"sos" ordi infeste.Fermé

Question

Bonjour,
Je m' adresse a la communaute car j' ai un probleme de pop up intempestif provenant  de " em pc internet ".
J' ai suivi les conseils que j' ai pu trouver sur le forum, a savoir:l' installation de ccleaner,AVG ainsi que hijackthis.
Je vous joins les rapports de Avg et Hijackthis, en esperant que quelqu' un pourra m' aider.
Je possede egalement l' anti virus NOD32, mais il me laisse parfois passer des virus, comment faire pour bien le regler et savoir si il est a jour.
Merci d' avance.

Scan saved at 2:26:55 PM, on 11/4/2007 
Platform: Windows XP SP2 (WinNT 5.01.2600) 
MSIE: Internet Explorer v7.00 (7.00.6000.16544) 

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe 
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\WINDOWS\system32
etdde.exe 
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 
C:\WINDOWS\system32\cisvc.exe 
C:\WINDOWS\system32\clipsrv.exe 
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 
C:\Program Files\Eset
od32krn.exe 
C:\WINDOWS\system32	cpsvcs.exe 
C:\WINDOWS\system32\slserv.exe 
C:\WINDOWS\System32\snmp.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\system32\dllhost.exe 
C:\WINDOWS\System32\dmadmin.exe 
C:\WINDOWS\system32\dllhost.exe 
C:\WINDOWS\Explorer.EXE 
C:\Program Files\Eset
od32kui.exe 
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe 
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
C:\WINDOWS\SOUNDMAN.EXE 
C:\WINDOWS\System32\Rundll32.exe 
C:\Program Files\QuickTime\qttask.exe 
C:\Program Files\Internet Explorer\IEXPLORE.EXE 
C:\WINDOWS\system32\ctfmon.exe 
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe 
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
C:\Program Files\Internet Explorer\iexplore.exe 
C:\WINDOWS\system32\cidaemon.exe 
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.yahoo.com/?p=us 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.yahoo.com/?p=us 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll 
O2 - BHO: browser optimizer by rightonadz - {971C3384-F75E-4562-95B3-CBE7417529BC} - C:\WINDOWS\system32\gzmrotate.dll 
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll 
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll 
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll 
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll 
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file) 
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll 
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll 
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName 
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE 
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe 
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC 
O4 - HKLM\..\Run: [hid_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized 
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll 
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll 
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
O11 - Options group: [INTERNATIONAL] International* 
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm 
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab 
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.serviceshub.microsoft.com/supportforbusiness/create 
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab 
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab 
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab 
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info 
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll 
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab 
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab 
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx 
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/ 
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab 
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab 
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab 
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe 
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0F725AE-65FA-401A-AA9C-10D9F9964B6C}: NameServer = 195.229.241.222 213.42.20.20 
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL 
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL 
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll 
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll 
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe 
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe 
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe 
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset
od32krn.exe 
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe 
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe 


C:\Documents and Settings\CORINNE AGGOUN\Application Data\installer_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.z : Aucune action entreprise. 
C:\Documents and Settings\CORINNE AGGOUN\Application Data\setup_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.z : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@247realmedia[1].txt -> TrackingCookie.247realmedia : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@adtech[1].txt -> TrackingCookie.Adtech : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@ehg-traderpublishing.hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@hitbox[2].txt -> TrackingCookie.Hitbox : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Aucune action entreprise. 
C:\Documents and Settings\CORINNE AGGOUN\Cookies\corinne_aggoun@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise. 
C:\Documents and Settings\CORINNE AGGOUN\Cookies\corinne_aggoun@statcounter[1].txt -> TrackingCookie.Statcounter : Aucune action entreprise. 
C:\Documents and Settings\CORINNE AGGOUN\Cookies\corinne_aggoun@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise. 
C:\Documents and Settings\Razors\Cookiesazors@m.webtrends[1].txt -> TrackingCookie.Webtrends : Aucune action entreprise. 
C:\Documents and Settings\SAMIR AGGOUN\Cookies\samir_aggoun@m.webtrends[1].txt -> TrackingCookie.Webtrends : Aucune action entreprise.

hardcool · Answer

bjr,déjà commence par cocher la ligne
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)  et clique sur fix
puis tu télécharge a-sqaured free:   www.emsisoft.fr/fr/software/download/ 
                              spybot S&D      :  www.clubic.com/telecharger-fiche10965-spybot-search-destroy.html
tu fais un scan,puis tu choisis supprimer ;comme action à entreprendre
TRES IMPORTANT:effectuer les MAJ avant le scan
ensuite,histoire de vérifier tu fais un scan en ligne ici webscanner.kaspersky.fr

becool · Answer

slt,
essaye AD-aware se personal :

https://download.cnet.com/Adaware-Antivirus-Free/3000-2239_4-10045910.html?part=dl-ad-aware&subj=dl&tag=top5

il est tres efficace.
ainsi que l'Antivirus Antivir en plus ils sont gratuits ;-)

toztoz · Answer

Bjr Hardcool,
Etant novice en ordi, je n' ai pas compris quand tu me dis d effectuer les MAJ avant le scan, c' est quoi les MAJ.

hardcool · Answer

MAJ=mise à jour

toztoz · Answer

Salut hardcool,

J' ai fait ce que tu m' as dit, il est vrai que je n' ai plus de fenetre  " em pc internet " qui s' ouvre, mais maintenant, j' ai beaucoup de mal a surfer sur le net et quand j' allume l' ordi un message d' erreur apparait: An exception occured while trying to run '''' C\windows\system32\gzmrotate.dll''dllverify''. Je ne sais pas ce que ca signifie. Snif que se passe t- il?

"sos" ordi infeste.

5 réponses

Discussions similaires

Newsletters