Bonjour,
J'ai attraper un/des virus ou/et spy...
J'ai fait un Skybot, Ad-aware mais y'en a toujours...
J'ai donc fait un Hijackthis... Mais je sais pas quoi "FIX IT"...
Pouvez vous m'aider ??? C'est assez urgent pcq ca me paralyse mon pc et j'ai plein de dossier a la bourre a cause de ca :s
Voici le Hijackthis :
Logfile of HijackThis v1.99.0
Scan saved at 21:48:56, on 02/02/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\D3OC.EXE
C:\WINDOWS\ADDYV.EXE
C:\WINDOWS\SYSTEM\WINDO32.EXE
C:\WINDOWS\SYSTEM\MFCYG.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\NTCK32.EXE
C:\WINDOWS\D3GM32.EXE
C:\WINDOWS\SYSTEM\NETLV32.EXE
C:\WINDOWS\MSSA.EXE
C:\WINDOWS\SDKTN32.EXE
C:\WINDOWS\SYSTEM\MSOJ32.EXE
C:\WINDOWS\ATLRL.EXE
C:\WINDOWS\SDKNU.EXE
C:\WINDOWS\SYSTEM\IEPV.EXE
C:\WINDOWS\IEVR32.EXE
C:\WINDOWS\SYSTEM\SDKFG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\NETCO32.EXE
C:\WINDOWS\APIBL32.EXE
C:\WINDOWS\CRQM.EXE
C:\WINDOWS\SYSTEM\SDKBA.EXE
C:\WINDOWS\SYSTEM\MFCYS.EXE
C:\WINDOWS\SYSTEM\ADDHV.EXE
C:\WINDOWS\D3UX.EXE
C:\WINDOWS\SYSTEM\APPEI.EXE
C:\WINDOWS\NTKZ.EXE
C:\WINDOWS\SYSTEM\CRWI32.EXE
C:\WINDOWS\IEWZ.EXE
C:\WINDOWS\SYSTEM\ATLNW.EXE
C:\WINDOWS\SYSTEM\NETCZ.EXE
C:\WINDOWS\NETKN.EXE
C:\WINDOWS\SYSTEM\IEEJ.EXE
C:\WINDOWS\JAVAUQ32.EXE
C:\WINDOWS\SYSTEM\ATLCO.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\WINDR32.EXE
C:\WINDOWS\SYSTEM\MFCHV.EXE
C:\WINDOWS\SYSTEM\SOFT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\CSAFE\AUTOCHK.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\DDDD.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\TEMP\1350.TMP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\SRXMJMR.EXE
C:\WINDOWS\ISRVS\DESKTOP.EXE
C:\PROGRAM FILES\WEB_REBATES\WEBREBATES0.EXE
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NSCHED32.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\PROFILES\YVES\BUREAU\SPY\HIJACKTHIS.EXE
C:\PROGRAM FILES\WEB_REBATES\WEBREBATES1.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
F1 - win.ini: run=C:\WINDOWS\SYSTEM\soft.exe
O2 - BHO: Class - {DF71F1AE-041F-04D3-EB7C-618CA46ED8DF} - C:\WINDOWS\SYSTEM\MSTT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\YSB.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [ConfigSafe] C:\CSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [LVComs] c:\windows\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [1350.TMP] C:\WINDOWS\TEMP\1350.TMP.exe 1 10001
O4 - HKLM\..\Run: [Web Service] C:\WINDOWS\SYSTEM\MSXMIDI.EXE
O4 - HKLM\..\Run: [1350.TMP.EXE] C:\WINDOWS\TEMP\1350.TMP.EXE 2 10001
O4 - HKLM\..\Run: [Q6P8vBN63] C:\SRXMJMR.EXE
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [cMkBi] C:\NGXSM.EXE
O4 - HKLM\..\Run: [BDvdyQby] C:\SRXMJMR.EXE
O4 - HKLM\..\Run: [¢‰¸ï04Ã4}¤Áœ5]C:\Program Files\ISTsvc\istsvc.exe] C:\SRXMJMR.EXE
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [WebRebates0] C:\Program Files\Web_Rebates\WebRebates0.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [D3OC.EXE] C:\WINDOWS\SYSTEM\D3OC.EXE
O4 - HKLM\..\RunServices: [ADDYV.EXE] C:\WINDOWS\ADDYV.EXE
O4 - HKLM\..\RunServices: [WINDO32.EXE] C:\WINDOWS\SYSTEM\WINDO32.EXE
O4 - HKLM\..\RunServices: [MFCYG.EXE] C:\WINDOWS\SYSTEM\MFCYG.EXE
O4 - HKLM\..\RunServices: [NTCK32.EXE] C:\WINDOWS\SYSTEM\NTCK32.EXE
O4 - HKLM\..\RunServices: [D3GM32.EXE] C:\WINDOWS\D3GM32.EXE
O4 - HKLM\..\RunServices: [NETLV32.EXE] C:\WINDOWS\SYSTEM\NETLV32.EXE
O4 - HKLM\..\RunServices: [MSSA.EXE] C:\WINDOWS\MSSA.EXE
O4 - HKLM\..\RunServices: [SDKTN32.EXE] C:\WINDOWS\SDKTN32.EXE
O4 - HKLM\..\RunServices: [IEPV.EXE] C:\WINDOWS\SYSTEM\IEPV.EXE
O4 - HKLM\..\RunServices: [ATLRL.EXE] C:\WINDOWS\ATLRL.EXE
O4 - HKLM\..\RunServices: [MSOJ32.EXE] C:\WINDOWS\SYSTEM\MSOJ32.EXE
O4 - HKLM\..\RunServices: [SDKNU.EXE] C:\WINDOWS\SDKNU.EXE
O4 - HKLM\..\RunServices: [SDKFG32.EXE] C:\WINDOWS\SYSTEM\SDKFG32.EXE
O4 - HKLM\..\RunServices: [IEVR32.EXE] C:\WINDOWS\IEVR32.EXE
O4 - HKLM\..\RunServices: [NETCO32.EXE] C:\WINDOWS\SYSTEM\NETCO32.EXE
O4 - HKLM\..\RunServices: [APIBL32.EXE] C:\WINDOWS\APIBL32.EXE
O4 - HKLM\..\RunServices: [CRQM.EXE] C:\WINDOWS\CRQM.EXE
O4 - HKLM\..\RunServices: [MFCYS.EXE] C:\WINDOWS\SYSTEM\MFCYS.EXE
O4 - HKLM\..\RunServices: [SDKBA.EXE] C:\WINDOWS\SYSTEM\SDKBA.EXE
O4 - HKLM\..\RunServices: [ADDHV.EXE] C:\WINDOWS\SYSTEM\ADDHV.EXE
O4 - HKLM\..\RunServices: [D3UX.EXE] C:\WINDOWS\D3UX.EXE
O4 - HKLM\..\RunServices: [APPEI.EXE] C:\WINDOWS\SYSTEM\APPEI.EXE
O4 - HKLM\..\RunServices: [NTKZ.EXE] C:\WINDOWS\NTKZ.EXE
O4 - HKLM\..\RunServices: [ATLNW.EXE] C:\WINDOWS\SYSTEM\ATLNW.EXE
O4 - HKLM\..\RunServices: [CRWI32.EXE] C:\WINDOWS\SYSTEM\CRWI32.EXE
O4 - HKLM\..\RunServices: [IEWZ.EXE] C:\WINDOWS\IEWZ.EXE
O4 - HKLM\..\RunServices: [NETKN.EXE] C:\WINDOWS\NETKN.EXE
O4 - HKLM\..\RunServices: [NETCZ.EXE] C:\WINDOWS\SYSTEM\NETCZ.EXE
O4 - HKLM\..\RunServices: [JAVAUQ32.EXE] C:\WINDOWS\JAVAUQ32.EXE
O4 - HKLM\..\RunServices: [ATLCO.EXE] C:\WINDOWS\SYSTEM\ATLCO.EXE
O4 - HKLM\..\RunServices: [IEEJ.EXE] C:\WINDOWS\SYSTEM\IEEJ.EXE
O4 - HKLM\..\RunServices: [NTJI.EXE] C:\WINDOWS\NTJI.EXE
O4 - HKLM\..\RunServices: [WINDR32.EXE] C:\WINDOWS\WINDR32.EXE
O4 - HKLM\..\RunServices: [MFCHV.EXE] C:\WINDOWS\SYSTEM\MFCHV.EXE
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Web Service] C:\WINDOWS\SYSTEM\MSXMIDI.EXE
O4 - Startup: Norton Program Scheduler.lnk = C:\Program Files\Norton AntiVirus\NSCHED32.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: EPSON Contrôleur en arrière plan.lnk = C:\ESM2\STMS.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.pizdato.biz
O15 - Trusted Zone: *.vse-moe.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.addictivetechnologies.net
O15 - Trusted Zone: *.f1organizer.com
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O21 - SSODL: eplrr - {426BC1E0-6FF1-11D9-A3DB-0007CB0000FF} - C:\WINDOWS\SYSTEM\eplrr3.dll
Merci de m'aider, je vous en serai très reconnaissant...
++ T-eO

OUI!
Ce sera un début d'épuration.
Reviens avec un autre log.
Cordialement
Richard1 (Montréal, Canada)
Va aussi te chercher un simple parefeu gratuit.
Mais bon, je vais en mettre un pour etre plus tranquil dessus mais je ne suis pas totalement convaincu de l'efficaciter...
Sur un autre pc perso vec Win2000, j'ai juste AntiVir et tout marche sans probleme... un peu de Ad-aware de temps en temps et jamais de gros probleme...
De plus le jour ou j'ai eu le malheur de vouloir mettre ZoneAlarm j'me suis chopper une variante de Sasser le lendemain...
Enfin bref, tu t'y connais surment plus que moi !
Sinon, je pense mettre zoneAlarm (il est en français c deja ca), je fé un tit netoyage comme tu a dis de mon log et je vous en renvoie un dans l'apres-midi...
(Merci pour tout ces conseils)