D:\WINDOWS\AGRSMMSG.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Synaptics\SynTP\Toshiba.exe
D:\WINDOWS\System32\TPSBattM.exe
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\PROGRA~1\MICROS~3\wcescomm.exe
D:\PROGRA~1\MICROS~3\rapimgr.exe
D:\WINDOWS\system32\PDFCreatorMessages.exe
D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [igfxtray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] D:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "D:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "D:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [THotkey] D:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [SynTPEnh] D:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{264A1E05-99D0-4968-BA04-EC09FA6FA882}: NameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{264A1E05-99D0-4968-BA04-EC09FA6FA882}: NameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{264A1E05-99D0-4968-BA04-EC09FA6FA882}: NameServer = 192.168.1.254
O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - D:\WINDOWS\System32\acs.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd - D:\WINDOWS\system32\PDFCreatorMessages.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - D:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - D:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

--
End of file - 4801 bytes
d'avance merci

Quels outils as-tu utiliser pour supprimer Vundo ?
Suis le guide suivante : http://med365.co.cc/guides/vundo.html et poste le rapport de combofix.

Autre chose, en relisant ton message ça ressemble aux restes d'une infection par IEDefender, dans ce cas télécharge SmitFraudFix : http://siri.urz.free.fr/ redémarre en mode sans échecs (tapotte F8 au démarrage) et lance le directement en option 2, poste le rapport.

A+