Bonjour,
D'habitude j'arrive à me débrouiller mais là pas vraiment... C'est purquoi je viens chercher votre aide. Mon PC est infecté par Trojan.DnsChanger et je n'arrive pas à m'en débarrasser. Je vous fait un copier-coller des différents logs que j'ai sortis :
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 13:28:44 06/04/2007
+ Résultat de l'analyse:
[1036] VM_00A40000 -> Trojan.DNSChanger.hg : Nettoyé.
[1672] VM_00A00000 -> Trojan.DNSChanger.hg : Nettoyé.
[1716] VM_00920000 -> Trojan.DNSChanger.hg : Nettoyé.
[1736] VM_00A40000 -> Trojan.DNSChanger.hg : Nettoyé.
[1740] VM_00930000 -> Trojan.DNSChanger.hg : Nettoyé.
[1780] VM_003D0000 -> Trojan.DNSChanger.hg : Nettoyé.
[1808] VM_00930000 -> Trojan.DNSChanger.hg : Nettoyé.
[252] VM_00900000 -> Trojan.DNSChanger.hg : Nettoyé.
[640] VM_00800000 -> Trojan.DNSChanger.hg : Nettoyé.
[916] VM_008A0000 -> Trojan.DNSChanger.hg : Nettoyé.
[944] VM_00DC0000 -> Trojan.DNSChanger.hg : Nettoyé.
[968] VM_00C50000 -> Trojan.DNSChanger.hg : Nettoyé.
Fin du rapport
----------------------------------------------------------------------------
BitDefender Online Scanner
Scan report generated at: Fri, Apr 06, 2007 - 14:39:39
Scan path: A:\;C:\;D:\;E:\;F:\;
Statistics
Time
00:59:49
Files
371759
Folders
3488
Boot Sectors
3
Archives
2072
Packed Files
39570
Results
Identified Viruses
0
Infected Files
0
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
0
Engines Info
Virus Definitions
417972
Engine build
AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)
Scan plugins
14
Archive plugins
38
Unpack plugins
6
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
No virus found.
---------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 14:43:17, on 06/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Pack Sécurité\Common\FSM32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Sécurité\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Pack Sécurité\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Sécurité\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Sécurité\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Sécurité\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\pack sécurité\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\pack sécurité\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\pack sécurité\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\pack sécurité\fsps\program\fslsp.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A7E97DB-6802-478F-B4E3-25AD31FA4716}: NameServer = 85.255.115.59,85.255.112.126
O17 - HKLM\System\CCS\Services\Tcpip\..\{41586ED6-D02E-474A-8BF8-47D54896EE3D}: NameServer = 85.255.115.59,85.255.112.126
O17 - HKLM\System\CCS\Services\Tcpip\..\{E54CE982-30EF-4A19-AEF7-19EB60B5C223}: NameServer = 85.255.115.59,85.255.112.126
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA9D2186-003E-41FB-A957-8DAA84D9CD22}: NameServer = 85.255.115.59,85.255.112.126
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126
O17 - HKLM\System\CS1\Services\Tcpip\..\{1A7E97DB-6802-478F-B4E3-25AD31FA4716}: NameServer = 85.255.115.59,85.255.112.126
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126
O17 - HKLM\System\CS2\Services\Tcpip\..\{1A7E97DB-6802-478F-B4E3-25AD31FA4716}: NameServer = 85.255.115.59,85.255.112.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
------------------------------------------------------------------------
La conf de mon PC est : Windows XP Pro SP2, I.E 6.0
Merci de bien vouloir m'aider à enfin me débarraser de cette horreur.
Lyac Configuration: Windows XP
Internet Explorer 6.0
