Http://www.hbidiocy.com/IMG000583.php

salut,
dsl j ai pas le lien mais regarde sur le forum (sinon jte les donne ce soir)

met un log hijack this + un scan en ligne sur bitefender stp

a+

j'attend les liens.
merci a toi

salut

je crois que regis et reparti bosser

pour hijackthis:
http://www.merijn.org/files/hijackthis.zip
Dezippe le dans un dossier prévu a cet effet.
Par exemple C:\hijack
et surtout pas dans un dossier temporaire (temp)
lance le puis:
clic sur "do a system scan and save logfile" et pas autre chose
Le bloc note va s'ouvrir, copie tout le contenu et colle le ici a la suite de ton message.

pour le scan en ligne:
http://www.bitdefender.com/scan/licence.php

a+

Logfile of HijackThis v1.99.1
Scan saved at 13:55:09, on 28/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\IZArc\IZArc.exe
C:\DOCUME~1\SANDRI~1\LOCALS~1\Temp\ARCC\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} (dnlplayer Class) - http://www.digitalwebbooks.com/reader/dbplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSn­iff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5CE7A7AF-8C5E-48CF-AE30-8FC6F01C27E3} (Yahoo! Photos - Outil de publication Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropp­er/ydropper1_6fr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x­86/client/wuweb_site.cab?1122366368853
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/­cabsa.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/­ICSScanner.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

BitDefender Online Scanner



Scan report generated at: Thu, Jul 28, 2005 - 14:29:22





Scan path: A:\;C:\;E:\;M:\;S:\;







Statistics

Time
00:32:14

Files
174868

Folders
2132

Boot Sectors
4

Archives
934

Packed Files
25758




Results

Identified Viruses
4

Infected Files
10

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
10




Engines Info

Virus Definitions
197440

Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

Scan plugins
13

Archive plugins
39

Unpack plugins
4

E-mail plugins
6

System plugins
1




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ol­e;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rt­f;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;sm­m;pfd;msi;ini;csc;cmd;bas;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P206\A0035967.exe=>(RAR Sfx o)=>10a.exe
Infected with: Dropped:Trojan.Winad.71680.DLL

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P206\A0035967.exe=>(RAR Sfx o)=>10a.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P206\A0035967.exe=>(RAR Sfx o)=>10a.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P206\A0035967.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035993.exe
Infected with: Trojan.Winad.AE

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035993.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035993.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035994.exe
Infected with: Trojan.Winad.V

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035994.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035994.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035995.dll
Infected with: Trojan.Winad.71680.DLL

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035995.dll
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035995.dll
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035999.exe=>(RAR Sfx o)=>10a.exe
Infected with: Dropped:Trojan.Winad.71680.DLL

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035999.exe=>(RAR Sfx o)=>10a.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035999.exe=>(RAR Sfx o)=>10a.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P207\A0035999.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036971.exe=>(RAR Sfx o)=>10a.exe
Infected with: Dropped:Trojan.Winad.71680.DLL

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036971.exe=>(RAR Sfx o)=>10a.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036971.exe=>(RAR Sfx o)=>10a.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036971.exe=>(RAR Sfx o)
Update failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036983.exe
Infected with: Trojan.Winad.AE

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036983.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036983.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036984.exe
Infected with: Trojan.Winad.V

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036984.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036984.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036985.dll
Infected with: Trojan.Winad.71680.DLL

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036985.dll
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036985.dll
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036987.exe=>(RAR Sfx o)=>10a.exe
Infected with: Dropped:Trojan.Winad.71680.DLL

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036987.exe=>(RAR Sfx o)=>10a.exe
Disinfection failed

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036987.exe=>(RAR Sfx o)=>10a.exe
Deleted

C:\System Volume Information\_restore{1A7ED1B4-5AD4-43B1-B898-57EBD856C170}\R­P208\A0036987.exe=>(RAR Sfx o)
Update failed

bon bin voila les deux resultats.
j'espere que c'est bien ca.

bo apparement y a plus personne qui me repond!!!!

salut
¤Désactive ta restauration système:
Clic droit sur poste de travail puis,
propriété, tu clique sur onglet restauration système
tu coche la case désactiver la restauration et applique
puis decoche la case

redelmarre

precise ou en sont tes soucis

bonsoir, voila c fais
bin mes soucis sont comme je l'ai dis dans mon premier message....
cette apres midi g fais se que vous m'avez dit, et dans le scan en ligne, il m'a trouver 2 trojean qui se sont mis en quarantaine.
je les ais suprimer, mais je ne suis pas sure que tous est enlever de mon pc!!!

se matin j'avais encore la fenetre de discution qui s'ouvrait avec le lien a cliker....
mais depuis le scan plus rien