01net    Web


Actuellement en ligne : 445 Utilisateurs dont 50 dans Sécurité, virus et assimilés >S'inscrire      >S'identifier      >Recherche      >Aide  
modéré par A.Ouloube, naheulbeuk, Mérillym, bibou0007, Malekal_morte, IL-MAFIOSO  
01net > Forum de 01net > Sécurité, virus et assimilés > Spam
> pubs ,pubs et encore des pubs de toute sortes !!! [RESOLU]
Passionné(e) d'internet, de logiciels, de forums ? 01net recrute...
Auteur
Message
 
<     1       >
pete parker
  oups !! grilled !!
  :-)
      ?   ^   @     Posté le 04/12/2006 04:28:23  
Voter pour ce message
bonjours vous l'aurait compris je suis envahi de pubs de toute sortes :/ ,donc voila probleme recurant. :fou: si quelqu'un a quelques minutes a me consacrer,je le remerci .. :jap:

EDIT: je viens de m'aperçevoir qu'il n'y a pas que des pubs je viens d'atterir sur un site avec des biographie de star feminine :whistle:
bizard !!
-->Message édité par pete parker le 05/12/2006 15:11:27<--
-------
http://www.inforumatique.fr
Spirit c'est ma meuf !  
yaya31
  
  :-)
      ?   @     Posté le 04/12/2006 05:59:05  
Voter pour ce message
Bonjour,
- Télécharge HiJackThis de Merijn sur ton bureau.
- Renomme le fichier HiJackThis.exe en Scanner.exe pour cela, fais un clic droit sur le fichier HiJackThis.exe et choisis renommer dans la liste
- Tape Scanner.exe et Appuye sur la touche Entrée.
- Génère un rapport en suivant ces indications :
- Double-clic sur Scanner.exe
- Exécute le et clique sur Do a scan and save log file.
- Le rapport s'ouvre sur leBloc-Note
- Colle le rapport ici, pour cela :
- Menu Edition / Selectionner Tout
- Menu Edition / copier
- Ici dans un nouveau message : clic droit / coller :)
Aide : N'hésite pas à consulter l'aide HiJackThis -
-------
Les regles pour les rapports
http://forum.telecharger.01net.com/telecharger/securite_virus_et_assimiles/ob(...)

Soyez patients...merci
pete parker
  oups !! grilled !!
  :-)
      ?   ^   @     Posté le 04/12/2006 14:35:01  
Voter pour ce message
salut! ravi de te conaitre ,si j'avais su que tu aurais repondu si vite je n'aurais pas etait me coucher :lol: bon presentation faite je crois qu'il faut passer aux chose serieuses!! :/


Logfile of HijackThis v1.99.1
Scan saved at - 14:31:48, on 04/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Documents and Settings\steph\Bureau\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [16 boob amen acid] C:\Documents and Settings\All Users.WINDOWS\Application Data\ace bird 16 boob\Web does.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Smod] C:\Program Files\Spy Shot\Capture.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Deafidol] C:\DOCUME~1\steph\APPLIC~1\CHINUP~1\funk proc.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Poker.fr - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\Poker.fr\client.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA4B3615-1C2B-47A0-9476-8D737A3C6E90}: NameServer = 212.27.53.252
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)


edit:j'ai deja passer avg-antispyware et supprimer ce qu'il trouver sans resultat !
-->Message édité par pete parker le 04/12/2006 14:38:25<--
-------
http://www.inforumatique.fr
Spirit c'est ma meuf !  
yaya31
  
  :-)
      ?   @     Posté le 04/12/2006 17:20:57  
Voter pour ce message
Bonjour,
Télécharge ce fichier - combofix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix, Il va te poser une question, réponds yes (touche y) puis attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Copie/colle un nouveau rapport HiJackThis avec. :)
-------
Les regles pour les rapports
http://forum.telecharger.01net.com/telecharger/securite_virus_et_assimiles/ob(...)

Soyez patients...merci
pete parker
  oups !! grilled !!
  :-)
      ?   ^   @     Posté le 04/12/2006 17:32:12  
Voter pour ce message
steph - 06-12-04 17:28:51,42 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\steph\Bureau"

((((((((((((((((((((((((((((((( Files Created from 2006-11-04 to 2006-12-04 ))))))))))))))))))))))))))))))))))


2006-12-04 15:24 <REP> dr-h----- C:\Documents and Settings\steph\Recent
2006-12-04 03:09 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-04 01:11 <REP> d-------- C:\Documents and Settings\steph\Application Data\Chin up list
2006-12-04 01:11 <REP> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\ace bird 16 boob
2006-11-30 14:39 <REP> d-------- C:\Program Files\DVD Decrypter
2006-11-29 18:32 <REP> d-------- C:\Program Files\Axon Data
2006-11-27 19:19 <REP> d-------- C:\Program Files\QuickPar
2006-11-27 16:15 <REP> d-------- C:\Program Files\Poker.fr
2006-11-26 07:47 1,624 --a------ C:\WINDOWS\system32\tmp.reg
2006-11-26 07:45 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-11-26 07:45 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-11-26 07:45 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-11-26 07:45 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-11-26 06:08 <REP> d-------- C:\WINDOWS\system32\ActiveScan
2006-11-22 18:06 <REP> d-------- C:\Program Files\Office XP 2003 Pro
2006-11-22 18:04 <REP> d-------- C:\Program Files\Nero
2006-11-19 23:25 119,568 --a------ C:\WINDOWS\system32\vb6fr.DLL
2006-11-18 20:28 <REP> d-------- C:\Program Files\VideoLAN
2006-11-18 20:28 <REP> d-------- C:\Documents and Settings\steph\Application Data\vlc
2006-11-12 21:30 <REP> d-------- C:\Documents and Settings\steph\Application Data\PEDROZAG
2006-11-06 04:15 <REP> dr------- C:\Documents and Settings\steph\Application Data\Brother
2006-11-04 01:59 <REP> d-------- C:\Program Files\GrabIt


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-04 03:22 -------- d-------- C:\Documents and Settings\steph\Application Data\Lavasoft
2006-11-28 20:10 -------- d-------- C:\Program Files\Fichiers communs
2006-11-28 17:13 -------- d-------- C:\Program Files\Grisoft
2006-11-27 15:38 -------- d-------- C:\Program Files\WinRAR
2006-11-27 15:37 -------- d-------- C:\Program Files\Unlocker
2006-11-27 15:37 -------- d-------- C:\Program Files\Spy Shot
2006-11-27 15:35 -------- d-------- C:\Program Files\MSN Messenger
2006-11-27 15:33 -------- d-------- C:\Program Files\MessengerPlus! 3
2006-11-27 15:32 -------- d-------- C:\Program Files\Internet Explorer
2006-11-27 15:31 -------- d-------- C:\Program Files\Google
2006-11-27 15:30 -------- d-------- C:\Program Files\7-Zip
2006-11-22 18:06 -------- d-------- C:\Program Files\Adobe
2006-11-22 18:03 -------- d-------- C:\Program Files\DVD Shrink
2006-11-22 18:02 -------- d-------- C:\Program Files\Winamp
2006-11-22 18:02 -------- d-------- C:\Program Files\MSN
2006-11-22 18:01 -------- d-------- C:\Program Files\Easy CD-DA Extractor 4.5.2
2006-11-09 08:46 -------- d---s---- C:\Documents and Settings\steph\Application Data\Microsoft
2006-11-06 03:32 -------- d-------- C:\Program Files\Sunbelt Software
2006-11-01 05:39 -------- d-------- C:\Program Files\Lavalys
2006-10-30 14:42 -------- d-------- C:\Program Files\CCleaner
2006-10-15 04:45 -------- d-------- C:\Program Files\Fichiers communs\Microsoft Shared
2006-10-14 00:26 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-11 17:45 -------- d-------- C:\Program Files\FreeGo
2006-10-11 17:04 -------- d-------- C:\Program Files\WinPcap
2006-10-07 13:38 -------- d-------- C:\Documents and Settings\steph\Application Data\AdobeUM
2006-10-07 13:38 -------- d-------- C:\Documents and Settings\steph\Application Data\Adobe
2006-09-28 15:10 58952 --a------ C:\WINDOWS\system32\MsgPlusLoader.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Smod"="C:\\Program Files\\Spy Shot\\Capture.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"Deafidol"="C:\\DOCUME~1\\steph\\APPLIC~1\\CHINUP~1\\funk proc.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SSBkgdUpdate"="\"C:\\Program Files\\Fichiers communs\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot"
"AVG7_CC"="\"C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe\" /STARTUP"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"16 boob amen acid"="C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\ace bird 16 boob\\Web does.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,00,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=hex:ff,00,00,00
"NoChangeStartMenu"=dword:00000000
"NoClose"=dword:00000000
"NoLogOff"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^InterVideo WinCinema Manager.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Menu Démarrer\\Programmes\\Démarrage\\InterVideo WinCinema Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\InterVideo WinCinema Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\INTERV~1\\Common\\Bin\\WINCIN~1.EXE "
"item"="InterVideo WinCinema Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Menu Démarrer\\Programmes\\Démarrage\\Lancement rapide d'Adobe Reader.lnk"
"backup"="C:\\WINDOWS\\pss\\Lancement rapide d'Adobe Reader.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Lancement rapide d'Adobe Reader"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="brctrcen"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe\" /autorun"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IndexSearch"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsgPlus"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvMcTray"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="\"nwiz"
"hkey"="HKLM"
"command"="\"nwiz.exe\" /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="pptd40nt"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\POINTER]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="point32"
"hkey"="HKLM"
"command"="point32.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRONoMgrWired]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PRONoMgr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Intel\\PROSetWired\\NCS\\PROSet\\PRONoMgr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BrStDvPt"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Brother\\Brmfl05a\\BrStDvPt.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smart Start UP]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PnPDetect"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\NewSoft\\Smart Start UP\\PnPDetect.exe\" /Automation "
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SOUNDMAN"
"hkey"="HKLM"
"command"="SOUNDMAN.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW20]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sw20"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\sw20.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW24]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sw24"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\sw24.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SweetIM"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Macrogaming\\SweetIM\\SweetIM.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleToolbarNotifier"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\type32]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="type32"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"inimapping"="0"

Terminer le programme de commandes (O/N)ÿ?

Logfile of HijackThis v1.99.1
Scan saved at 17:31, on 06-12-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\steph\Bureau\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [16 boob amen acid] C:\Documents and Settings\All Users.WINDOWS\Application Data\ace bird 16 boob\Web does.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Smod] C:\Program Files\Spy Shot\Capture.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Deafidol] C:\DOCUME~1\steph\APPLIC~1\CHINUP~1\funk proc.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Poker.fr - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\Poker.fr\client.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA4B3615-1C2B-47A0-9476-8D737A3C6E90}: NameServer = 212.27.53.252
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

-------
http://www.inforumatique.fr
Spirit c'est ma meuf !  
yaya31
  
  :-)
      ?   @     Posté le 04/12/2006 17:39:04  
Voter pour ce message
-- Télécharge SmitfraudFix de S!Ri, balltrap34 et moe31
(Si tu as Norton Antivirus ou NOD32, désactive le)
-- Fais un clic droit puis Extraire tout sur le fichier SmitfraudFix.zip, cela va tout décompresser dans un nouveau dossier SmitFraudfix
-- Ouvre le dossier SmitfraudFix double clic sur SmitfraudFix.cmd (le .cmd peut ne pas être présent)
-- Choisis l'option 1 et appuie sur Entrée
-- Réponds o (Oui) aux deux questions suivantes si elles sont posées
-- Un rapport sera généré sauvegarde le dans un dossier
-- Copie/colle le contenu du rapport ici :)
-------
Les regles pour les rapports
http://forum.telecharger.01net.com/telecharger/securite_virus_et_assimiles/ob(...)

Soyez patients...merci
pete parker
  oups !! grilled !!
  :-)
      ?   ^   @     Posté le 04/12/2006 17:52:45  
Voter pour ce message
SmitFraudFix v2.127

Rapport fait à 17:52:16.23, 06-12-04
Executé à partir de C:\Documents and Settings\steph\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\steph


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\steph\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\steph\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="MsgPlusLoader.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

-------
http://www.inforumatique.fr
Spirit c'est ma meuf !  
pete parker
  oups !! grilled !!
  :-)
      ?   ^   @     Posté le 04/12/2006 17:53:39  
Voter pour ce message
Logfile of HijackThis v1.99.1
Scan saved at 17:53, on 06-12-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\steph\Bureau\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [16 boob amen acid] C:\Documents and Settings\All Users.WINDOWS\Application Data\ace bird 16 boob\Web does.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Smod] C:\Program Files\Spy Shot\Capture.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Deafidol] C:\DOCUME~1\steph\APPLIC~1\CHINUP~1\funk proc.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Poker.fr - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\Poker.fr\client.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA4B3615-1C2B-47A0-9476-8D737A3C6E90}: NameServer = 212.27.53.252
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

-------
http://www.inforumatique.fr
Spirit c'est ma meuf !  
yaya31
  
  :-)
      ?   @     Posté le 04/12/2006 18:12:35  
Voter pour ce message
- Télécharge SpywareTerminator
- Lors du step 2 du Crawler Spyware Terminator Setup Assistant, réponds non lorsqu'il te demande si tu veux activer la protection en temps réel
- Ne scanne pas mais démarre Spyware Terminator puis clic sur le menu update à gauche pour effectuer la mise à jour.
- Télécharge clean.zip, décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.


- Redémarre en mode sans échec, si tu sais pas comment on fait lis ceci
- Relance Hijackthis et coches ces lignes en gras :
O4 - HKLM\..\Run: [16 boob amen acid] C:\Documents and Settings\All Users.WINDOWS\Application Data\ace bird 16 boob\Web does.exe
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKCU\..\Run: [Deafidol] C:\DOCUME~1\steph\APPLIC~1\CHINUP~1\funk proc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

-- Ensuite, navigue dans tes dossiers pour supprimer les dossiers, si existants :

C:\Program Files\Macrogaming\

-- Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laisse la ouverte.

-- Démarre Spyware Terminator puis clic sur le bouton scan à gauche.
-- Dans "Scan Type Settings" clic sur Full Spyware Scan
-- Clic en bas sur "Start Scan Now" pour démarrer le scan, ceci peut prendre plusieurs minutes.
-- Clic sur remove en bas pour supprimer tous les spywares.
-- Clic sur l'onglet scan report puis en bas à gauche sur "Copy Clipboard"
-- Ouvre le bloc-note (Démarrer / Programmes / Accessoires / Bloc-note)
-- Dans le Bloc-note, clic sur le menu Edition puis coller
-- Enregistre le rapport du scan sur ton bureau sous le nom rapport.txt

-- Ouvre le dossier SmitfraudFix double clic sur SmitfraudFix.cmd (ne
clique sur aucun autre fichier!!!)
-- Choisis l'option 2 et appuie sur Entrée
-- Réponds o (Oui) aux deux questions suivantes si elles sont posées
-- Un rapport sera généré sauvegarde le dans un dossier,

-- Redémarre en mode normal : Menu Démarrer / Arreter / Redémarre l'ordinateur
Attention : dans le cas où l'ordinateur redémarre en boucle en mode sans échec, faire la manipulation inverse en décochant l'option /SAFEBOOT à l'aide de msconfig : voir à nouveau cette page : cliquez-ici

-- Copie colle moi dans ton prochain message les raports SmitfraudFix, Spyware Terminator, Clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt , :)
-------
Les regles pour les rapports
http://forum.telecharger.01net.com/telecharger/securite_virus_et_assimiles/ob(...)

Soyez patients...merci
pete parker
  oups !! grilled !!
  :-)
      ?   ^   @     Posté le 04/12/2006 18:56:38  
Voter pour ce message

Scan Progress (Full Scan)
Start time: 06-12-04 18:30:40
Database: 1.0.517.261

Processes Scanning
comctl32 : C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2180_X-WW_A84F1FF9\COMCTL32.DLL
PowerProfile : C:\WINDOWS\SYSTEM32\POWRPROF.DLL
Shdocvw : C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
Startup Scanning
Smod : C:\PROGRAM FILES\SPY SHOT\CAPTURE.EXE
MessengerService : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run msnmsgr
MessengerService : C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
Deafidol : C:\Documents and Settings\steph\Application Data\Chin up list\FUNK PROC.EXE
SSBkgdUpdate : C:\PROGRAM FILES\FICHIERS COMMUNS\SCANSOFT SHARED\SSBKGDUPDATE\SSBKGDUPDATE.EXE
AVG7_Control Center : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AVG7_CC
AVG7_Control Center : C:\Program Files\Grisoft\AVG Free\avgcc.exe
NvCplDaemon : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NvCplDaemon
NvCplDaemon : C:\WINDOWS\SYSTEM32\NVCPL.DLL
16 boob amen acid : C:\DOCUMENTS AND SETTINGS\ALL USERS.WINDOWS\APPLICATION DATA\ACE BIRD 16 BOOB\WEB DOES.EXE
Spyware Terminator : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SpywareTerminator
Spyware Terminator : C:\PROGRAM FILES\SPYWARE TERMINATOR\SPYWARETERMINATORSHIELD.EXE
MSConfig : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MSConfig
MSConfig : C:\WINDOWS\PCHEALTH\HELPCTR\BINARIES\MSCONFIG.EXE
AppInit_DLLs : C:\WINDOWS\system32\MSGPLUSLOADER.DLL
Explorer : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Explorer : C:\WINDOWS\EXPLORER.EXE
Toolbars Scanning
SweetIM For Internet Explorer : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
Google Toolbar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ {2318C2B1-4965-11d4-9B18-009027A5CD4F}
Google Toolbar : C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR3.DLL
Shdocvw : HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
Shdocvw : C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
Shdocvw : explorer.exe PID: 752
Shdocvw : SpywareTerminator.exe PID: 1068
Shdocvw : HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}
Shdocvw : HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Shdocvw : HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
Shdocvw : HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Browser Helper Objects Scanning
AcroIEHelper : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHelper : C:\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACTIVEX\ACROIEHELPER.DLL
SWEETIE : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}
SSJava : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
SSJava : C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
Google Toolbar : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
IE Explorer Bars
IE Extensions
Services Scanning
AVG7_AMSVR : HKLM\SYSTEM\CurrentControlSet\Services\Avg7Alrt
AVG7_EMC : HKLM\SYSTEM\CurrentControlSet\Services\AVGEMS
Protocol filters Scanning
Protocol handlers Scanning
WinSock2 Scanning
Uninstallers Scanning
C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\SETUP.EXE
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\UNINSTALL.EXE
C:\PROGRAM FILES\AXON DATA\AXCRYPT\AXCRYPTU.EXE
C:\PROGRAM FILES\CCLEANER\UNINST.EXE
C:\PROGRAM FILES\DVD DECRYPTER\UNINSTALL.EXE
C:\PROGRAM FILES\DVD SHRINK\UNINS000.EXE
C:\WINDOWS\IUN506.EXE
C:\PROGRAM FILES\LAVALYS\EVEREST HOME EDITION\UNINS000.EXE
C:\PROGRAM FILES\FREEDIAL\FREEDIAL.EXE
C:\PROGRAM FILES\FREEGO\UNINS000.EXE
C:\PROGRAM FILES\FREEPLAYER\UNINSTALL.EXE
C:\PROGRAM FILES\GRABIT\UNINS000.EXE
C:\Documents and Settings\steph\Bureau\HijackThis.exe \uninstall
C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriver.exe
C:\WINDOWS\ISUNINST.EXE
C:\PROGRAM FILES\INTERACTUAL\INTERACTUAL PLAYER\INUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB873339$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB885250$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB885835$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB885836$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB886185$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB887472$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB887742$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB888113$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB888302$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB890046$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB890859$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB891781$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB893756$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$MSI31UNINSTALL_KB893803V2$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB894391$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB896358$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB896422$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB896423$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB896424$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB896428$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB898461$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB899587$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB899589$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB899591$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB900485$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB900725$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB901017$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB901214$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB902400$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB904706$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB905414$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB905749$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB905915$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB908519$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB908531$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB910437$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB911280$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB911562$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB911564$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB911565$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB911567$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB911927$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB912812$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB912919$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB913446$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB913580$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB914388$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB914389$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB916281$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB916595$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB917159$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB917344$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB917734_WMP10$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB917734_WMP9$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB917953$\SPUNINST\SPUNINST.EXE
C:\WINDOWS\$NTUNINSTALLKB918439$\SPUNINST\SPUNINST.EXE
C:\PROGRAM FILES\LIMEWIRE\UNINSTALL.EXE
C:\PROGRAM FILES\MESSENGERPLUS! 3\MSGPLUS.EXE
MessengerPlus : C:\PROGRAM FILES\MESSENGERPLUS! 3\MSGPLUS.EXE
MessengerPlus : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MsgPlus! Plugin
C:\PROGRAM FILES\AHEAD\NERO\UNINSTALL\UNNERO.EXE
C:\WINDOWS\SYSTEM32\NVUDISP.EXE
C:\WINDOWS\SYSTEM32\ASUNINST.EXE
C:\WINDOWS\system32\SETUPAPI.DLL
C:\Program Files\Poker.fr\UNWISE.EXE
C:\WINDOWS\system32\PROUNSTL.EXE
C:\PROGRAM FILES\QUICKPAR\UNINST.EXE
C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASHUTIL9B.EXE
C:\PROGRAM FILES\SPY SHOT\UNINSTAL.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\UNINS000.EXE
C:\PROGRAM FILES\SPYWARE TERMINATOR\UNINS000.EXE
C:\PROGRAM FILES\UNLOCKER\UNINST.EXE
C:\PROGRAM FILES\VIDEOLAN\VLC\UNINSTALL.EXE
C:\PROGRAM FILES\WINAMP\UNINSTWA.EXE
C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMSETSDK.EXE
C:\WINDOWS\$NTSERVICEPACKUNINSTALL$\SPUNINST\SPUNINST.EXE
C:\PROGRAM FILES\WINPCAP\UNINSTALL.EXE
C:\PROGRAM FILES\WINRAR\UNINSTALL.EXE
C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR3.DLL
Google Toolbar : C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR3.DLL
Google Toolbar : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}
C:\Program Files\Fichiers communs\InstallShield\engine\6\Intel 32\ctor.dll
C:\WINDOWS\system32\MSIEXEC.EXE
C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
C:\PROGRAM FILES\DIVX\DIVXCODECUNINSTALL.EXE
C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
Start Menu Scanning
Explorer : C:\Documents and Settings\steph\Menu Démarrer\Programmes\Accessoires\Explorateur Windows.lnk
SynchronizationManager : C:\Documents and Settings\steph\Menu Démarrer\Programmes\Accessoires\Synchroniser.lnk
Ccleaner : C:\Documents and Settings\steph\Menu Démarrer\Programmes\CCleaner\CCleaner.lnk
Explorer : C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Accessoires\Communications\Connexions réseau.lnk
Explorer : C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Accessoires\Outils système\Tâches planifiées.lnk
AVG7_Control Center : C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\AVG Free Edition\AVG Free Control Center.lnk
iTunes : C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\iTunes\iTunes.lnk
Spyware Terminator : C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Spyware Terminator\Spyware Terminator.lnk
Desktop Scanning
Ccleaner : C:\Documents and Settings\steph\Bureau\CCleaner.lnk
PrcRew : C:\Documents and Settings\steph\Bureau\SmitfraudFix\Process.exe
Favorites Scanning
Cookies Scanning
Affiliate tracking cookie : C:\Documents and Settings\steph\cookies\steph@2o7[1].txt
Affiliate tracking cookie : C:\Documents and Settings\steph\cookies\steph@ads.pointroll[2].txt
Affiliate tracking cookie : C:\Documents and Settings\steph\cookies\steph@questionmarket[1].txt
Affiliate tracking cookie : C:\Documents and Settings\steph\cookies\steph@roiservice[1].txt
Affiliate tracking cookie : C:\Documents and Settings\steph\cookies\steph@serving-sys[1].txt
Affiliate tracking cookie : C:\Documents and Settings\steph\cookies\steph@zedo[1].txt
Registry Scanning
Google Toolbar : HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}
Google Toolbar : C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR3.DLL
Google Toolbar : HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}
AcroIEHelper : HKCR\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHelper : C:\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACTIVEX\ACROIEHELPER.DLL
MSDXM : HKCR\CLSID\{8E718888-423F-11D2-876E-00A0C9082467}
MSDXM : C:\WINDOWS\SYSTEM32\MSDXM.OCX
SSJava : HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
SSJava : C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
SweetIM For Internet Explorer : HKCR\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
SWEETIE : HKCR\CLSID\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}
Files Scanning
Spyware Terminator : C:\Program Files\Spyware Terminator\Spywareterminatorshield.exe
Spyware Terminator : C:\Program Files\Spyware Terminator\Spywareterminator.exe
Spyware Terminator : C:\Program Files\Spyware Terminator\sptcontmenu.dll
AVG7_Control Center : C:\Program Files\Grisoft\AVG Free\avgcc.exe
SoundMan : C:\WINDOWS\soundman.exe
MessengerService : C:\Program Files\MSN Messenger\msnmsgr.exe
NvMixerTray : C:\WINDOWS\system32\NvMcTray.dll
Ctfmon : C:\WINDOWS\system32\ctfmon.exe
AVG7_EMC : C:\Program Files\Grisoft\AVG Free\avgemc.exe
SunJavaUpdateSched : C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
SunJavaUpdateSched : C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
QuickTimeTask : C:\Program Files\QuickTime\qttask.exe
NeroFilterCheck : C:\WINDOWS\system32\NeroCheck.exe
iTunes : C:\Program Files\iTunes\iTunesHelper.exe
iTunes : C:\Program Files\iTunes\iTunes.exe
Nwiz : C:\WINDOWS\system32\nwiz.exe
MSConfig : C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
Type32 : C:\Program Files\Microsoft IntelliType Pro\type32.exe
UpdateMgr : C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
SynchronizationManager : C:\WINDOWS\system32\mobsync.exe
NBJ : C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
MSDXM : C:\WINDOWS\system32\msdxm.ocx
StillImageMonitor : C:\WINDOWS\system32\STIMON.EXE
NvCplDaemon : C:\WINDOWS\system32\NvCpl.dll
GrpConv : C:\WINDOWS\system32\grpconv.exe
Wextract : C:\WINDOWS\system32\advpack.dll
MessengerPlus : C:\Program Files\MessengerPlus! 3\MsgPlus.exe
KernelFaultCheck : C:\WINDOWS\system32\dumprep.exe
Explorer : C:\WINDOWS\explorer.exe
PowerProfile : C:\WINDOWS\system32\powrprof.dll
BluetoothControlPanel : C:\WINDOWS\system32\bthprops.cpl
SSJava : C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
Shdocvw : C:\WINDOWS\system32\shdocvw.dll
PHIME2002ASync : C:\WINDOWS\system32\dllcache\tintsetp.exe
Ccleaner : C:\Program Files\CCleaner\ccleaner.exe
MSPY2002 : C:\WINDOWS\system32\dllcache\imscinst.exe
AVG7_AMSVR : C:\Program Files\Grisoft\AVG Free\avgamsvr.exe
NVIEW : C:\WINDOWS\system32\nview.dll
PaperPort PTD : C:\Program Files\ScanSoft\PAPERPORT\pptd40nt.exe
Verclsid : C:\WINDOWS\system32\verclsid.exe
Systray : C:\WINDOWS\system32\systray.exe
IndexSearch : C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
comctl32 : C:\WINDOWS\WinSxS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2180_X-WW_A84F1FF9\comctl32.dll
Preparing DeepFile Scan
DeepFiles Scanning
PrcRew : C:\Documents and Settings\steph\Bureau\SmitfraudFix\Process.exe
AcroIEHelper : C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
UpdateMgr : C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
NBJ : C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
Ccleaner : C:\Program Files\CCleaner\ccleaner.exe
Google Toolbar : C:\Program Files\Google\GoogleToolbar3.dll
AVG7_AMSVR : C:\Program Files\Grisoft\AVG Free\avgamsvr.exe
AVG7_Control Center : C:\Program Files\Grisoft\AVG Free\avgcc.exe
AVG7_EMC : C:\Program Files\Grisoft\AVG Free\avgemc.exe
iTunes : C:\Program Files\iTunes\iTunes.exe
iTunes : C:\Program Files\iTunes\iTunesHelper.exe
SunJavaUpdateSched : C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
SunJavaUpdateSched : C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
SSJava : C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
MessengerPlus : C:\Program Files\MessengerPlus! 3\MsgPlus.exe
Type32 : C:\Program Files\Microsoft IntelliType Pro\type32.exe
MessengerService : C:\Program Files\MSN Messenger\msnmsgr.exe
QuickTimeTask : C:\Program Files\QuickTime\qttask.exe
IndexSearch : C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
PaperPort PTD : C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
Spyware Terminator : C:\Program Files\Spyware Terminator\sptcontmenu.dll
Spyware Terminator : C:\Program Files\Spyware Terminator\SpywareTerminator.exe
Spyware Terminator : C:\Program Files\Spyware Terminator\Spywareterminatorshield.Exe
Explorer : C:\WINDOWS\explorer.exe
SoundMan : C:\WINDOWS\SOUNDMAN.EXE
MSConfig : C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe
Wextract : C:\WINDOWS\system32\advpack.dll
BluetoothControlPanel : C:\WINDOWS\system32\bthprops.cpl
Ctfmon : C:\WINDOWS\system32\ctfmon.exe
MSPY2002 : C:\WINDOWS\system32\dllcache\imscinst.exe
PHIME2002ASync : C:\WINDOWS\system32\dllcache\tintsetp.exe
KernelFaultCheck : C:\WINDOWS\system32\dumprep.exe
GrpConv : C:\WINDOWS\system32\grpconv.exe
SynchronizationManager : C:\WINDOWS\system32\mobsync.exe
MSDXM : C:\WINDOWS\system32\msdxm.ocx
NeroFilterCheck : C:\WINDOWS\system32\NeroCheck.exe
NvCplDaemon : C:\WINDOWS\system32\nvcpl.dll
NVIEW : C:\WINDOWS\system32\nview.dll
NvMixerTray : C:\WINDOWS\system32\nvmctray.dll
Nwiz : C:\WINDOWS\system32\nwiz.exe
PowerProfile : C:\WINDOWS\system32\powrprof.dll
PrcRew : C:\WINDOWS\system32\Process.exe
Shdocvw : C:\WINDOWS\system32\shdocvw.dll
StillImageMonitor : C:\WINDOWS\system32\stimon.exe
Verclsid : C:\WINDOWS\system32\verclsid.exe
comctl32 : C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
Done

Scan Summary:

Total Scanning Time : 849.05 s
Objects Scanned : 55,003
Objects Identified : 92
Objects Ignored : 0

Critical Objects : 0

Remove Process:

Preparing structures
Hard File Remover Disabled
Remove Affiliate tracking cookie
Deleted File: C:\Documents and Settings\steph\cookies\steph@2o7[1].txt
Deleted File: C:\Documents and Settings\steph\cookies\steph@ads.pointroll[2].txt
Deleted File: C:\Documents and Settings\steph\cookies\steph@questionmarket[1].txt
Deleted File: C:\Documents and Settings\steph\cookies\steph@roiservice[1].txt
Deleted File: C:\Documents and Settings\steph\cookies\steph@serving-sys[1].txt
Deleted File: C:\Documents and Settings\steph\cookies\steph@zedo[1].txt

Script clean par Malekal_morte - http://www.malekal.com

Microsoft Windows XP [version 5.1.2600]
Script execute en mode sans echec

*** Suppression de fichiers sur C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\swxcacls.exe FOUND

"C:\Program Files\POKER.FR\" FOUND

*** Suppression des clefs du registre effectuee..


Logfile of HijackThis v1.99.1
Scan saved at 18:25, on 06-12-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\steph\Bureau\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [16 boob amen acid] C:\Documents and Settings\All Users.WINDOWS\Application Data\ace bird 16 boob\Web does.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Smod] C:\Program Files\Spy Shot\Capture.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Deafidol] C:\DOCUME~1\steph\APPLIC~1\CHINUP~1\funk proc.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Poker.fr - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\Poker.fr\client.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA4B3615-1C2B-47A0-9476-8D737A3C6E90}: NameServer = 212.27.53.252
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

SmitFraudFix v2.127

Rapport fait à 18:48:12.64, 06-12-04
Executé à partir de C:\Documents and Settings\steph\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin



-------
http://www.inforumatique.fr
Spirit c'est ma meuf !  
yaya31
  
  :-)
      ?   @     Posté le 04/12/2006 19:26:28  
Voter pour ce message
J'ai oublié de te dire apres avoir selectionné les lignes sur hijackthis de cliquer sur Fix Checked. Les lignes n'ont pas fixées.
Ferme toutes tes applications en cours, et relance Hijackthis, coche ces lignes :
O4 - HKLM\..\Run: [16 boob amen acid] C:\Documents and Settings\All Users.WINDOWS\Application Data\ace bird 16 boob\Web does.exe
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKCU\..\Run: [Deafidol] C:\DOCUME~1\steph\APPLIC~1\CHINUP~1\funk proc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Clique ensuite sur Fix Checked

As tu supprimé Macrogaming dans tes program files(si présent)?

Sur HiJackThis -> Open the misc tools sections -> open Uninstall manager -> clique sur "Save list" -> enregistre le fichier -> fais-en un copier/coller ici.
-------
Les regles pour les rapports
http://forum.telecharger.01net.com/telecharger/securite_virus_et_assimiles/ob(...)

Soyez patients...merci
pete parker
  oups !! grilled !!
  :-)
      ?   ^   @     Posté le 04/12/2006 19:38:56  
Voter pour ce message<