pop-up security alert . fausses alertes windows, PC lent

Bonjour a tous!

J' utilise windows vista et Norton antivirus.

Depuis quelques temps mon PC est lents et des fenetre s'ouvrent seules m'avertissant du 'grand danger' que court mon PC si je ne telecharge pas leur programme. J'ai bien entendu des faux scan qui ont ete realise me disant que 45 infections ont ete trouvee sur mn PC, et j'ai aussi des fausses alertes windows.
Parmis les intrus j'ai PCPrivacyTools.

Je n'ai clique sur aucun des liens ou download qu'ils m'ont envoyes et les ai ignores.

Voulant resoudre le probleme, j'ai effectue une recherche sur internet et ai suivi les conseils d'un site http://www.2-spyware.com/remove-pcprivacytool.html en installant SPYWAREDOCTOR (PC Tools)
Spyware doctor a trouve tout un tas d'infections dont :

rogue antispyware drive cleaner,
rogue antispyware PCPrivacyTools
trojan.mailskinner
Dialer.Instant_access
...
Apres avoir effectue le scan, il me dit que seule la version payante me permet de supprimer ces intrus. Ai-je fais une betise en installant spyware doctor?


Que dois-je faire maintenant?
Merci d'avance pour votre aide precieuse!

Bonsoir, infecté en effet..

Désactive l'UAC ( Menu Démarrer \ Panneau de Configuration \ Comptes d'utilisateurs et protection des utilisateurs \ Comptes d'utilisateurs \ Activer ou désactiver le contrôle des comptes d'utilisateurs \ décoche la case Utiliser le contrôle ... et valide par OK , il te sera demandé de redémarrer, fais le )

Télécharge Navilog

Enregistre-le sur ton Bureau.
Installe-le en double cliquant sur navilog.exe.
Une fois l'installation terminée, l'utilitaire s'exécutera automatiquement.
(Si ce n'est pas le cas, double clique sur le raccourci présent sur le Bureau)

Laisse-toi guider par l'utilitaire. Choisis l'option 1 puis valide.
! N'utilise pas l'option 2,3 et 4 sans notre accord !
Patiente jusqu'à l'apparition de ce message :
"*** Analyse Termine le ..... ***"
Appuie sur une touche comme demandé. Le Bloc-notes va s'ouvrir. Poste le rapport ici.

Le rapport se trouve ici :C:\fixnavi.txt

Ouaw! merci pour la rapidite de reponse!

J'ai suivi tes instructions. Voila 30 min que la fenetre de navilog est bloquee au meme point.

"GenericNavisearch
Veuillez patienter
1 file copied"

Est-ce normal? Dois-je patienter? Dois je recommencer?

merci!

Hello!

Apres avoir attendu 1 heure, sans que rien ne se passe, j'ai relance Navilog1.

Me voici 2 heures 48 min plus tard, et la encore, Navilog1 arrete, mais a un stade different que la premiere fois. Cette fois si j'en suis a "search with Catchme by gmer[....]
the scan may take a few minutes"

Que faire?

Merci!

et j'oubliais: quelques chose doit planter...je n'ai plus acces a poste de travail ni a panneau de config depuis que j'ai lance Navilog1!
aie!

je precise que apres avoir redemarre la bete, tout refonctionne.
Voila, bonne nuit!

A bientot...

Re,

Désactive tes protections (ton antivirus), et ressaie pour navilog.
Au pire, essaie en mode sans échec

Bonjour Michou,

Voila, le travail est fait....
Merci!!!

Search Navipromo version 3.2.1 began on Wed 10/10/2007 at 11:39:52.70

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Program Files\navilog1
Updated on 09.10.2007 at 18h00 by IL-MAFIOSO

Microsoft Windows [Version 6.0.6000]
Version Internet Explorer : 7.0.6000.16512

Done in normal mode

*** Searching for installed Software ***




*** Search folders in C:\Windows ***



*** Search folders in C:\Program Files ***

C:\Program Files\WebMediaPlayer found !

*** Search folders in C:\ProgramData ***


*** Search folders in C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***

...\WebMediaPlayer found !

*** Search folders in C:\Users\deleuze\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs ***


*** Search folders in C:\Users\deleuze\AppData\Local\virtualstore\Program Files ***



*** Search folders in C:\Users\deleuze\AppData\Roaming ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

Hidden(s) file(s) :

C:\Users\deleuze\AppData\Local\sfkejobvag.dat
C:\Users\deleuze\AppData\Local\sfkejobvag.exe
C:\Users\deleuze\AppData\Local\sfkejobvag_nav.dat
C:\Users\deleuze\AppData\Local\sfkejobvag_navps.dat

Hidden(s) Process :

C:\Users\deleuze\AppData\Local\sfkejobvag.exe


*** Search with GenericNaviSearch ***
!!! Possibility of legitims files in the result !!!
!!! To be always checked before manually deleting !!!

* Scan C:\Windows\system32 *

* Scan C:\Users\deleuze\AppData\Local\Microsoft *

* Scan C:\Users\deleuze\AppData\Local\virtualstore\windows\system32 *

* Scan C:\Users\deleuze\AppData\Local *

Files found :

sfkejobvag.exe found !



*** Search files ***


C:\Users\Public\Desktop\WebMediaPlayer.lnk found !
C:\Windows\system32\nvs2.inf found !


*** Search registry keys ***

HKEY_CURRENT_USER\Software\Lanconfig found !

*** Complementary Search ***
(Search specifics files)

1)Search known files:

2)Heuristic Search :

C:\Users\deleuze\AppData\Local\sfkejobvag.dat found !

3)Certificates Search :

Certificate Egroup found !


*** Search completed on Wed 10/10/2007 at 11:40:32.60 ***

De rien

Double clique sur le raccourci de navilog1.
Option 2 puis valide. (entrée)
Laisse toi guider.
Ton ordinateur va redémarrer, sinon fais le manuellement.

Ton bureau va disparaître.

Patiente jusqu'à l'apparition de ce message :
"*** Nettoyage Termine le ..... ***"

Appuie sur une touche comme demandé, le Bloc-notes va s'ouvrir.
Sauvegarde le rapport.
Referme le Bloc-notes. Ton bureau va maintenant réapparaître.

Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tapes explorer et valides. Cela te fera apparaitre ton bureau

Démarrer -> panneau de configuration -> options internet
Clique sur l'onglet "Contenu" puis onglet "Certificats" et si tu trouves ceci, en particulier dans "éditeurs approuvés" :

electronic-group ; egroup ; Montorgueil ; VIP ; "Sunny Day Design Ltd"

~~> Supprime-les tous <~~

Poste le rapport sauvegardé auparavant (C:\cleannavi.txt)
Ainsi qu'un nouveau rapport Hijackthis.

Voila voila, on avance! Merci encore Michou.

Parmis les (tres nombreux) certif, j'ai trouve Electronic-group que j'ai supprime.

Alors, les rapports:

heu...ben je trouve plus le rapport cleannavi. M...alors, j'ai du faire une betise....???

Search Navipromo version 3.2.1 began on Wed 10/10/2007 at 12:38:22.04

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Program Files\navilog1
Updated on 09.10.2007 at 18h00 by IL-MAFIOSO

Microsoft Windows [Version 6.0.6000]
Version Internet Explorer : 7.0.6000.16512

Done in normal mode

*** Searching for installed Software ***




*** Search folders in C:\Windows ***



*** Search folders in C:\Program Files ***


*** Search folders in C:\ProgramData ***


*** Search folders in C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***


*** Search folders in C:\Users\deleuze\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs ***


*** Search folders in C:\Users\deleuze\AppData\Local\virtualstore\Program Files ***



*** Search folders in C:\Users\deleuze\AppData\Roaming ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

No file found in :

- C:\Users\deleuze\AppData\Local\Microsoft
- C:\Users\deleuze\AppData\Local\virtualstore\windows\system32
- C:\Users\deleuze\AppData\Local



*** Search with GenericNaviSearch ***
!!! Possibility of legitims files in the result !!!
!!! To be always checked before manually deleting !!!

* Scan C:\Windows\system32 *

* Scan C:\Users\deleuze\AppData\Local\Microsoft *

* Scan C:\Users\deleuze\AppData\Local\virtualstore\windows\system32 *

* Scan C:\Users\deleuze\AppData\Local *



*** Search files ***




*** Search registry keys ***


*** Complementary Search ***
(Search specifics files)

1)Search known files:

2)Heuristic Search :


3)Certificates Search :

Certificate Egroup not found !


*** Search completed on Wed 10/10/2007 at 12:38:49.63 ***

Pas grave, c'est supprimé quand même.
C'est mieux?

Télécharge sur ton bureau : Clean
Dézippe le sur ton bureau. Double-clic sur ce dossier clean.
Double-clic sur clean.cmd. Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé et poste le rapport ici.
Le rapport se trouve ici : C:\rapport_clean.txt
Tuto

Ca a l'air d'aller beaucoup mieux!!!
Merci merci!
Mais comment ai-je chope ces merdes? Je suis pourtant prudente et ne telecharge pas grand chose... Un conseil a me donner pour eviter ce genre de probleme?

Voici le rapport de clean:

Wed 10/10/2007 a 13:36:12.33

*** Recherche C:

*** Recherche C:\Windows\

*** Recherche C:\Windows\system32
C:\Windows\system32\wininit.exe FOUND
C:\Windows\system32\wininit.exe FOUND

*** Recherche C:\Program Files
*** End of the report !

Ton infection est dû au téléchargement de Webmediaplayer, programme à éviter

Continue à faire attention oui

Télécharge AVG Anti-Spyware Installes-le.
Lance AVG et fais une mise à jour.
Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglet comment réagir, clique sur Actions recommandées. Choisis Quarantaine.
Ne fais pas d’analyse pour le moment.
Redémarre en mode sans échec.
Relance Avg.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas.
Clique sur "Enregistrer le rapport". Ceci génère un rapport qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
Poste le ici.
&
Toujours en mode sans échec, relance clean et fais l'option 2, poste le rapport.

c est fait chef! voila les rapports demandes...


Script executed in Safe Mode
Rapport clean par Malekal_morte - http://www.malekal.com
Script executed in Safe Mode Wed 10/10/2007 a 15:13:39.26

Microsoft Windows [Version 6.0.6000]

*** Suppression C:

*** Suppression C:\Windows\

*** Suppression C:\Windows\system32
tentative de suppression de C:\Windows\system32\wininit.exe
Impossible de supprimer C:\Windows\system32\wininit.exe
tentative de suppression de C:\Windows\system32\wininit.exe
Impossible de supprimer C:\Windows\system32\wininit.exe

*** Suppression C:\Program Files

*** Deletion of the registry keys successful..
*** End of the report !
---------------------------------------------------------------------

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 3:12:00 PM 10/10/2007

+ Résultat de l'analyse:



C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@clickbank[1].txt -> TrackingCookie.Clickbank : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@connextra[3].txt -> TrackingCookie.Connextra : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@searchportal.information[1].txt -> TrackingCookie.Information : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@ads.planetactive[2].txt -> TrackingCookie.Planetactive : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@ads.planetactive[2].txt -> TrackingCookie.Planetactive : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@real[2].txt -> TrackingCookie.Real : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@revsci[2].txt -> TrackingCookie.Revsci : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@tacoda[2].txt -> TrackingCookie.Tacoda : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@valueclick[2].txt -> TrackingCookie.Valueclick : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@webstat[2].txt -> TrackingCookie.Web-stat : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\Low\deleuze@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Users\deleuze\AppData\Roaming\Microsoft\Windows\Cookies\deleuze@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.


Fin du rapport

Re,

Télécharge Killbox (tuto)
Dézippe-le sur ton bureau.
Sélectionne l’encadré ci-dessous, puis fais clique droit - copier

Lance PocketKillBox , va dans "File" puis "Paste from Clipboard" (tu ne verras rien se passer).
Tu peux vérifier dans le menu déroulant que tous les fichiers sont bien présents.
Coche la case "Delete on reboot" + "unregistre dll before deleting"
Clique sur "all files" et ensuite sur la croix rouge
Réponds yes aux messages qui vont s’afficher.
Si l’ordinateur ne redémarre pas, fais le manuellement.
Après redémarrage, relance Killbox. Va dans "File" puis "Logs" et "Actions History Log".
Poste le rapport.

Reposte un hijackthis.

Bonjour Michou,

J'ai suivi tes instructions et les rapports sont ci-dessous.
Par contre pour KillBox, la case "unregistre dll before rebooting" etait grisee et ne pouvait pas etre cochee.
Quand tu dis de poster un rapport Hijackthis, tu parles biensur de Navilog, n'est ce pas?

Merci et a plus tard!


Pocket Killbox version 2.0.0.648
Running on as deleuze(Limited Account)
was started @ Thursday, October 11, 2007, 12:35 PM

# 1 [Delete on Reboot]
Path = C:\Windows\system32\wininit.exe


I Rebooted @ 12:37:20 PM
Killbox Closed(Exit) @ 12:37:26 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on as deleuze(Limited Account)
was started @ Thursday, October 11, 2007, 12:40 PM

------------------------------------------------------------



Search Navipromo version 3.2.1 began on Thu 10/11/2007 at 12:42:54.00

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Program Files\navilog1
Updated on 09.10.2007 at 18h00 by IL-MAFIOSO

Microsoft Windows [Version 6.0.6000]
Version Internet Explorer : 7.0.6000.16546

Done in normal mode

*** Searching for installed Software ***




*** Search folders in C:\Windows ***



*** Search folders in C:\Program Files ***


*** Search folders in C:\ProgramData ***


*** Search folders in C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***


*** Search folders in C:\Users\deleuze\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs ***


*** Search folders in C:\Users\deleuze\AppData\Local\virtualstore\Program Files ***



*** Search folders in C:\Users\deleuze\AppData\Roaming ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

No file found in :

- C:\Users\deleuze\AppData\Local\Microsoft
- C:\Users\deleuze\AppData\Local\virtualstore\windows\system32
- C:\Users\deleuze\AppData\Local



*** Search with GenericNaviSearch ***
!!! Possibility of legitims files in the result !!!
!!! To be always checked before manually deleting !!!

* Scan C:\Windows\system32 *

* Scan C:\Users\deleuze\AppData\Local\Microsoft *

* Scan C:\Users\deleuze\AppData\Local\virtualstore\windows\system32 *

* Scan C:\Users\deleuze\AppData\Local *



*** Search files ***




*** Search registry keys ***


*** Complementary Search ***
(Search specifics files)

1)Search known files:

2)Heuristic Search :


3)Certificates Search :

Certificate Egroup not found !


*** Search completed on Thu 10/11/2007 at 12:43:22.73 ***

Ah excuse moi, on ne l'avait pas encore utilisé.
Le fichier C:\Windows\system32\wininit.exe est-il toujours présent ?

Télécharge Hijackthis

Dézippe le dans un dossier sur ton bureau.
Double clique sur celui-ci.
Puis "Do a system scan and save a logfile" et poste le rapport.
Tuto HiJackThis

C:\Windows\system32\wininit.exe est TOUJOURS present...
Voila le rapport hijackthis.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:55:01 PM, on 10/11/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\hp\kbd\kbd.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\deleuze\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c(...)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c(...)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10252 bytes

Re,

Pas d'autre infection visible.

Relance HiJackThis, do a system scan only, coche ces lignes :

Puis Fix Checked !

Télécharge Killbox (tuto)
Dézippe-le sur ton bureau.
Sélectionne l’encadré ci-dessous, puis fais clique droit - copier

Lance PocketKillBox , va dans "File" puis "Paste from Clipboard" (tu ne verras rien se passer).
Tu peux vérifier dans le menu déroulant que tous les fichiers sont bien présents.
Coche la case "Delete on reboot" + "unregistre dll before deleting"(cette case peut être grisée si une ce n'est pas une dll qui a été entrée)
Clique sur "all files" et ensuite sur la croix rouge
Réponds yes aux messages qui vont s’afficher.
Si l’ordinateur ne redémarre pas, fais le manuellement.
Après redémarrage, relance Killbox. Va dans "File" puis "Logs" et "Actions History Log".
Poste le rapport.

juste une petite question: ce fichier wininit, c est pas un fichier normal de windows???

Je ne le ferai pas supprimer si c'était le cas:)
Le fichier sain s'appelle wininet.dll et non wininit

Je ne doute pas de ce que tu me fais faire...je suis pas assez douee pour ca Je pensais que peut etre un virus se cachait avec un vrai nom de fichier....

Voila le rapport:

Pocket Killbox version 2.0.0.648
Running on as deleuze(Limited Account)
was started @ Thursday, October 11, 2007, 12:35 PM

# 1 [Delete on Reboot]
Path = C:\Windows\system32\wininit.exe


I Rebooted @ 12:37:20 PM
Killbox Closed(Exit) @ 12:37:26 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on as deleuze(Limited Account)
was started @ Thursday, October 11, 2007, 12:40 PM

Killbox Closed(Exit) @ 12:40:43 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on as deleuze(Limited Account)
was started @ Thursday, October 11, 2007, 5:20 PM

# 1 [Delete on Reboot]
Path = C:\Windows\system32\wininit.exe


I Rebooted @ 5:21:35 PM
Killbox Closed(Exit) @ 5:21:36 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on as deleuze(Limited Account)
was started @ Thursday, October 11, 2007, 5:26 PM

le fichier est toujours la...
tu as besoin d'un rapport hijackthis ou navilog apres ca?
Merci, et bonne nuit a toi!

euh... desolee, mais encore petite question: comment se fait-il que ce fichier soit en date de novembre 2006, alors que j'ai achete mon PC il y a quelques mois?
Fait-il courir un grand danger a mon PC? C est un virus?
Avec ce fichier qui se traine toujours ici, est ce que je cours un risque de confidentialite??? (je n'ose plus rien faire!)

Comment se renseigner sur des programmes avant de les installer sur son PC (ex: webmediaplayer qui m'a plombee, n'avait pas plombe ma soeur...)?

Depuis que tu m'a aide a virer les autres 'infections' mon PC va beaucoup mieux!!!!! MERCI!

Re,

Oui c'est un fichier indésirable ..
Pour les programmes : http://forum.malekal.com/ftopic1836.php
Ils n'y sont pas tous, mais il yen a déjà pas mal.
Fais des recherches sur le net pour tes programmes avant de les télécharger, télécharge sur des sites sûrs.

Essaie de supprimer ce fichier en mode sans échec (le wininit)
Fais attention à suppprimer le bon fichier.

Bonjour Michou,

Desolee, je reponds tard, mais impossible de me connecter au site....

Bref, la suppression de wininit en mode sans echec ne marche pas...

Voila le message que j'obtiens:

Destination folder access denied

You need permission to perform this action

Wininit
File description: windows start-up application
Company: Microsoft Corporation
File version: 6.0.6000.16386
Date created: 11/2/2006 3:44 am
Size: 93.5 KB

Le vicelard!
Que faire maintenant?

Merci encore de t'occuper de mon cas!

Re,

Fais un scan avec ton antivirus. Poste le rapport.
Si tu as envie de changer d'antivirus, désinstalle norton et installe antivir.

Voila le rapport de norton...que des tracking cookies, mais avant de poster sur ce site, j etais bel et bien infectee, et pourtant norton ne m'avait sorti que des cookies!!!
Je viens de payer $45 pour avoir Norton...

Scan Stats:
Scan Time: 218
Scan Options:
Scan Targets:
Counts:
Total items scanned: 7655
- Files & Directories: 2219
- Registry Entries: 276
- Processes & Start-up Items: 4048
- Network & Browser Items: 1102
- Potential Unknown Threats: 5
- Other: 5

Total security risks detected: 1
Total items resolved: 0
Total items that require attention: 1

Resolved Threats:


Unresolved Threats:
Tracking Cookie
Virus ID: 4294909925
Type: Anomaly
Risk: Low (Low Stealth, Low Removal, Low Performance, Low Privacy)
Categories: Cookie
State: Not Attempted
-----------
7 Tracking Cookies
Cookie:deleuze@media.adrevolver.com/adrevolver/ - No action taken
Cookie:deleuze@techguy.us.intellitxt.com/ - No action taken
Cookie:deleuze@ads.expedia.com/ - No action taken
Cookie:deleuze@media.hotels.com/ - No action taken
Cookie:deleuze@ad.yieldmanager.com/ - No action taken
Cookie:deleuze@media.adrevolver.com/ - No action taken

Petite info, au cas ou ca te soit utile....(on sait jamais): il y a queques temps j'ai chope W32.rajump detecte et enleve par Norton.

Et oui, norton n'est vraiment pas ce qu'on fait de mieux.
La prochaine fois, si tu désires toujours un payant, prends Kaspersky

As-tu toujours des problèmes ?
Tu peux refaire un scan Spyware Doctor, et me dire ce qu'il te trouve. (si tu veux)

bonjour Michou,

Spyware doctor me trouve toujours Dialer.Instant_access, 15 adware advertising et 25 aplication.TrackingCookies

apparemment Dialer.Instant_access est pas tres sympa!!!
J ai ceci: HKEY_USERS
S-1-5-21-97304389-3229914424-173611390-1000

Que puis-je faire ?

Merci.

Peux-tu me donner tous les chemins complets ?

Bonjour Michou,

oui, mon PC va beaucoup mieux. Il reste tres tres lent au demarrage cependant.
Aussi, mais je ne sais pas si cela a voir avec les virus et autres infections, je dois constamment reinstaller mon imprimante...

Voici le rapport de spyware doctor. J'ai d'abord realise un "intelliscan" puis un full scan, ce qui explique que le rapport soit en deux parties. Sinon, Navilog1 a ete detecte comme virus...

Re re re merci!
A tres bientot et bon we!

PC Tools Spyware Doctor PC Tools Spyware Doctor
DateStatus
10/13/2007 12:20:23 PM:938AntiVirus Engine
Engine initialized or reloaded successfully.
10/13/2007 12:20:25 PM:471Service Started
Spyware Doctor Service Application started
10/13/2007 12:20:36 PM:800Immunizer Results
ActiveX section has been immunized, Processed 3655 items.
10/13/2007 12:21:12 PM:459OnGuards status
All OnGuards were Enabled
10/13/2007 12:22:55 PM:794Scan Started
Scan Type - Intelli-Scan

10/13/2007 12:22:58 PM:387Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - 247realmedia.com/ 247realmedia.com

10/13/2007 12:22:58 PM:390Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - 2o7.net/ 2o7.net

10/13/2007 12:22:58 PM:457Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - ad.yieldmanager.com/ ad.yieldmanager.com

10/13/2007 12:22:58 PM:475Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - adecn.com/ adecn.com

10/13/2007 12:22:58 PM:480Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - adrevolver.com/ adrevolver.com

10/13/2007 12:22:58 PM:510Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - ads.pointroll.com/ ads.pointroll.com

10/13/2007 12:22:58 PM:536Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - adtech.de/ adtech.de

10/13/2007 12:22:58 PM:539Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - advertising.com/ advertising.com

10/13/2007 12:22:58 PM:541Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - adviva.net/ adviva.net

10/13/2007 12:22:58 PM:579Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - atdmt.com/ atdmt.com

10/13/2007 12:22:58 PM:583Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - atwola.com/ atwola.com

10/13/2007 12:22:58 PM:611Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 12:22:58 PM:618Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bs.serving-sys.com/ bs.serving-sys.com

10/13/2007 12:22:58 PM:622Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - burstnet.com/ burstnet.com

10/13/2007 12:22:58 PM:655Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - cybermonitor.com/ cybermonitor.com

10/13/2007 12:22:58 PM:664Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - dm.travelocity.com/ dm.travelocity.com

10/13/2007 12:22:58 PM:667Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - dotomi.com/ dotomi.com

10/13/2007 12:22:58 PM:673Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/13/2007 12:22:58 PM:745Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - estat.com/ estat.com

10/13/2007 12:22:58 PM:780Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - fastclick.net/ fastclick.net

10/13/2007 12:22:58 PM:788Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - fl01.ct2.comclick.com/ fl01.ct2.comclick.com

10/13/2007 12:22:58 PM:880Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - fr.sitestat.com/ fr.sitestat.com

10/13/2007 12:22:58 PM:880Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - fr.sitestat.com/ fr.sitestat.com

10/13/2007 12:22:58 PM:922Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - ic-live.com/ ic-live.com

10/13/2007 12:22:59 PM:66Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - m.webtrends.com/ m.webtrends.com

10/13/2007 12:22:59 PM:141Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - media.adrevolver.com/ media.adrevolver.com

10/13/2007 12:22:59 PM:144Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - mediaplex.com/ mediaplex.com

10/13/2007 12:22:59 PM:183Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - msnportal.112.2o7.net/ msnportal.112.2o7.net

10/13/2007 12:22:59 PM:270Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - overture.com/ overture.com

10/13/2007 12:22:59 PM:307Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - pro-market.net/ pro-market.net

10/13/2007 12:22:59 PM:353Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - realmedia.com/ realmedia.com

10/13/2007 12:22:59 PM:423Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - rotator.adjuggler.com/ rotator.adjuggler.com

10/13/2007 12:22:59 PM:516Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - serving-sys.com/ serving-sys.com

10/13/2007 12:22:59 PM:519Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:22:59 PM:572Infection was detected on this computer
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - statcounter.com/ statcounter.com

10/13/2007 12:22:59 PM:695Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - tradedoubler.com/ tradedoubler.com

10/13/2007 12:22:59 PM:703Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - travelocity.com/ travelocity.com

10/13/2007 12:22:59 PM:712Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - tribalfusion.com/ tribalfusion.com

10/13/2007 12:23:00 PM:143Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - xiti.com/ xiti.com

10/13/2007 12:23:00 PM:165Infection was detected on this computer
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - zedo.com/ zedo.com

10/13/2007 12:23:22 PM:387Infection was detected on this computer
Threat Name - Dialer.Instant_Access
Type - Registry Value
Risk Level - High
Infection -
HKEY_USERS\S-1-5-21-97304389-3229914424-173611390-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust
Providers\Software Publishing\Trust Database\0,
goicfboogidikkejccmclpieicihhlpo jimddp

10/13/2007 12:25:56 PM:625Scan Finished
Scan Type - Intelli-Scan
Items Processed - 117333
Threats Detected - 3
Infections Detected - 41
Infections Ignored - 0

10/13/2007 12:26:00 PM:793AntiVirus Engine
Engine initialized or reloaded successfully.
10/13/2007 12:30:05 PM:548OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - 247realmedia.com/ 247realmedia.com

10/13/2007 12:30:05 PM:549OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - 2o7.net/ 2o7.net

10/13/2007 12:30:05 PM:550OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - ad.yieldmanager.com/ ad.yieldmanager.com

10/13/2007 12:30:05 PM:551OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - adecn.com/ adecn.com

10/13/2007 12:30:05 PM:552OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - adrevolver.com/ adrevolver.com

10/13/2007 12:30:05 PM:553OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - ads.pointroll.com/ ads.pointroll.com

10/13/2007 12:30:05 PM:554OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - adtech.de/ adtech.de

10/13/2007 12:30:05 PM:554OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - advertising.com/ advertising.com

10/13/2007 12:30:05 PM:555OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - adviva.net/ adviva.net

10/13/2007 12:30:05 PM:556OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - atdmt.com/ atdmt.com

10/13/2007 12:30:05 PM:557OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - atwola.com/ atwola.com

10/13/2007 12:30:05 PM:558OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 12:30:05 PM:559OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bs.serving-sys.com/ bs.serving-sys.com

10/13/2007 12:30:05 PM:559OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - burstnet.com/ burstnet.com

10/13/2007 12:30:05 PM:560OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - cybermonitor.com/ cybermonitor.com

10/13/2007 12:30:05 PM:561OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - dm.travelocity.com/ dm.travelocity.com

10/13/2007 12:30:05 PM:561OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - dotomi.com/ dotomi.com

10/13/2007 12:30:05 PM:562OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/13/2007 12:30:05 PM:562OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - estat.com/ estat.com

10/13/2007 12:30:05 PM:563OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - fastclick.net/ fastclick.net

10/13/2007 12:30:05 PM:563OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - fl01.ct2.comclick.com/ fl01.ct2.comclick.com

10/13/2007 12:30:05 PM:564OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - fr.sitestat.com/ fr.sitestat.com

10/13/2007 12:30:05 PM:565OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - fr.sitestat.com/ fr.sitestat.com

10/13/2007 12:30:05 PM:565OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - ic-live.com/ ic-live.com

10/13/2007 12:30:05 PM:566OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - m.webtrends.com/ m.webtrends.com

10/13/2007 12:30:05 PM:566OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - media.adrevolver.com/ media.adrevolver.com

10/13/2007 12:30:05 PM:567OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - mediaplex.com/ mediaplex.com

10/13/2007 12:30:05 PM:568OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - msnportal.112.2o7.net/ msnportal.112.2o7.net

10/13/2007 12:30:05 PM:569OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - overture.com/ overture.com

10/13/2007 12:30:05 PM:569OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - pro-market.net/ pro-market.net

10/13/2007 12:30:05 PM:570OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - realmedia.com/ realmedia.com

10/13/2007 12:30:05 PM:571OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - rotator.adjuggler.com/ rotator.adjuggler.com

10/13/2007 12:30:05 PM:571OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - serving-sys.com/ serving-sys.com

10/13/2007 12:30:05 PM:572OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:30:05 PM:572OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - statcounter.com/ statcounter.com

10/13/2007 12:30:05 PM:573OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - tradedoubler.com/ tradedoubler.com

10/13/2007 12:30:05 PM:574OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - travelocity.com/ travelocity.com

10/13/2007 12:30:05 PM:574OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - tribalfusion.com/ tribalfusion.com

10/13/2007 12:30:05 PM:575OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - xiti.com/ xiti.com

10/13/2007 12:30:05 PM:576OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - zedo.com/ zedo.com

10/13/2007 12:30:23 PM:82OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:47:44 PM:854OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - cybermonitor.com/ cybermonitor.com

10/13/2007 12:47:44 PM:854OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/13/2007 12:47:44 PM:855OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:48:40 PM:267OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/13/2007 12:48:40 PM:268OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:49:38 PM:649OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:50:45 PM:726OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 12:50:45 PM:726OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:50:45 PM:728OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - xiti.com/ xiti.com

10/13/2007 12:51:54 PM:213OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bs.serving-sys.com/ bs.serving-sys.com

10/13/2007 12:51:54 PM:214OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - serving-sys.com/ serving-sys.com

10/13/2007 12:51:54 PM:214OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:55:58 PM:832OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 12:55:58 PM:833OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bs.serving-sys.com/ bs.serving-sys.com

10/13/2007 12:55:58 PM:865OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - mediaplex.com/ mediaplex.com

10/13/2007 12:55:58 PM:866OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - serving-sys.com/ serving-sys.com

10/13/2007 12:56:15 PM:137OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 12:56:15 PM:137OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 12:58:54 PM:978OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 12:58:54 PM:980OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 1:02:42 PM:573OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 1:26:20 PM:870Service Stopped
Spyware Doctor Service Application Stopped
10/13/2007 4:31:10 PM:912AntiVirus Engine
Engine initialized or reloaded successfully.
10/13/2007 4:31:19 PM:967Service Started
Spyware Doctor Service Application started
10/13/2007 4:31:20 PM:495OnGuards status
All OnGuards were Enabled
10/13/2007 4:31:20 PM:855Immunizer Results
ActiveX section has been immunized, Processed 59 items.
10/13/2007 4:39:58 PM:663OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/13/2007 4:39:58 PM:664OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - xiti.com/ xiti.com

10/13/2007 4:40:11 PM:46OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 4:41:44 PM:907OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - cybermonitor.com/ cybermonitor.com

10/13/2007 4:41:44 PM:945OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 4:42:30 PM:309OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 4:44:24 PM:15OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 4:45:51 PM:667OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - overture.com/ overture.com

10/13/2007 4:45:51 PM:667OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 4:46:41 PM:120OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 4:48:56 PM:220OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 4:49:51 PM:779OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 4:51:29 PM:743OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/13/2007 4:55:05 PM:304OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - atdmt.com/ atdmt.com

10/13/2007 4:55:05 PM:305OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/13/2007 4:59:48 PM:659Scan Started
Scan Type - Full Scan

10/13/2007 5:02:27 PM:436Scan Finished
Scan Type - Full Scan
Items Processed - 22341
Threats Detected - 0
Infections Detected - 0
Infections Ignored - 0

10/13/2007 5:02:34 PM:851Scan Started
Scan Type - Full Scan

10/13/2007 5:36:57 PM:30Infection was detected on this computer
Threat Name - AntiVirus Detected Files
Type - File
Risk Level - High
Infection - Packed/FSG detected in C:\Program Files\Navilog1\gnc.exe

10/13/2007 6:29:58 PM:787Infection was detected on this computer
Threat Name - Dialer.Instant_Access
Type - Registry Value
Risk Level - High
Infection -
HKEY_USERS\S-1-5-21-97304389-3229914424-173611390-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust
Providers\Software Publishing\Trust Database\0,
goicfboogidikkejccmclpieicihhlpo jimddp

10/13/2007 6:30:13 PM:765Scan Finished
Scan Type - Full Scan
Items Processed - 235883
Threats Detected - 2
Infections Detected - 2
Infections Ignored - 0

Une petite surprise (pour moi, peut etre pas pour toi... )
Dans le dossier nomme !KillBox, je trouve un sous-dossier Logs (qui contient les rapports) et un fichier....nomme wininit.exe , tout le meme que celui qui est ds systeme 32, meme taille, meme derniere date de modif...tout pareil, sauf la location.
C'est normal docteur?

Re,

Supprime Killbox, wininit sur vista n'est pas à supprimer en fait ..

Va dans démarrer\exécuter, tape regedit, ok.
Cherche et supprime cette clef (si présente) :
KEY_USERS\S-1-5-21-97304389-3229914424-173611390-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust
Providers\Software Publishing\Trust Database\0

Reposte un HiJackthis.

C'est fait!
La key et toutes ses sub-keys sont supprimees.

Voila le rapport hijackthis ainsi qu un rapport spyware doctor:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:48:15 AM, on 10/14/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\deleuze\Desktop\antispyware\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c(...)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c(...)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 12254 bytes


-------------------------------------


10/14/2007 8:20:30 AM:377AntiVirus Engine
Engine initialized or reloaded successfully.
10/14/2007 8:20:38 AM:490Service Started
Spyware Doctor Service Application started
10/14/2007 8:20:38 AM:734OnGuards status
All OnGuards were Enabled
10/14/2007 8:20:39 AM:71Immunizer Results
ActiveX section has been immunized. No items were processed.
10/14/2007 8:27:34 AM:715OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bs.serving-sys.com/ bs.serving-sys.com

10/14/2007 8:27:34 AM:742OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - serving-sys.com/ serving-sys.com

10/14/2007 8:27:34 AM:929OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 8:42:07 AM:189OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bs.serving-sys.com/ bs.serving-sys.com

10/14/2007 8:42:07 AM:189OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - serving-sys.com/ serving-sys.com

10/14/2007 8:57:24 AM:872OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - atdmt.com/ atdmt.com

10/14/2007 8:57:24 AM:873OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/14/2007 9:24:36 AM:64OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/14/2007 9:44:43 AM:951OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/14/2007 9:44:43 AM:952OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - xiti.com/ xiti.com

10/14/2007 9:48:44 AM:273OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - mediaplex.com/ mediaplex.com

10/14/2007 9:48:44 AM:274OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 9:50:58 AM:606OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - cybermonitor.com/ cybermonitor.com

10/14/2007 9:50:58 AM:607OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 9:52:45 AM:800OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 9:56:22 AM:410OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 9:58:26 AM:194OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 10:01:41 AM:472OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 10:03:33 AM:482OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/14/2007 10:03:33 AM:483OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 10:04:47 AM:644OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/14/2007 10:04:47 AM:645OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - overture.com/ overture.com

10/14/2007 10:04:47 AM:645OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - rotator.adjuggler.com/ rotator.adjuggler.com

10/14/2007 10:04:47 AM:646OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 10:06:34 AM:996OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/14/2007 10:06:34 AM:996OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 10:09:17 AM:982OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - atdmt.com/ atdmt.com

10/14/2007 10:09:17 AM:983OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/14/2007 10:09:17 AM:983OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/14/2007 10:10:43 AM:308OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - adtech.de/ adtech.de

10/14/2007 10:10:43 AM:309OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - atdmt.com/ atdmt.com

10/14/2007 10:10:43 AM:310OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - bluestreak.com/ bluestreak.com

10/14/2007 10:10:43 AM:312OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - doubleclick.net/ doubleclick.net

10/14/2007 10:10:43 AM:313OnGuard Detection Cleaned
Threat Name - Application.TrackingCookies
Type - Cookie
Risk Level - Low
Infection - xiti.com/ xiti.com

10/14/2007 10:11:24 AM:996OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 10:12:16 AM:343OnGuard Detection Cleaned
Threat Name - Adware.Advertising
Type - Cookie
Risk Level - Low
Infection - smartadserver.com/ smartadserver.com

10/14/2007 10:24:12 AM:301Scan Started
Scan Type - Full Scan

10/14/2007 10:30:50 AM:507Scan Finished
Scan Type - Full Scan
Items Processed - 23317
Threats Detected - 0
Infections Detected - 0
Infections Ignored - 0

10/14/2007 10:31:46 AM:888Scan Started
Scan Type - Intelli-Scan

10/14/2007 10:35:49 AM:70Scan Finished
Scan Type - Intelli-Scan
Items Processed - 118841
Threats Detected - 0
Infections Detected - 0
Infections Ignored - 0

Re,

Toujours des problèmes ?
Un dernier scan et c'est bon.

Fais une analyse antivirus en ligne sur Kaspersky avec Internet Explorer. (Tuto)
Autorise les active x.
Clique sur Démarrer Online Scanner.
Sélectionne le poste de travail comme analyse. Enregistres sous le rapport en format .txt.
Colle son rapport ici.

Bonjour,

Mon PC va beaucoup beaucoup mieux. Par contre il merde souvent sur internet explorer qui doit etre ferme.

Pour le scan: je crois que kapersky a un peu rame sur mon ordi...apres 2h30 de scan j ai tout arrete...kapersky restait bloque 20 min sur un fichier, repartait, m'a rescanne 2 fois les memes fichiers...il avait l'air perdu... j'avais bien coupe norton et spyware doctor.
J'ai ensuite vu sur le site de Kapersky qu'une version vista serait bientot disponible. Peut-etre serait-ce la, la cause du probleme? Dois-je recommencer? Un autre type de scan plus adapte a Vista?


Merci et a tres bientot!

Re,

Il est mieux de naviguer avec Mozilla Firefox ou encore Opéra.
Mais garde IE pour les mises à jour windows et les scans en ligne par exemple.
Sinon ça m'arrive aussi que mon navigateur plante pendant un certain temps.
Tu peux essayer avec norton si tu veux ( ton antivirus) sinon on peut s'en passer.
Bonne soirée

Hello!

Norton n'avait rien detecte, alors il vaut mieux que je scan en ligne regulierement mon PC...mais avec quoi?
Sinon, ca fait pas trop norton+AVG+spyware doctor? il faut que j'en enleve?
que fais-je des logiciels que tu m'as fait installer?

Merci beaucoup pour ton aide. (Desolee pour les reponses a retardement mais je ne suis pa a la meme heure que toi!)