pc virusé

[hollister]

Salut,
J'ai un probleme de page pub qui apparait sur mon ordi.De plus ces pages pub s'adaptent au site que je visites,par exemple pour ce forum je vient de recevoir de la pub pour les pc.Pouvez vous m'aidez svp...
J'ai fait un rapport hijackthis le voici:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:26:07, on 16/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:WINDOWSSystem32smss.exe
D:WINDOWSsystem32csrss.exe
D:WINDOWSsystem32winlogon.exe
D:WINDOWSsystem32services.exe
D:WINDOWSsystem32lsass.exe
D:WINDOWSsystem32Ati2evxx.exe
D:WINDOWSsystem32svchost.exe
D:WINDOWSsystem32svchost.exe
D:WINDOWSSystem32svchost.exe
D:WINDOWSsystem32Ati2evxx.exe
D:WINDOWSsystem32svchost.exe
D:WINDOWSsystem32svchost.exe
D:WINDOWSsystem32svchost.exe
D:WINDOWSSystem32iscsiexe.exe
D:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
D:Program FilesAlwil SoftwareAvast4ashServ.exe
D:WINDOWSExplorer.EXE
D:WINDOWSsystem32spoolsv.exe
D:WINDOWSsystem32svchost.exe
D:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
D:Program FilesBonjourmDNSResponder.exe
D:WINDOWSsystem32PnkBstrA.exe
D:Program FilesSpyware DoctorpctsAuxs.exe
D:Program FilesSpyware DoctorpctsSvc.exe
D:WINDOWSsystem32svchost.exe
D:Program FilesAxBxVirusKeeper 2009 Pro Evaluationvk_service.exe
D:Program FilesSpyware DoctorpctsTray.exe
D:WINDOWSsystem32SearchIndexer.exe
D:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
D:Program FilesAlwil SoftwareAvast4ashWebSv.exe
D:WINDOWSSystem32alg.exe
D:WINDOWSSOUNDMAN.EXE
D:Program FilesAxBxVirusKeeper 2009 Pro EvaluationVirusKeeper.exe
D:Program FilesiTunesiTunesHelper.exe
D:PROGRA~1ALWILS~1Avast4ashDisp.exe
D:WINDOWSsystem32ctfmon.exe
D:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
D:documents and settingsstef.pakardbe-c6f185local settingsapplication datahxpazrcb.exe
D:Program FilesMessengermsmsgs.exe
D:Program FilesWindows Desktop SearchWindowsSearch.exe
D:Program FilesInternet Exploreriexplore.exe
D:Program FilesiPodiniPodService.exe
D:Program FilesInternet Exploreriexplore.exe
D:Program FilesAxBxVirusKeeper 2009 Pro Evaluationvk_watchop.exe
D:WINDOWSsystem32wuauclt.exe
D:Program FilesTrend MicroHijackThisHijackThis.exe
D:WINDOWSsystem32wbemwmiprvse.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://recherche.neuf.fr/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://fr.msn.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:Program FilesFichiers communsAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:Program FilesGoogleGoogleToolbarNotifier5.1.1309.15642swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - D:Program FilesGoogleGoogle ToolbarComponentfastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [VirusKeeper] D:Program FilesAxBxVirusKeeper 2009 Pro EvaluationVirusKeeper.exe
O4 - HKLM..Run: [QuickTime Task] "D:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "D:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [avast!] D:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [ISTray] "D:Program FilesSpyware DoctorpctsTray.exe"
O4 - HKCU..Run: [CTFMON.EXE] D:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [swg] D:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [hxpazrcb] "d:documents and settingsstef.pakardbe-c6f185local settingsapplication datahxpazrcb.exe" hxpazrcb
O4 - HKCU..Run: [MSMSGS] "D:Program FilesMessengermsmsgs.exe" /background
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] D:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] D:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] D:WINDOWSsystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] D:WINDOWSsystem32CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:Program FilesAdobeReader 8.0ReaderAdobeCollabSync.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:Program FilesAdobeReader 8.0Reader eader_sl.exe
O4 - Global Startup: Windows Search.lnk = D:Program FilesWindows Desktop SearchWindowsSearch.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:WINDOWSNetwork Diagnosticxpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - D:Program FilesPokerStars.NETPokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:Program FilesMessengermsmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 3870767171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3870859828
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwarede ... _1_2_0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLMSystemCCSServicesTcpip..{6FEDD117-66EC-43B6-9E36-5358582921EF}: NameServer = 86.64.145.144 84.103.237.144
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - D:Program FilesGoogleGoogle ToolbarComponentfastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - D:Program FilesFichiers communsAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:WINDOWSsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:WINDOWSsystem32ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:Program FilesBonjourmDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:Program FilesiPodiniPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - D:Program Filesma-config.commaconfservice.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - D:WINDOWSsystem32GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - D:WINDOWSsystem32PnkBstrA.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - D:Program FilesSiSoftwareSiSoftware Sandra Lite 2009.SP2RpcAgentSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:Program FilesSpyware DoctorpctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:Program FilesSpyware DoctorpctsSvc.exe
O23 - Service: VirusKeeper antivirus/antispyware (vkservice) - AxBx - D:Program FilesAxBxVirusKeeper 2009 Pro Evaluationvk_service.exe

--
End of file - 9146 bytes
merci de votre aide....

[Pac428]

Bonjour et bienvenue Hollister

Ton log HijackThis est propre.
Par contre tu devrais virer VirusKeeper 2009 Pro
et même Spyware Doctor

J'aimerais bien que tu lances un scan MBAM en suivant
le tuto => ICI <= et que tu nous postes le rapport.

++

[hollister]

Merci Pac428 pour ton aide,j'ai bien enlevé virus keeper et doctor spywear et voici donc le resultat de l'analyse que tu m'a demandé en te remerciant une fois de plus:

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2635
Windows 5.1.2600 Service Pack 3

16/08/2009 21:12:39
mbam-log-2009-08-16 (21-12-39).txt

Type de recherche: Examen complet (C:|D:|E:|F:|G:|H:|I:|)
Eléments examinés: 316677
Temps écoulé: 2 hour(s), 12 minute(s), 23 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 15
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
D:documents and settingsstef.pakardbe-c6f185local settingsapplication datahxpazrcb.exe (Adware.Navipromo.H) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsinstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREfcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunhxpazrcb (Adware.Navipromo.H) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
D:Documents and SettingsaurelieApplication DataAVSystemCare (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataAVSystemCareLogs (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingscocoApplication DataAVSystemCare (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingscocoApplication DataAVSystemCareLogs (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataFunWebProducts (Adware.MyWay) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataFunWebProductsData (Adware.MyWay) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataFunWebProductsDataaurelie (Adware.MyWay) -> Quarantined and deleted successfully.
D:Documents and SettingsAll UsersApplication DataSalesMonitor (Rogue.Multiple) -> Quarantined and deleted successfully.
D:Documents and SettingsAll UsersApplication DataSalesMonitorData (Rogue.Multiple) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcsdb (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcsdwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcs eport (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcs es1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
D:Documents and SettingsliliroseLocal SettingsApplication Datagecoq_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and SettingsliliroseLocal SettingsApplication Datagecoq_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and SettingsliliroseLocal SettingsApplication Datagecoq.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and SettingsliliroseLocal SettingsApplication Datagecoq.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and Settingsstef.PAKARDBE-C6F185Local SettingsApplication Datahxpazrcb_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and Settingsstef.PAKARDBE-C6F185Local SettingsApplication Datahxpazrcb_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and Settingsstef.PAKARDBE-C6F185Local SettingsApplication Datahxpazrcb.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and Settingsstef.PAKARDBE-C6F185Local SettingsApplication Datahxpazrcb.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataAVSystemCareLogsav.log (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingscocoApplication DataAVSystemCareavtasks.dat (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingscocoApplication DataAVSystemCareLogsav.log (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingscocoApplication DataAVSystemCareLogsga6Support.log (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingscocoApplication DataAVSystemCareLogsupdate.log (Rogue.AVSystemcare) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataFunWebProductsDataaurelieavatar.dat (Adware.MyWay) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcsConfig.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcsdbAliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcsdbSites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcsdwldWhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcs eportaggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcs eportsend_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieApplication DataShoppingReportcs es1WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.
D:Documents and SettingsaurelieBureauOnline Security Guide.lnk (Rogue.Link) -> Quarantined and deleted successfully.
D:Documents and SettingscocoBureauOnline Security Guide.lnk (Rogue.Link) -> Quarantined and deleted successfully.
D:install.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:Documents and SettingsAll UsersMenu DémarrerOnline Security Guide.lnk (Rogue.Link) -> Quarantined and deleted successfully.

[Pac428]

Parfait ! j'avais "un peu loupé" le hx xxx.exe dans ton log,
mais MBAM ne l'a pas loupé, lui.
Es-tu sûr que le rapport est complet de chez complet ?
Pourrais tu refaire tourner MBAM un coup pour être sûr
qu'il ne trouve plus rien ? Garde-le pour des scans réguliers.
Tu pourrais également installer > SpywareBlaster <
pour augmenter la protection en temps réel de ton antivirus.
++ Hollister et bon surf.

[hollister]

Salut Pac428,
Voici mon dernier rapport et sache que je n'est plus de pub sur mon ordi c'est géant!Je te remercie sincerement et te souhaite une bonne continuation a toi...A+ Pac428

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2635
Windows 5.1.2600 Service Pack 3

17/08/2009 11:33:26
mbam-log-2009-08-17 (11-33-25).txt

Type de recherche: Examen complet (C:|D:|E:|F:|G:|H:|I:|)
Eléments examinés: 317028
Temps écoulé: 1 hour(s), 31 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

[Pac428]

Merci Hollister
? tu as un bon pare-feu ? ( genre Zone-Alarm)
Bon surf et ++