Slt, Voila depuis hier , le pc de mes enfants se met à ramer , à bloquer sur msn et des fenêtres dub non sollicitées apparaissent ici et là :
en mode sans echec j'ai fait :
-avg anti spyware où j'ai mis 2 objets trouvés en quarantaine.
-spybot qui m'a corrigé 28 objets sur les 30 (il en reste 2 objets nommés il me semble "messenger skimmer")
lancé jv16 tools vers free et viré tous les registres verts.
Atf cleaner et ccleaner qui ont tout supprimé les fichiers non indispensable .
Ensuite j'ai lancé hijackthis et vous verrez le rapport ci-dessous et navilog1 dont je joins aussi le rapport .
Maintenant j'attends vos conseils sur les procédures adéquates à adopter avec navilog1 et hijackthis .
Merci
HIJACKTHIS:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:37:14, on 22/12/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode
Running processes:
C:WINNTSystem32smss.exe
C:WINNTsystem32winlogon.exe
C:WINNTsystem32services.exe
C:WINNTsystem32lsass.exe
C:WINNTsystem32svchost.exe
C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
C:WINNTSystem32WBEMWinMgmt.exe
C:WINNTExplorer.EXE
F:HiJackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://home.sweetim.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:Program FilesMacrogamingSweetIMBarForIE oolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:PROGRA~1MACROG~1SWEETI~1 oolbar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6inssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINNTsystem32msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:Program FilesCanonEasy-WebPrintToolband.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:Program FilesMacrogamingSweetIMBarForIE oolbar.dll
O4 - HKLM..Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM..Run: [SiS Tray] C:WINNTSystem32sistray.EXE
O4 - HKLM..Run: [SiS KHooker] C:WINNTSystem32khooker.exe
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OB
ealsched.exe" -osboot
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [NeroFilterCheck] C:WINNTsystem32NeroCheck.exe
O4 - HKLM..Run: [InCD] C:Program FilesAheadInCDInCD.exe
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLink DVD SolutionPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [!AVG Anti-Spyware] "C:Program FilesGrisoftAVG Anti-Spyware 7.5avgas.exe" /minimized
O4 - HKLM..Run: [Easy-PrintToolBox] C:Program FilesCanonEasy-PrintToolBoxBJPSMAIN.EXE /logon
O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..Run: [SweetIM] C:Program FilesMacrogamingSweetIMSweetIM.exe
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..RunOnce: [SpybotDeletingA2586] command /c del "C:Program FilesMessengerSkinnerdownloaddefaultPack.cab"
O4 - HKLM..RunOnce: [SpybotDeletingC9431] cmd /c del "C:Program FilesMessengerSkinnerdownloaddefaultPack.cab"
O4 - HKLM..RunOnce: [SpybotDeletingA4114] command /c del "C:Program FilesMessengerSkinner
esourcesappconfig.xml"
O4 - HKLM..RunOnce: [SpybotDeletingC4126] cmd /c del "C:Program FilesMessengerSkinner
esourcesappconfig.xml"
O4 - HKLM..RunOnce: [SpybotDeletingA2262] command /c del "C:Program FilesMessengerSkinner
esourcestn.rgn"
O4 - HKLM..RunOnce: [SpybotDeletingC16] cmd /c del "C:Program FilesMessengerSkinner
esourcestn.rgn"
O4 - HKLM..RunOnce: [SpybotDeletingA6101] command /c del "C:Program FilesMessengerSkinner
esourcestnBnr.rgn"
O4 - HKLM..RunOnce: [SpybotDeletingC981] cmd /c del "C:Program FilesMessengerSkinner
esourcestnBnr.rgn"
O4 - HKLM..RunOnce: [SpybotDeletingA2351] command /c del "C:Program FilesMessengerSkinner
esourcestnIn.rgn"
O4 - HKLM..RunOnce: [SpybotDeletingC7380] cmd /c del "C:Program FilesMessengerSkinner
esourcestnIn.rgn"
O4 - HKLM..RunOnce: [SpybotDeletingA6125] command /c del "C:Program FilesMessengerSkinner
esourcestnInNormal.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingC491] cmd /c del "C:Program FilesMessengerSkinner
esourcestnInNormal.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingA7044] command /c del "C:Program FilesMessengerSkinner
esourcestnInOver.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingC6303] cmd /c del "C:Program FilesMessengerSkinner
esourcestnInOver.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingA8338] command /c del "C:Program FilesMessengerSkinner
esourcestnNormal.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingC9498] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormal.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingA3618] command /c del "C:Program FilesMessengerSkinner
esourcestnNormal.gif"
O4 - HKLM..RunOnce: [SpybotDeletingC4585] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormal.gif"
O4 - HKLM..RunOnce: [SpybotDeletingA6207] command /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingC3133] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingA2688] command /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.gif"
O4 - HKLM..RunOnce: [SpybotDeletingC8135] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.gif"
O4 - HKLM..RunOnce: [SpybotDeletingA6506] command /c del "C:Program FilesMessengerSkinner
esourcestnOver.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingC4242] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOver.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingA8672] command /c del "C:Program FilesMessengerSkinner
esourcestnOver.gif"
O4 - HKLM..RunOnce: [SpybotDeletingC1942] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOver.gif"
O4 - HKLM..RunOnce: [SpybotDeletingA2307] command /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingC5188] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.bmp"
O4 - HKLM..RunOnce: [SpybotDeletingA4911] command /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.gif"
O4 - HKLM..RunOnce: [SpybotDeletingC3993] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.gif"
O4 - HKLM..RunOnce: [SpybotDeletingA8843] command /c del "C:Program FilesMessengerSkinner
esourceslanguages_v2.xml"
O4 - HKLM..RunOnce: [SpybotDeletingC6088] cmd /c del "C:Program FilesMessengerSkinner
esourceslanguages_v2.xml"
O4 - HKLM..RunOnce: [SpybotSnD] "C:Program FilesSpybot - Search & DestroySpybotSD.exe" /autocheck
O4 - HKCU..Run: [SweetIM] C:Program FilesMacrogamingSweetIMSweetIM.exe
O4 - HKCU..Run: [messengerskinner] C:Program FilesMessengerSkinnerMessengerSkinner.exe
O4 - HKCU..Run: [isgki] "c:documents and settingsadministrateurlocal settingsapplication dataisgki.exe" isgki
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKCU..RunOnce: [SpybotDeletingB3305] command /c del "C:Program FilesMessengerSkinnerdownloaddefaultPack.cab"
O4 - HKCU..RunOnce: [SpybotDeletingD8303] cmd /c del "C:Program FilesMessengerSkinnerdownloaddefaultPack.cab"
O4 - HKCU..RunOnce: [SpybotDeletingB5886] command /c del "C:Program FilesMessengerSkinner
esourcesappconfig.xml"
O4 - HKCU..RunOnce: [SpybotDeletingD3665] cmd /c del "C:Program FilesMessengerSkinner
esourcesappconfig.xml"
O4 - HKCU..RunOnce: [SpybotDeletingB214] command /c del "C:Program FilesMessengerSkinner
esourcestn.rgn"
O4 - HKCU..RunOnce: [SpybotDeletingD5908] cmd /c del "C:Program FilesMessengerSkinner
esourcestn.rgn"
O4 - HKCU..RunOnce: [SpybotDeletingB2167] command /c del "C:Program FilesMessengerSkinner
esourcestnBnr.rgn"
O4 - HKCU..RunOnce: [SpybotDeletingD1278] cmd /c del "C:Program FilesMessengerSkinner
esourcestnBnr.rgn"
O4 - HKCU..RunOnce: [SpybotDeletingB9869] command /c del "C:Program FilesMessengerSkinner
esourcestnIn.rgn"
O4 - HKCU..RunOnce: [SpybotDeletingD8268] cmd /c del "C:Program FilesMessengerSkinner
esourcestnIn.rgn"
O4 - HKCU..RunOnce: [SpybotDeletingB1982] command /c del "C:Program FilesMessengerSkinner
esourcestnInNormal.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingD775] cmd /c del "C:Program FilesMessengerSkinner
esourcestnInNormal.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingB2825] command /c del "C:Program FilesMessengerSkinner
esourcestnInOver.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingD9580] cmd /c del "C:Program FilesMessengerSkinner
esourcestnInOver.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingB8704] command /c del "C:Program FilesMessengerSkinner
esourcestnNormal.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingD8285] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormal.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingB4810] command /c del "C:Program FilesMessengerSkinner
esourcestnNormal.gif"
O4 - HKCU..RunOnce: [SpybotDeletingD4234] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormal.gif"
O4 - HKCU..RunOnce: [SpybotDeletingB3352] command /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingD7884] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingB3954] command /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.gif"
O4 - HKCU..RunOnce: [SpybotDeletingD7879] cmd /c del "C:Program FilesMessengerSkinner
esourcestnNormalBnr.gif"
O4 - HKCU..RunOnce: [SpybotDeletingB153] command /c del "C:Program FilesMessengerSkinner
esourcestnOver.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingD9349] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOver.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingB7855] command /c del "C:Program FilesMessengerSkinner
esourcestnOver.gif"
O4 - HKCU..RunOnce: [SpybotDeletingD498] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOver.gif"
O4 - HKCU..RunOnce: [SpybotDeletingB9107] command /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingD4580] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.bmp"
O4 - HKCU..RunOnce: [SpybotDeletingB7079] command /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.gif"
O4 - HKCU..RunOnce: [SpybotDeletingD6747] cmd /c del "C:Program FilesMessengerSkinner
esourcestnOverBnr.gif"
O4 - HKCU..RunOnce: [SpybotDeletingB4407] command /c del "C:Program FilesMessengerSkinner
esourceslanguages_v2.xml"
O4 - HKCU..RunOnce: [SpybotDeletingD5059] cmd /c del "C:Program FilesMessengerSkinner
esourceslanguages_v2.xml"
O4 - HKUS.DEFAULT..Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS.DEFAULT..RunOnce: [^SetupICWDesktop] C:Program FilesInternet ExplorerConnection Wizardicwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: KODAK Software Updater.lnk = C:Program FilesKodakKODAK Software Updater7288971ProgramKodak Software Updater.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:Program FilesKodakKodak EasyShare softwareinEasyShare.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:Program FilesTRENDnetTEW-424UBWlanCU.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_Preview.html
O9 - Extra button: (no name) - SOFTWARE - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll
O12 - Plugin for .mpeg: C:Program FilesInternet ExplorerPLUGINS
pqtplugin3.dll
O12 - Plugin for .mpg: C:Program FilesInternet ExplorerPLUGINS
pqtplugin3.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1208784538986
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/in...l/installer.exe
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINNTsystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINNTsystem32ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:Program FilesGrisoftAVG Anti-Spyware 7.5guard.exe
O23 - Service: Boonty Games - BOONTY - C:Program FilesFichiers communsBOONTY SharedServiceBoonty.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:WINNTSystem32dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesFichiers communsInstallShieldDriver1150Intel 32IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:Program FilesAheadInCDInCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:Program FilesJavajre6injqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:WINNTsystem32driversKodakCCS.exe (file missing)
--
End of file - 15253 bytes
NAVILOG1:
** Recherche dossiers dans "c:docume~1alluse~1applic~1" ***
*** Recherche dossiers dans "C:Documents and SettingsAdministrateurapplic~1" ***
...MessengerSkinner trouvé !
*** Recherche dossiers dans "C:Documents and SettingsAdministrateurlocals~1applic~1" ***
*** Recherche dossiers dans "C:Documents and SettingsAdministrateurmenudm~1progra~1" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:WINNTsystem32" *
* Recherche dans "C:Documents and SettingsAdministrateurlocals~1applic~1" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!
HKEY_CURRENT_USERSoftwareLanconfig trouvé !
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"isgki"=""c:\documents and settings\administrateur\local settings\application data\isgki.exe" isgki"
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:WINNTsystem32" :
* Dans "C:Documents and SettingsAdministrateurlocals~1applic~1" :
isgki.exe trouvé !
isgki.dat trouvé !
isgki_nav.dat trouvé !
isgki_navps.dat trouvé !
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche autres dossiers et fichiers connus :
*** Analyse terminée le lun. 22/12/2008 à 14:51:15,75 ***