Quelqu un peut il m aider svp merci d avance Logfile of HijackThis v1.99.1 Scan saved at 13:27:00, on 10/08/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE C:\WINDOWS\System32\NMSSvc.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\WINDOWS\system32\PROMon.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\MSN Apps\Updater\\01.03.0000.1005\fr\msnappau.exe C:\WINDOWS\VM_STI.EXE C:\WINDOWS\edmgrg.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\DOCUME~1\ELOUAZ~1.CPQ\LOCALS~1\Temp\Rar$EX00.079\PCBooster.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\Program Files\ISTsvc\istsvc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\pc\Local Settings\Temp\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/040C/bl8.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.menara.ma R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/040C/bl7.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O1 - Hosts: 222.89.98.219 www.wo365.com O1 - Hosts: 222.89.98.219 cmfu.com O1 - Hosts: 222.89.98.219 www.cmfu.com O1 - Hosts: 222.89.98.219 9i0.com O1 - Hosts: 222.89.98.219 www.9flash.com O1 - Hosts: 222.89.98.219 9flash.com O1 - Hosts: 222.89.98.219 www.nowok.net O1 - Hosts: 222.89.98.219 nowok.net O1 - Hosts: 222.89.98.219 wisa.com.cn O1 - Hosts: 222.89.98.219 www.sia.com.cn O1 - Hosts: 222.89.98.219 www.wisa.cn O1 - Hosts: 222.89.98.219 wisa.cn O1 - Hosts: 222.89.98.219 www.zhao99.com O1 - Hosts: 222.89.98.219 zhao99.com O1 - Hosts: 222.89.98.219 www.wo123.com O1 - Hosts: 222.89.98.219 wo123.com O1 - Hosts: 222.89.98.219 wo99.com O1 - Hosts: 222.89.98.219 www.wo99.com O1 - Hosts: 222.89.98.219 www.page.com.cn O1 - Hosts: 222.89.98.219 page.com.cn O1 - Hosts: 222.89.98.219 www.432.cn O1 - Hosts: 222.89.98.219 432.cn O1 - Hosts: 222.89.98.219 wysw.com O1 - Hosts: 222.89.98.219 14.com.cn O1 - Hosts: 222.89.98.219 www.14.com.cn O1 - Hosts: 222.89.98.219 cnww.net O1 - Hosts: 222.89.98.219 www.mv99.com O1 - Hosts: 222.89.98.219 mv99.com O1 - Hosts: 222.89.98.219 www.youav.com O1 - Hosts: 222.89.98.219 www.mtvav.com O1 - Hosts: 222.89.98.219 www.98983.com O1 - Hosts: 222.89.98.219 98983.com O1 - Hosts: 222.89.98.219 www.114.com.cn O1 - Hosts: 222.89.98.219 114.com.cn O1 - Hosts: 222.89.98.219 www.net114.com O1 - Hosts: 222.89.98.219 www.skywz.com O1 - Hosts: 222.89.98.219 skywz.com O1 - Hosts: 222.89.98.219 www.hao6.com O1 - Hosts: 222.89.98.219 hao6.com O1 - Hosts: 222.89.98.219 www.678a.com O1 - Hosts: 222.89.98.219 678a.com O1 - Hosts: 222.89.98.219 www.7510.com O1 - Hosts: 222.89.98.219 7510.com O1 - Hosts: 222.89.98.219 www.zzkan.com O1 - Hosts: 222.89.98.219 zzkan.com O1 - Hosts: 222.89.98.219 www.ca183.com O1 - Hosts: 222.89.98.219 ca183.com O1 - Hosts: 222.89.98.219 3tom.com O1 - Hosts: 222.89.98.219 www.yhjm.com O1 - Hosts: 222.89.98.219 yhjm.com O1 - Hosts: 222.89.98.219 www.k369.com O1 - Hosts: 222.89.98.219 www.xxwww.com O1 - Hosts: 222.89.98.219 xxwww.com O1 - Hosts: 222.89.98.219 www.fm1000.net O1 - Hosts: 222.89.98.219 fm1000.net O1 - Hosts: 222.89.98.219 www.ok135.com O1 - Hosts: 222.89.98.219 ok135.com O1 - Hosts: 222.89.98.219 www.link999.com O1 - Hosts: 222.89.98.219 link999.com O1 - Hosts: 222.89.98.219 www.001wz.com O1 - Hosts: 222.89.98.219 001wz.com O1 - Hosts: 222.89.98.219 www.7t7t.com O1 - Hosts: 222.89.98.219 7t7t.com O1 - Hosts: 222.89.98.219 www.7k7k.com O1 - Hosts: 222.89.98.219 7k7k.com O1 - Hosts: 222.89.98.219 www.webcool.net O1 - Hosts: 222.89.98.219 webcool.net O1 - Hosts: 222.89.98.219 www.51sobu.com O1 - Hosts: 222.89.98.219 51sobu.com O1 - Hosts: 222.89.98.219 cy.51sobu.com O1 - Hosts: 222.89.98.219 www.fj3721.com O1 - Hosts: 222.89.98.219 fj3721.com O1 - Hosts: 222.89.98.219 www.msncn.com O1 - Hosts: 222.89.98.219 msncn.com O1 - Hosts: 222.89.98.219 www.6235.com O1 - Hosts: 222.89.98.219 6235.com O1 - Hosts: 222.89.98.219 www.8goo.com O1 - Hosts: 222.89.98.219 8goo.com O1 - Hosts: 222.89.98.219 www.baimin.com O1 - Hosts: 222.89.98.219 baimin.com O1 - Hosts: 222.89.98.219 www.bwwz.com O1 - Hosts: 222.89.98.219 bwwz.com O1 - Hosts: 222.89.98.219 www.howow.net O1 - Hosts: 222.89.98.219 howow.net O1 - Hosts: 222.89.98.219 www.tongchi.com O1 - Hosts: 222.89.98.219 tongchi.com O1 - Hosts: 222.89.98.219 www.65658.com O1 - Hosts: 222.89.98.219 65658.com O1 - Hosts: 222.89.98.219 www.7o7o.com O1 - Hosts: 222.89.98.219 7o7o.com O1 - Hosts: 222.89.98.219 5126.net O1 - Hosts: 222.89.98.219 www.5126.net O1 - Hosts: 222.89.98.219 www.wangzhiku.com O1 - Hosts: 222.89.98.219 wangzhiku.com O1 - Hosts: 222.89.98.219 www.soyeah.com O1 - Hosts: 222.89.98.219 soyeah.com O1 - Hosts: 222.89.98.219 www.sowang.cn O1 - Hosts: 222.89.98.219 sowang.cn O1 - Hosts: 222.89.98.219 www.77177.com O1 - Hosts: 222.89.98.219 77177.com O1 - Hosts: 222.89.98.219 www.look8.net O2 - BHO: (no name) - SOFTWARE - (no file) O2 - BHO: (no name) - {00000000-0000-4AB4-A8F1-E71359B5DEFA} - C:\Program Files\hm3ovamm\hm3ovamm.dll O2 - BHO: (no name) - {029E8378-B59B-4488-845A-037BD43A43B6} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {18E875A4-6275-630A-FF27-37E86A6C88FC} - C:\DOCUME~1\ELOUAZ~1.CPQ\APPLIC~1\MEDIAP~1\Mpeg about.exe (file missing) O2 - BHO: (no name) - {417B7F8F-522D-450B-B0DF-43CC0F3F5C36} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {432B8002-FFAB-6752-A91E-2C0EAEB91030} - C:\DOCUME~1\ELOUAZ~1.CPQ\APPLIC~1\MEDIAP~1\Mpeg about.exe (file missing) O2 - BHO: (no name) - {4C0F0397-ED34-4D0B-89F4-B299823AB7FD} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {54248269-2D69-4A72-A77E-1D81E1517C0A} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {677A18F2-07B9-472D-9EC3-247858E33B6B} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {73E10C85-A376-41FF-B148-E1BC49AC0ADF} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {7A0FC0A7-D092-4906-9F22-EADC60B0CF0C} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll O2 - BHO: (no name) - {82088289-185C-45B3-A8EB-47811C061129} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {87B28EF2-C0B8-467C-8B14-3E593F6AD941} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {8E2D2133-4F15-4173-A8AE-A4980AD98049} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {9073568A-A76A-4B96-8851-C4994223A111} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {9A255E43-DEE0-40EB-B8EE-63F24F36B891} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {9BA0225B-5747-44E6-9F05-8C343674E758} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {A5F940A9-6B5E-40C7-82CA-4687FE47ABB9} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing) O2 - BHO: (no name) - {AAB4F4AE-6155-4265-8F0A-049B75DB73CB} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {ACFFF0AB-9A34-4320-97E0-91C026ABD83A} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {B6D13DCF-4547-4F11-8ACF-F7DF7CCC83C9} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {B95CECE3-0358-4DD1-8D67-9B411E3EA9E5} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {BC91054E-BE41-4CBC-ADBF-4783B7219551} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\01.02.4000.1001\fr\msntb.dll O2 - BHO: (no name) - {BF1AAB54-CCCC-4E44-B766-588ED723996D} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {C402AF3F-6CAA-467A-9DC4-F64FD13D09C3} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {D1B0348E-D2FA-4964-8E24-C73A24410AEA} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {DDA10BD0-5EA3-4F93-91FF-E9378D2205E9} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {E7E3EDFC-F48B-4ED6-82AE-FCD7E9A2D83A} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {F3B9BFD2-F48B-457B-A4FD-42F4A7B6712F} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {FAC1A20D-E694-4EDE-A28F-C61D1472D101} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {FC021765-7DF2-457B-BC27-4C7CC9B30DCB} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {FF186F98-C334-487D-BA5A-0637CF00A5B2} - C:\Program Files\CSBB\CSBB.dll (file missing) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [mbmjuc] C:\WINDOWS\System32\mbmjuc.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\\01.03.0000.1005\fr\msnappau.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P O4 - HKLM\..\Run: [17xOkb] C:\WINDOWS\edmgrg.exe O4 - HKLM\..\Run: [PC Booster] C:\DOCUME~1\ELOUAZ~1.CPQ\LOCALS~1\Temp\Rar$EX00.079\PCBooster.exe O4 - HKLM\..\Run: [hm3ovamm] C:\Program Files\hm3ovamm\hm3ovamm.exe O4 - HKLM\..\Run: [twomodedoeschin] C:\Documents and Settings\All Users\Application Data\PlatformBuildTwoMode\DeafAmok.exe O4 - HKLM\..\Run: [Á²# L"h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\edmgrg.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.menara.ma O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1022_FR_XP.cab O16 - DPF: {1BAD0830-AC09-44FA-8A44-5365AEB45D11} - http://www.mtv.com/overdrive/bin/setup.exe O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cab O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f009.mail.caramail.lycos.fr/app/uploader/FileUploader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D05E546E-0131-4D88-AE04-C3D91F4100C4}: Domain = galaxi.ensias O17 - HKLM\System\CCS\Services\Tcpip\..\{D05E546E-0131-4D88-AE04-C3D91F4100C4}: NameServer = 192.168.100.100 O17 - HKLM\System\CCS\Services\Tcpip\..\{EEA1862B-4B8A-4207-B5A1-39F21A3D3BFE}: NameServer = 212.217.0.3 212.217.1.4 O20 - AppInit_DLLs: mad.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\PROGRA~1\SYSTEM~1\autocomp.exe (file missing) O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

bonjour je démarre l'analyse de ton rapport, réponse dans un moment en attendant installe HijackThis correctement IMPORTANT HijackThis doit être enregistré dans un répertoire dédié tel que C:\HijackThis et pas dans un dossier de fichiers temporaires.[nonnon] Tutorial d'aide d'installation : http://sitethemacs.free.fr/aide_enregistrement_de_hijackthi.htm

Modifié par philae le 11/08/2005 15:03

Merci infiniment vous me sauvez la vie [smile] je v esayer d installer correctement hijackthis ! encore merci

re je ne sais pas si je te sauve la vie, mais ton pc est bien infecté. Installer Hijack Correctement est très important ensuite * Télécharge Ccleaner http://www.ccleaner.com/ccdownload.asp * Téléchage LSPFix. http://www.cexx.org/lspfix.htm puis * Tu cliques sur Démarrer-------------- Exécuter, tu tapes services.msc------------------ OK. Dans la liste des services, cherche et sélectionne " System Startup Service " / double clique sur la ligne / vérifie dans Chemin d'accès des fichiers exécutables qu'il s'agit bien de " C:\WINDOWS\svcproc.exe " / dans Type de démarrage, sélectionne Désactiver / valide la modification. Clique sur Démarrer, Exécuter, puis tapes cmd et OK. Copie/Colle la ligne suivante dans la fenêtre et appuie sur Entrée. sc delete Sound Service Ferme la fenêtre. * Lance LSPFix * Désinstalle ces applications (si tu les trouves) dans Ajout-Suppression de programmes : ISTsvc * Re-Démarrer le logiciel HijackThis en IMPERATIVEMENT en Mode Sans Echec (vous n'aurez plus accès à Internet, donc il faut copier ces instructions au préalable dans un fichier texte) aide pour mode sans échec : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020905112131924 et lancer un scan "Do a system scan only" Puis cocher les lignes suivantes en GRAS (dans HijackThis): Logfile of HijackThis v1.99.1 Scan saved at 13:27:00, on 10/08/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE C:\WINDOWS\System32\NMSSvc.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\WINDOWS\system32\PROMon.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\MSN Apps\Updater\\\01.03.0000.1005\fr\msnappau.exe C:\WINDOWS\VM_STI.EXE C:\WINDOWS\edmgrg.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\DOCUME~1\ELOUAZ~1.CPQ\LOCALS~1\Temp\Rar$EX00.079\PCBooster.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\Program Files\ISTsvc\istsvc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\pc\Local Settings\Temp\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/040C/bl8.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.menara.ma R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/040C/bl7.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O1 - Hosts: 222.89.98.219 www.wo365.com O1 - Hosts: 222.89.98.219 cmfu.com O1 - Hosts: 222.89.98.219 www.cmfu.com O1 - Hosts: 222.89.98.219 9i0.com O1 - Hosts: 222.89.98.219 www.9flash.com O1 - Hosts: 222.89.98.219 9flash.com O1 - Hosts: 222.89.98.219 www.nowok.net O1 - Hosts: 222.89.98.219 nowok.net O1 - Hosts: 222.89.98.219 wisa.com.cn O1 - Hosts: 222.89.98.219 www.sia.com.cn O1 - Hosts: 222.89.98.219 www.wisa.cn O1 - Hosts: 222.89.98.219 wisa.cn O1 - Hosts: 222.89.98.219 www.zhao99.com O1 - Hosts: 222.89.98.219 zhao99.com O1 - Hosts: 222.89.98.219 www.wo123.com O1 - Hosts: 222.89.98.219 wo123.com O1 - Hosts: 222.89.98.219 wo99.com O1 - Hosts: 222.89.98.219 www.wo99.com O1 - Hosts: 222.89.98.219 www.page.com.cn O1 - Hosts: 222.89.98.219 page.com.cn O1 - Hosts: 222.89.98.219 www.432.cn O1 - Hosts: 222.89.98.219 432.cn O1 - Hosts: 222.89.98.219 wysw.com O1 - Hosts: 222.89.98.219 14.com.cn O1 - Hosts: 222.89.98.219 www.14.com.cn O1 - Hosts: 222.89.98.219 cnww.net O1 - Hosts: 222.89.98.219 www.mv99.com O1 - Hosts: 222.89.98.219 mv99.com O1 - Hosts: 222.89.98.219 www.youav.com O1 - Hosts: 222.89.98.219 www.mtvav.com O1 - Hosts: 222.89.98.219 www.98983.com O1 - Hosts: 222.89.98.219 98983.com O1 - Hosts: 222.89.98.219 www.114.com.cn O1 - Hosts: 222.89.98.219 114.com.cn O1 - Hosts: 222.89.98.219 www.net114.com O1 - Hosts: 222.89.98.219 www.skywz.com O1 - Hosts: 222.89.98.219 skywz.com O1 - Hosts: 222.89.98.219 www.hao6.com O1 - Hosts: 222.89.98.219 hao6.com O1 - Hosts: 222.89.98.219 www.678a.com O1 - Hosts: 222.89.98.219 678a.com O1 - Hosts: 222.89.98.219 www.7510.com O1 - Hosts: 222.89.98.219 7510.com O1 - Hosts: 222.89.98.219 www.zzkan.com O1 - Hosts: 222.89.98.219 zzkan.com O1 - Hosts: 222.89.98.219 www.ca183.com O1 - Hosts: 222.89.98.219 ca183.com O1 - Hosts: 222.89.98.219 3tom.com O1 - Hosts: 222.89.98.219 www.yhjm.com O1 - Hosts: 222.89.98.219 yhjm.com O1 - Hosts: 222.89.98.219 www.k369.com O1 - Hosts: 222.89.98.219 www.xxwww.com O1 - Hosts: 222.89.98.219 xxwww.com O1 - Hosts: 222.89.98.219 www.fm1000.net O1 - Hosts: 222.89.98.219 fm1000.net O1 - Hosts: 222.89.98.219 www.ok135.com O1 - Hosts: 222.89.98.219 ok135.com O1 - Hosts: 222.89.98.219 www.link999.com O1 - Hosts: 222.89.98.219 link999.com O1 - Hosts: 222.89.98.219 www.001wz.com O1 - Hosts: 222.89.98.219 001wz.com O1 - Hosts: 222.89.98.219 www.7t7t.com O1 - Hosts: 222.89.98.219 7t7t.com O1 - Hosts: 222.89.98.219 www.7k7k.com O1 - Hosts: 222.89.98.219 7k7k.com O1 - Hosts: 222.89.98.219 www.webcool.net O1 - Hosts: 222.89.98.219 webcool.net O1 - Hosts: 222.89.98.219 www.51sobu.com O1 - Hosts: 222.89.98.219 51sobu.com O1 - Hosts: 222.89.98.219 cy.51sobu.com O1 - Hosts: 222.89.98.219 www.fj3721.com O1 - Hosts: 222.89.98.219 fj3721.com O1 - Hosts: 222.89.98.219 www.msncn.com O1 - Hosts: 222.89.98.219 msncn.com O1 - Hosts: 222.89.98.219 www.6235.com O1 - Hosts: 222.89.98.219 6235.com O1 - Hosts: 222.89.98.219 www.8goo.com O1 - Hosts: 222.89.98.219 8goo.com O1 - Hosts: 222.89.98.219 www.baimin.com O1 - Hosts: 222.89.98.219 baimin.com O1 - Hosts: 222.89.98.219 www.bwwz.com O1 - Hosts: 222.89.98.219 bwwz.com O1 - Hosts: 222.89.98.219 www.howow.net O1 - Hosts: 222.89.98.219 howow.net O1 - Hosts: 222.89.98.219 www.tongchi.com O1 - Hosts: 222.89.98.219 tongchi.com O1 - Hosts: 222.89.98.219 www.65658.com O1 - Hosts: 222.89.98.219 65658.com O1 - Hosts: 222.89.98.219 www.7o7o.com O1 - Hosts: 222.89.98.219 7o7o.com O1 - Hosts: 222.89.98.219 5126.net O1 - Hosts: 222.89.98.219 www.5126.net O1 - Hosts: 222.89.98.219 www.wangzhiku.com O1 - Hosts: 222.89.98.219 wangzhiku.com O1 - Hosts: 222.89.98.219 www.soyeah.com O1 - Hosts: 222.89.98.219 soyeah.com O1 - Hosts: 222.89.98.219 www.sowang.cn O1 - Hosts: 222.89.98.219 sowang.cn O1 - Hosts: 222.89.98.219 www.77177.com O1 - Hosts: 222.89.98.219 77177.com O1 - Hosts: 222.89.98.219 www.look8.net O2 - BHO: (no name) - SOFTWARE - (no file) O2 - BHO: (no name) - {00000000-0000-4AB4-A8F1-E71359B5DEFA} - C:\Program Files\hm3ovamm\hm3ovamm.dll O2 - BHO: (no name) - {029E8378-B59B-4488-845A-037BD43A43B6} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx ta version est ancienne, télécharge la version 7.0 O2 - BHO: (no name) - {18E875A4-6275-630A-FF27-37E86A6C88FC} - C:\DOCUME~1\ELOUAZ~1.CPQ\APPLIC~1\MEDIAP~1\Mpeg about.exe (file missing) O2 - BHO: (no name) - {417B7F8F-522D-450B-B0DF-43CC0F3F5C36} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {432B8002-FFAB-6752-A91E-2C0EAEB91030} - C:\DOCUME~1\ELOUAZ~1.CPQ\APPLIC~1\MEDIAP~1\Mpeg about.exe (file missing) O2 - BHO: (no name) - {4C0F0397-ED34-4D0B-89F4-B299823AB7FD} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {54248269-2D69-4A72-A77E-1D81E1517C0A} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {677A18F2-07B9-472D-9EC3-247858E33B6B} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {73E10C85-A376-41FF-B148-E1BC49AC0ADF} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {7A0FC0A7-D092-4906-9F22-EADC60B0CF0C} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll O2 - BHO: (no name) - {82088289-185C-45B3-A8EB-47811C061129} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {87B28EF2-C0B8-467C-8B14-3E593F6AD941} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {8E2D2133-4F15-4173-A8AE-A4980AD98049} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {9073568A-A76A-4B96-8851-C4994223A111} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\\\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: (no name) - {9A255E43-DEE0-40EB-B8EE-63F24F36B891} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {9BA0225B-5747-44E6-9F05-8C343674E758} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {A5F940A9-6B5E-40C7-82CA-4687FE47ABB9} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing) O2 - BHO: (no name) - {AAB4F4AE-6155-4265-8F0A-049B75DB73CB} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {ACFFF0AB-9A34-4320-97E0-91C026ABD83A} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {B6D13DCF-4547-4F11-8ACF-F7DF7CCC83C9} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {B95CECE3-0358-4DD1-8D67-9B411E3EA9E5} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {BC91054E-BE41-4CBC-ADBF-4783B7219551} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\\01.02.4000.1001\fr\msntb.dll O2 - BHO: (no name) - {BF1AAB54-CCCC-4E44-B766-588ED723996D} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {C402AF3F-6CAA-467A-9DC4-F64FD13D09C3} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {D1B0348E-D2FA-4964-8E24-C73A24410AEA} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {DDA10BD0-5EA3-4F93-91FF-E9378D2205E9} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {E7E3EDFC-F48B-4ED6-82AE-FCD7E9A2D83A} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {F3B9BFD2-F48B-457B-A4FD-42F4A7B6712F} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {FAC1A20D-E694-4EDE-A28F-C61D1472D101} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {FC021765-7DF2-457B-BC27-4C7CC9B30DCB} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {FF186F98-C334-487D-BA5A-0637CF00A5B2} - C:\Program Files\CSBB\CSBB.dll (file missing) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [mbmjuc] C:\WINDOWS\System32\mbmjuc.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\\\01.03.0000.1005\fr\msnappau.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P O4 - HKLM\..\Run: [17xOkb] C:\WINDOWS\edmgrg.exe O4 - HKLM\..\Run: [PC Booster] C:\DOCUME~1\ELOUAZ~1.CPQ\LOCALS~1\Temp\Rar$EX00.079\PCBooster.exe O4 - HKLM\..\Run: [hm3ovamm] C:\Program Files\hm3ovamm\hm3ovamm.exe O4 - HKLM\..\Run: [twomodedoeschin] C:\Documents and Settings\All Users\Application Data\PlatformBuildTwoMode\DeafAmok.exe O4 - HKLM\..\Run: [Á ²# L"h'þ9Óœð3rÅ WC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\edmgrg.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\lspak.dll Ne touche pas aux lignes 010 ne pas les fixer avec Hijack O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.menara.ma O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1022_FR_XP.cab O16 - DPF: {1BAD0830-AC09-44FA-8A44-5365AEB45D11} - http://www.mtv.com/overdrive/bin/setup.exe O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_FR_XP.cab O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f009.mail.caramail.lycos.fr/app/uploader/FileUploader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D05E546E-0131-4D88-AE04-C3D91F4100C4}: Domain = galaxi.ensias O17 - HKLM\System\CCS\Services\Tcpip\..\{D05E546E-0131-4D88-AE04-C3D91F4100C4}: NameServer = 192.168.100.100 O17 - HKLM\System\CCS\Services\Tcpip\..\{EEA1862B-4B8A-4207-B5A1-39F21A3D3BFE}: NameServer = 212.217.0.3 212.217.1.4 O20 - AppInit_DLLs: mad.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\PROGRA~1\SYSTEM~1\autocomp.exe (file missing) O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe et cliquer sur « Fix checked » * S'assurer d'avoir accès à tous les fichiers et dossiers cachés Aller dans l’ Explorateur Windows et afficher tous les fichiers cachés : [IMG]http://img159.exs.cx/img159/1880/sanstitre8cr.jpg[/IMG] Outils----->Options des dossiers----->Onglet Affichage-------> (le paramètre activé par défaut est <Ne pas afficher les fichiers cachés ou les fichiers système>.) Cliquez une fois dans le cercle étiqueté <Afficher tous les fichiers>, cliquez sur <Appliquer> puis sur <OK> et supprimer le(s) fichier(s ) ci dessous si il(s) est (sont) présent(s) : C:\Program Files\hm3ovamm----------------------->le dossier C:\Program Files\CSBB------------------------------>le dossier C:\DOCUMENT & SETTING~1\ELOUAZ~1.CPQ\APPLICATION DATA~1\MEDIAP~1---------------------------------->le dossier C:\WINDOWS\System32\mbmjuc.exe-------------->le fichier C:\WINDOWS\edmgrg.exe--------------------------->le fichier C:\DOCUMENT & SETTING ~1\ELOUAZ~1.CPQ\LOCALS SETTING~1\Temp--------------------------------------->tout le contenu C:\Documents and Settings\All Users\Application Data\PlatformBuildTwoMode-------------------------->le dossier C:\Program Files\ISTsvc------------------------------->le dossier Dans l'Explorateur Windows recacher les fichiers système afin de ne pas faire d'erreur à l'avenir: Retournez à la fenêtre <Paramètres de dossier> et sélectionnez <Ne pas afficher les fichiers cachés ou les fichiers système>. * Lance et execute Ccleaner * Redémarrer normalement Puis reviens mettre un rapport HijackThis

mille fois merci vous avez un sens du professionalisme qui vous honore encore merci je v tenter les réparartions que vous m avez conseillé

bonsoir voila je pense avoir fait presque tout j ai fait de mon mieyx lol encore merci Logfile of HijackThis v1.99.1 Scan saved at 18:06:39, on 11/08/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\WINDOWS\system32\PROMon.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\MSN Apps\Updater\\01.03.0000.1005\fr\msnappau.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/040C/bl8.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.menara.ma R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/040C/bl7.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {417B7F8F-522D-450B-B0DF-43CC0F3F5C36} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {432B8002-FFAB-6752-A91E-2C0EAEB91030} - C:\DOCUME~1\ELOUAZ~1.CPQ\APPLIC~1\MEDIAP~1\Mpeg about.exe (file missing) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing) O2 - BHO: (no name) - {B95CECE3-0358-4DD1-8D67-9B411E3EA9E5} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [mbmjuc] C:\WINDOWS\System32\mbmjuc.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\\01.03.0000.1005\fr\msnappau.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P O4 - HKLM\..\Run: [PC Booster] C:\DOCUME~1\ELOUAZ~1.CPQ\LOCALS~1\Temp\Rar$EX00.079\PCBooster.exe O4 - HKLM\..\Run: [hm3ovamm] C:\Program Files\hm3ovamm\hm3ovamm.exe O4 - HKLM\..\Run: [twomodedoeschin] C:\Documents and Settings\All Users\Application Data\PlatformBuildTwoMode\DeafAmok.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.menara.ma O16 - DPF: {1BAD0830-AC09-44FA-8A44-5365AEB45D11} - http://www.mtv.com/overdrive/bin/setup.exe O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f009.mail.caramail.lycos.fr/app/uploader/FileUploader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D05E546E-0131-4D88-AE04-C3D91F4100C4}: Domain = galaxi.ensias O17 - HKLM\System\CCS\Services\Tcpip\..\{EEA1862B-4B8A-4207-B5A1-39F21A3D3BFE}: NameServer = 212.217.0.3 212.217.1.4 O20 - AppInit_DLLs: mad.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\PROGRA~1\SYSTEM~1\autocomp.exe (file missing) O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Re Il en reste, * Re-Démarrer le logiciel HijackThis en IMPERATIVEMENT en Mode Sans Echec (vous n'aurez plus accès à Internet, donc il faut copier ces instructions au préalable dans un fichier texte) aide pour mode sans échec : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020905112131924 et lancer un scan "Do a system scan only" Puis cocher les lignes suivantes en GRAS (dans HijackThis): Logfile of HijackThis v1.99.1 Scan saved at 18:06:39, on 11/08/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\WINDOWS\system32\PROMon.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\MSN Apps\Updater\\\01.03.0000.1005\fr\msnappau.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/040C/bl8.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.menara.ma R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/040C/bl7.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {417B7F8F-522D-450B-B0DF-43CC0F3F5C36} - C:\Program Files\CSBB\CSBB.dll (file missing) O2 - BHO: (no name) - {432B8002-FFAB-6752-A91E-2C0EAEB91030} - C:\DOCUME~1\ELOUAZ~1.CPQ\APPLIC~1\MEDIAP~1\Mpeg about.exe (file missing) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\\\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing) O2 - BHO: (no name) - {B95CECE3-0358-4DD1- O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [mbmjuc] C:\WINDOWS\System32\mbmjuc.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\\\01.03.0000.1005\fr\msnappau.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P O4 - HKLM\..\Run: [PC Booster] C:\DOCUME~1\ELOUAZ~1.CPQ\LOCALS~1\Temp\Rar$EX00.079\PCBooster.exe O4 - HKLM\..\Run: [hm3ovamm] C:\Program Files\hm3ovamm\hm3ovamm.exe O4 - HKLM\..\Run: [twomodedoeschin] C:\Documents and Settings\All Users\Application Data\PlatformBuildTwoMode\DeafAmok.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.menara.ma O16 - DPF: {1BAD0830-AC09-44FA-8A44-5365AEB45D11} - http://www.mtv.com/overdrive/bin/setup.exe O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f009.mail.caramail.lycos.fr/app/uploader/FileUploader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D05E546E-0131-4D88-AE04-C3D91F4100C4}: Domain = galaxi.ensias O17 - HKLM\System\CCS\Services\Tcpip\..\{EEA1862B-4B8A-4207-B5A1-39F21A3D3BFE}: NameServer = 212.217.0.3 212.217.1.4 O20 - AppInit_DLLs: mad.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\PROGRA~1\SYSTEM~1\autocomp.exe (file missing) O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe et cliquer sur « Fix checked » * S'assurer d'avoir accès à tous les fichiers et dossiers cachés Aller dans l’ Explorateur Windows et afficher tous les fichiers cachés : [IMG]http://img159.exs.cx/img159/1880/sanstitre8cr.jpg[/IMG] Outils----->Options des dossiers----->Onglet Affichage-------> (le paramètre activé par défaut est <Ne pas afficher les fichiers cachés ou les fichiers système>.) Cliquez une fois dans le cercle étiqueté <Afficher tous les fichiers>, cliquez sur <Appliquer> puis sur <OK> et supprimer le(s) fichier(s ) ci dessous si il(s) est (sont) présent(s) : C:\Program Files\hm3ovamm---------------------->le dossier C:\Documents and Settings\All Users\Application Data\PlatformBuildTwoMode---------------------->le dossier C:\WINDOWS\System32\mbmjuc.exe----------->le fichier C:\Program Files\CSBB---------------------------->le dossier Dans l'Explorateur Windows recacher les fichiers système afin de ne pas faire d'erreur à l'avenir: Retournez à la fenêtre <Paramètres de dossier> et sélectionnez <Ne pas afficher les fichiers cachés ou les fichiers système>. * Lance et execute Ccleaner * Redémarrer normalement Puis reviens mettre un rapport HijackThis ainsi qu'un scan en ligne http://www.bitdefender.fr/scan8/ie.html copie colle le rapport ici et Ewido Télécharge-------Installe--------mets à jour-------puis fait un copier coller du rapport délivré ici. http://www.ewido.net/en/download/

bonsoir :) encore merci pour votre aide voila le rapport hijackthis apres les manipulations conseillés Logfile of HijackThis v1.99.1 Scan saved at 20:12:05, on 12/08/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE C:\WINDOWS\System32\NMSSvc.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe C:\Program Files\MSN Apps\Updater\\01.03.0000.1005\fr\msnappau.exe C:\WINDOWS\SynCor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/040C/bl8.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.menara.ma R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/040C/bl7.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\\01.02.4000.1001\fr\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.menara.ma O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D05E546E-0131-4D88-AE04-C3D91F4100C4}: Domain = galaxi.ensias O17 - HKLM\System\CCS\Services\Tcpip\..\{EEA1862B-4B8A-4207-B5A1-39F21A3D3BFE}: NameServer = 212.217.0.3 212.217.1.4 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - C:\PROGRA~1\SYSTEM~1\autocomp.exe (file missing) O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

tu ne m'as pas mis les rapports des scans d'Ewido ni de Bitdefender

Modifié par philae le 12/08/2005 22:54

oui desolé j ai oublié de sauver les rapports les voila : merci ewido security suite - Rapport de scan --------------------------------------------------------- + Créé le: 12:17:57, 13/08/2005 + Somme de contrôle: A14DE549 + Résultats du scan: HKLM\SOFTWARE\Altnet -> Spyware.Altnet : Erreur durant le nettoyage HKLM\SOFTWARE\Altnet\Dashboard -> Spyware.Altnet : Erreur durant le nettoyage HKLM\SOFTWARE\Altnet\Dashboard\Settings -> Spyware.Altnet : Erreur durant le nettoyage C:\Documents and Settings\pc\Cookies\pc@2o7[1].txt -> Spyware.Cookie.2o7 : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@atdmt[2].txt -> Spyware.Cookie.Atdmt : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@burstnet[2].txt -> Spyware.Cookie.Burstnet : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@counter2.hitslink[2].txt -> Spyware.Cookie.Hitslink : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@ehg.hitbox[2].txt -> Spyware.Cookie.Hitbox : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@hitbox[1].txt -> Spyware.Cookie.Hitbox : Nettoyer et sauvegarder C:\Documents and Settings\pc\Cookies\pc@statcounter[1].txt -> Spyware.Cookie.Statcounter : Nettoyer et sauvegarder ::Fin du rapport BitDefender Online Scanner Rapport d'analyse généré à: Sat, Aug 13, 2005 - 14:35:46 Voie d'analyse: A:\;C:\;D:\; Statistiques Temps 00:42:35 Fichiers 197998 Directoires 2608 Secteurs de boot 2 Archives 1044 Paquets programmes 37205 Résultats Virus identifiés 1 Fichiers infectés 1 Fichiers suspects 0 Avertissements 0 Désinfectés 0 Fichiers effacés 1 Info sur les moteurs Définition virus 199331 Version des moteurs AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29) Analyse des plugins 13 Archive des plugins 39 Unpack des plugins 4 E-mail plugins 6 Système plugins 1 Paramètres d'analyse Première action Désinfecté Seconde Action Supprimé Heuristique Oui Acceptez les avertissements Oui Extensions analysées exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas; Excludez les extensions Analyse d'emails Oui Analyse des Archives Oui Analyser paquets programmes Oui Analyse des fichiers Oui Analyse de boot Oui Fichier analysé Statut C:\WINDOWS\browserxtras\pn\remove.exe=>(NSIS o)=>zlib_nsis0001=>(NSIS o)=>zlib_nsis0002 Infecté par: Trojan.Downloader.Keenval.F C:\WINDOWS\browserxtras\pn\remove.exe=>(NSIS o)=>zlib_nsis0001=>(NSIS o)=>zlib_nsis0002 Echec de la désinfection C:\WINDOWS\browserxtras\pn\remove.exe=>(NSIS o)=>zlib_nsis0001=>(NSIS o)=>zlib_nsis0002 Supprimé C:\WINDOWS\browserxtras\pn\remove.exe=>(NSIS o)=>zlib_nsis0001=>(NSIS o) Echec de la mise à jour

bonsoir, une petite question connais tu adilelou ? http://www.dualforum.com/viewtopic10868.html j'espère néanmoins que tu t'en sors de toutes ces manipulations diverses.

Modifié par philae le 13/08/2005 21:36

a vrai dire je ne fais qu apprendre du mieux que je peux :) oui je connais adilelou ! c est mon ami ! j espere que ca ne te derange pas qu on ait consulté plusieurs forums encore merci pour tout