alpha antivirus

[Cynthia1506]

Bonjour, j'ai également un problème avec alpha antivirus qui s'est installer sur mon ordi.. d'aprés ce que j'ai compris, j'ai déja téléchargé hijack, je l'ai installé, je l'ai renommer "sniffle" et l'executer en cliquant sur "do a system scan and save a logfile".
Et voici le rapport qui en est sorti:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:42:27, on 30/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
F:WINDOWSSystem32smss.exe
F:WINDOWSsystem32csrss.exe
F:WINDOWSsystem32winlogon.exe
F:WINDOWSsystem32services.exe
F:WINDOWSsystem32lsass.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSSystem32svchost.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSExplorer.exe
F:WINDOWSsystem32spoolsv.exe
F:WINDOWSsystem32svchost.exe
F:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSsystem32DRIVERSCDANTSRV.EXE
F:Program FilesWindows LiveFamily Safetyfsssvc.exe
F:Program FilesJavajre6injqs.exe
F:Program FilesMioNetMioNetManager.exe
F:WINDOWSsystem32ctfmon.exe
F:Program FilesMicrosoftSearch Enhancement PackSeaPortSeaPort.exe
F:Program FilesMioNetjvminMioNet.exe
F:WINDOWSsystem32svchost.exe
F:WINDOWSSystem32alg.exe
F:WINDOWSsystem32wbemwmiapsrv.exe
F:WINDOWSSOUNDMAN.EXE
F:Program FilesHPHP Software UpdateHPWuSchd2.exe
F:Program FilesHPhpcoretechhpcmpmgr.exe
F:Program FilesPicasa2PicasaMediaDetector.exe
F:WINDOWSVM_STI.EXE
F:Program FilesWindows LiveFamily Safetyfsui.exe
F:WINDOWSsystem32 undll32.exe
F:Program FilesiTunesiTunesHelper.exe
F:Program FilesJavajre6injusched.exe
F:Program FilesIminentSearchTheWebIminent.Notifier.exe
F:WINDOWSsystem32CmWatch.exe
F:PROGRA~1MYWEBS~1ar1.binm3SrchMn.exe
F:PROGRA~1MYWEBS~1ar1.binmwsoemon.exe
F:Program FilesAlphaAVAlphaAV.exe
F:WINDOWSsystem32ctfmon.exe
F:Program FilesSuperCopier2SuperCopier2.exe
F:PROGRA~1NerodataXtrasmssysmgr.exe
F:Program FilesWindows LiveMessengerMsnMsgr.Exe
F:Program FilesDNAtdna.exe
F:Program FilesInternet ExplorerIEXPLORE.EXE
F:Program FilesSkypePhoneSkype.exe
F:Program FilesAresAres.exe
F:Documents and Settingsutilisateurvouux.exe
F:Program FilesInternet ExplorerIEXPLORE.EXE
F:Program FilesHPDigital Imaginginhpqtra08.exe
F:Program FilesPhilipsPhilips SPC210NC WebcamTrayMin210.exe
F:Documents and SettingsutilisateurApplication DataMicrosoftLive SearchNotification-LiveSearch.exe
F:Program FilesOpenOffice.org 3programsoffice.exe
F:Documents and SettingsutilisateurApplication DataMicrosoftLive SearchMise-a-jour-LiveSearch.exe
F:Program FilesOpenOffice.org 3programsoffice.bin
F:Program FilesHPDigital Imaginginhpqgalry.exe
F:Program FilesiPodiniPodService.exe
F:WINDOWSsystem32wuauclt.exe
F:Program FilesWindows LiveToolbarwltuser.exe
F:DOCUME~1UTILIS~1LOCALS~1Temp.exe
F:Documents and SettingsutilisateurBureauSniffle.exe
F:WINDOWSsystem32wbemwmiprvse.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://mystart.hiyo.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - F:Program FilesMyWebSearchar1.binMWSSRCAS.DLL
F2 - REG:system.ini: Shell=Explorer.exe F:WINDOWSsystem32WinSit.exe
F3 - REG:win.ini: load=F:WINDOWSinfOther.exe
F3 - REG:win.ini: run=F:WINDOWSsystem32configWin.exe
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - F:Program FilesMyWebSearchar1.binMWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - F:Program FilesMyWebSearchar1.binMWSBAR.DLL
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - F:Program FilesSkypeToolbarsInternet ExplorerSkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - F:Program FilesAVGAVG8avgssie.dll (file missing)
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - F:Program FilesWindows LiveFamily Safetyfssbho.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - F:WINDOWSsystem32msxml71.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - F:Program FilesMicrosoftSearch Enhancement PackSearch HelperSEPsearchhelperie.dll
O2 - BHO: CHelperBHO - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - F:Program FilesIminentSearchTheWebIminent.BHO.NavigationError.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:Program FilesGoogleGoogleToolbarNotifier5.2.4204.1700swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - F:Program FilesGoogleGoogle ToolbarComponentfastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:Program FilesJavajre6injp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - F:Program FilesWindows LiveToolbarwltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - F:Program FilesWindows LiveToolbarwltcore.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - F:Program FilesMyWebSearchar1.binMWSBAR.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [HP Software Update] "F:Program FilesHPHP Software UpdateHPWuSchd2.exe"
O4 - HKLM..Run: [HP Component Manager] "F:Program FilesHPhpcoretechhpcmpmgr.exe"
O4 - HKLM..Run: [NeroFilterCheck] F:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [Picasa Media Detector] F:Program FilesPicasa2PicasaMediaDetector.exe
O4 - HKLM..Run: [BigDogPath] F:WINDOWSVM_STI.EXE Philips SPC210NC Webcam
O4 - HKLM..Run: [fssui] "F:Program FilesWindows LiveFamily Safetyfsui.exe" -autorun
O4 - HKLM..Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM..Run: [QuickTime Task] "F:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "F:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] "F:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [IMBooster] F:Program FilesIminentIMBoosterimbooster.exe /warmup
O4 - HKLM..Run: [Iminent.Notifier] F:Program FilesIminentSearchTheWebIminent.Notifier.exe
O4 - HKLM..Run: [CmCardRun] F:WINDOWSsystem32CmWatch.exe
O4 - HKLM..Run: [MyWebSearch Plugin] rundll32 F:PROGRA~1MYWEBS~1ar1.binM3PLUGIN.DLL,UPF
O4 - HKLM..Run: [My Web Search Bar Search Scope Monitor] "F:PROGRA~1MYWEBS~1ar1.binm3SrchMn.exe" /m=2 /w /h
O4 - HKLM..Run: [MyWebSearch Email Plugin] F:PROGRA~1MYWEBS~1ar1.binmwsoemon.exe
O4 - HKLM..Run: [Hiyo] F:Program FilesHiYoinHiYo.exe /RunFromStartup
O4 - HKLM..Run: [meet great active lies] F:Documents and SettingsAll UsersApplication Datasoft chic meet greatBurn list.exe
O4 - HKLM..Run: [AlphaAV] F:Program FilesAlphaAVAlphaAV.exe
O4 - HKLM..Run: [MSDRV] NetFilter.exe
O4 - HKCU..Run: [CTFMON.EXE] F:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [SuperCopier2.exe] F:Program FilesSuperCopier2SuperCopier2.exe
O4 - HKCU..Run: [dc2k5] F:WINDOWSSVIQ.EXE
O4 - HKCU..Run: [Fun] F:WINDOWSsystemFun.exe
O4 - HKCU..Run: [dc] F:WINDOWSdc.exe
O4 - HKCU..Run: [PhotoShow Deluxe Media Manager] F:PROGRA~1NerodataXtrasmssysmgr.exe
O4 - HKCU..Run: [MsnMsgr] "F:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [BitTorrent DNA] "F:Program FilesDNAtdna.exe"
O4 - HKCU..Run: [Skype] "F:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [swg] F:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [ares] "F:Program FilesAresAres.exe" -h
O4 - HKCU..Run: [MyWebSearch Email Plugin] F:PROGRA~1MYWEBS~1ar1.binmwsoemon.exe
O4 - HKCU..Run: [insideremote] F:DOCUME~1UTILIS~1APPLIC~1AxisDupeaxis grim.exe
O4 - HKCU..Run: [utilisateur] F:Documents and Settingsutilisateurutilisateur.exe
O4 - HKCU..Run: [vouux] F:Documents and Settingsutilisateurvouux.exe
O4 - HKCU..Run: [PopRock] F:DOCUME~1UTILIS~1LOCALS~1Temp.exe
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] F:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] F:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] F:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] F:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = F:Program FilesOpenOffice.org 3programquickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = F:Documents and SettingsutilisateurApplication DataMicrosoftLive SearchNotification-LiveSearch.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = F:Program FilesHPDigital Imaginginhpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = F:Program FilesHPDigital Imaginginhpqthb08.exe
O4 - Global Startup: TrayMin210.exe.lnk = F:Program FilesPhilipsPhilips SPC210NC WebcamTrayMin210.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... YYYYYYYYNC
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://F:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - F:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - F:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - F:Program FilesSkypeToolbarsInternet ExplorerSkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:Program FilesMessengermsmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... .0.1.1.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - F:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - F:Program FilesAreschatServer.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - F:WINDOWSsystem32DRIVERSCDANTSRV.EXE
O23 - Service: Google Software Updater (gusvc) - Google - F:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - F:Program FilesiPodiniPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:Program FilesJavajre6injqs.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - F:Program FilesMioNetMioNetManager.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - F:PROGRA~1MYWEBS~1ar1.binmwssvc.exe
O23 - Service: Pml Driver HPZ12 - HP - F:WINDOWSsystem32HPZipm12.exe

--
End of file - 12798 bytes


Voila.. serait-il possible de m'aider..
Merci

[Pac428]

Bonsoir et bienvenue Cynthia

... c'est un Arbre de Noël, là dedans ...

Relance HijackThis > Do a system scan only et coche les cases devant toutes ces lignes :

Code: Tout sélectionner

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} -
F:Program FilesMyWebSearchar1.binMWSSRCAS.DLL

F3 - REG:win.ini: load=F:WINDOWSinfOther.exe

F3 - REG:win.ini: run=F:WINDOWSsystem32configWin.exe

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} -
F:Program FilesMyWebSearchar1.binMWSSRCAS.DLL

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} -
F:Program FilesMyWebSearchar1.binMWSBAR.DLL

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -
F:Program FilesAVGAVG8avgssie.dll (file missing)

O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} -
F:WINDOWSsystem32msxml71.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: CHelperBHO - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - F:Program FilesIminentSearchTheWebIminent.BHO.NavigationError.dll

O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} -
F:Program FilesMyWebSearchar1.binMWSBAR.DLL

O4 - HKLM..Run: [IMBooster] F:Program FilesIminentIMBoosterimbooster.exe /warmup

O4 - HKLM..Run: [Iminent.Notifier] F:Program FilesIminentSearchTheWebIminent.Notifier.exe

O4 - HKLM..Run: [MyWebSearch Plugin] rundll32 F:PROGRA~1MYWEBS~1ar1.binM3PLUGIN.DLL,UPF

O4 - HKLM..Run: [My Web Search Bar Search Scope Monitor]
"F:PROGRA~1MYWEBS~1ar1.binm3SrchMn.exe" /m=2 /w /h

O4 - HKLM..Run: [MyWebSearch Email Plugin] F:PROGRA~1MYWEBS~1ar1.binmwsoemon.exe

O4 - HKLM..Run: [Hiyo] F:Program FilesHiYoinHiYo.exe /RunFromStartup

O4 - HKLM..Run: [meet great active lies] F:Documents and
SettingsAll UsersApplication Datasoft chic meet greatBurn list.exe

O4 - HKLM..Run: [AlphaAV] F:Program FilesAlphaAVAlphaAV.exe

O4 - HKLM..Run: [MSDRV] NetFilter.exe

O4 - HKCU..Run: [MyWebSearch Email Plugin] F:PROGRA~1MYWEBS~1ar1.binmwsoemon.exe

O8 - Extra context menu item: &Search -
http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCYYYYYYYYNC

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/CursorManiaInitialS etup1.0.1.1.cab

O23 - Service: My Web Search Service (MyWebSearchService) -
MyWebSearch.com - F:PROGRA~1MYWEBS~1ar1.binmwssvc.exe


Clique sur le bouton Fix Checked > Valide par OUI > Referme toutes les fenêtres et redémarre ton PC

Ensuite, fais tourner MBAM en suivant > ce tuto < si besoin
et poste nous le rapport généré stp.
(Le scan MBAM, il y en a pour une grosse heure, belle nuit quand-même.)

Bon travail et ++

[danakil]

Salut à tous !

Première lecture du rapport HijackThis qui est mal placé sur le PC (ce n'est pas le plus urgent).
Liste des infections :

Infection RootKit Navipromo
Infection W32.Imaut.AS
Infection SmitFraud
Infection SD
Infection LOP
Infection CoiDung-A.Worm
Infection BT

Aprés le passage de Mbam et si Pac428 m'y autorise je prendrai en compte la désinfection de ce PC.
Si feu vert de sa part, je te donnerai des solutions et procédure à respecter. Surveille également ta Messagerie Personnelle sur ce Forum car tu devras effectuer certaines manipulations du PC que je ne voudrais pas voir afficher sur la toile.

[Cynthia1506]

merci encore de m'avoir aidé.

alor j'ai télécharger également "Malwarebytes", je l'ai executé et des que je devais supprimer toute la selection, un message d'erreur s'est afficher en disant que "Malwarebytes a rencontré certaines erreur et doit donc fermer". J'ai fais cette manipulation 3 fois de suite et le meme message s'affiche toujours au même moment.

Merci de bien vouloir m'aider.

[danakil]

J'attends le feu vert de Pac428 pour lancer les procédures qu'il voudrait peut-être effectuer lui même en dehors de son boulot de Modérateur.
Consulte ta MP ...

[Cynthia1506]

ok d'accord, j'attend... merci beaucoup.

[Pac428]

Bonjour

Que d'assauts de politesse ...

Moi j'attends surtout le rapport MBAM pour une réponse à la question
posée par l'ordinateur de Cynthia ...

A partir de là, tu es toujours le bienvenu Danakil.

Ici on joue collectif et ++