Pblm avec le processeur NTDM et p2esocks!Résolu/Fermé

Question

salut ! j'ai un problème lors du démarrage de mon pc les messages d'erreurs: - "C:\WINDOWS\system32\WMRRS.EXE Le processeur NTDM a rencontré une instruction non autorisée.CS:06e8 IP0100 op:ff fe 3c 00 48 Choisissez fermer pour mettre fin a l'application"              et: - "erreur de chargement de p2esocks_1046.dll  Le module spécifié est introuvable." s'affiche est ce que c'est grave et comment régler le problème. Merci d'avance pour vos réponses d'experts!!!

boulepate · Answer

Salut,processus non connu?! ..hummtélécharge hijackthis: http://www.hijackthis.de/downloads/hijackthis_199.zip Installe le dans son propre dossier:Par exemple C:\hijackthis Lance le, clique sur "do a system scan and save logfile" Puis copie et colle le rapport ici.

Bekinz · Answer

Merci pour ta rapidité de réponse Boulepate, voilà mon log:Logfile of HijackThis v1.99.1Scan saved at 15:02:21, on 27/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\fswsclds.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXEC:\Program Files\D-Tools\daemon.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\program files\mailskinner\mailskinner.exeC:\Program Files\Nikon\NkView6\NkvMon.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: XBTB07697 - {3C6825DC-F3DD-4666-8597-4FDF0D0A0143} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLLO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLLO3 - Toolbar: Solucevir Toolbar - {86B676AA-2483-411B-B088-EF1ED833FF12} - C:\Program Files\Solucevir Toolbar\solucevir.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -localO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exeO4 - HKLM\..\Run: [WMCRRS] C:\WINDOWS\system32\WMCRRS.EXEO4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Emule_Init] C:\Program Files\emule\share.exeO4 - HKCU\..\Run: [MailSkinner] c:\program files\mailskinner\mailskinner.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1046.dll,InstantAccessO4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm338YYFRO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htmO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CABO16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_FR_XP.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {511F9316-771B-4953-A268-1C36DA667FE9} - http://ip.sponsoradulto.com/cab/3/fr/SysWebTelecomInt.cabO16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} (Driver_Detective_v43_Non_Member.DD_v43) - http://www.drivershq.com/cab/prod/Driver_Detective_v43_Non_Member.CABO16 - DPF: {8B3B8135-9DAA-40E7-8941-962795F9C1CB} - http://scripts.downloadv3.com/binaries/IA/syswbsvc32_FR_XP.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.extrafilm.fr/import/ImageUploader3.cabO16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/sysinetsvc32_FR_XP.cabO16 - DPF: {BA14D944-0D8C-4F16-A950-6E53EEBB558F} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1040_FR_XP.cabO16 - DPF: {C6760A07-A574-4705-B113-7856315922C3} - http://akamai.downloadv3.com/binaries/IA/sysnetsvc32_FR_XP.cabO16 - DPF: {D8B94E9A-A34B-4253-BF48-C7CB7F2CFDB0} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1046_FR_XP.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{4DEE3B75-B798-414A-A6B1-BB3C34FACDC5}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeO23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tuser.exe (file missing)O23 - Service: NTLOAD - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tsrv.exe (file missing)O23 - Service: NTSVCMGR - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tsrv.exe (file missing)

Bekinz · Answer

merci pour ce ptit logiciel je scanne et je vous tiens au courrant!

Bekinz · Answer

ewido anti-malware - Rapport de scan--------------------------------------------------------- + Créé le:		15:36:13, 27/01/2006 + Somme de contrôle:	E6615A32 + Résultats du scan:	HKLM\SOFTWARE\Classes\CLSID\{31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} -> Dialer.Generic : Nettoyer et sauvegarder	HKLM\SOFTWARE\Classes\Interface\{9DD19D39-2CDC-465B-BB21-1D433590BA3D} -> Spyware.HotBar : Nettoyer et sauvegarder	HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} -> Dialer.Generic : Nettoyer et sauvegarder	HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{511F9316-771B-4953-A268-1C36DA667FE9} -> Dialer.Generic : Nettoyer et sauvegarder	[700] VM_01391000 -> Adware.NaviPromo : Erreur durant le nettoyage	[728] VM_01321000 -> Adware.NaviPromo : Erreur durant le nettoyage	[772] VM_00051000 -> Adware.NaviPromo : Erreur durant le nettoyage	[784] VM_00AF1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[928] VM_00C41000 -> Adware.NaviPromo : Erreur durant le nettoyage	[940] VM_006B1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1012] C:\WINDOWS\system32\msclock32.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	[1048] VM_02051000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1096] C:\WINDOWS\system32\msplock32.dll -> Adware.NaviPromo : Nettoyer et sauvegarder	[1172] C:\WINDOWS\system32\msplock32.dll -> Adware.NaviPromo : Erreur durant le nettoyage	[1436] VM_00DD1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1544] VM_008D1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1580] VM_00621000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1616] VM_00621000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1632] VM_00A21000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1656] VM_00821000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1736] VM_006B1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1808] VM_00E21000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1896] VM_00851000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1992] C:\WINDOWS\system32\msplock32.dll -> Adware.NaviPromo : Erreur durant le nettoyage	[540] VM_01651000 -> Adware.NaviPromo : Erreur durant le nettoyage	[820] VM_00711000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1356] VM_00751000 -> Adware.NaviPromo : Erreur durant le nettoyage	[2084] VM_00D41000 -> Adware.NaviPromo : Erreur durant le nettoyage	[2172] C:\WINDOWS\system32\msplock32.dll -> Adware.NaviPromo : Erreur durant le nettoyage	[2196] VM_00DD1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[3916] VM_00B31000 -> Adware.NaviPromo : Erreur durant le nettoyage	[2632] VM_00A81000 -> Adware.NaviPromo : Erreur durant le nettoyage	[2248] VM_00EA1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1368] VM_00961000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1072] VM_00B51000 -> Adware.NaviPromo : Erreur durant le nettoyage	[3048] VM_00D11000 -> Adware.NaviPromo : Erreur durant le nettoyage	[3052] VM_01D61000 -> Adware.NaviPromo : Erreur durant le nettoyage	[4020] VM_003E1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1452] VM_00F81000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1680] VM_00961000 -> Adware.NaviPromo : Erreur durant le nettoyage	[3264] VM_00B81000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1784] VM_009F1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[3792] VM_009E1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[1968] VM_00C21000 -> Adware.NaviPromo : Erreur durant le nettoyage	[3080] VM_01F21000 -> Adware.NaviPromo : Erreur durant le nettoyage	[332] VM_00D61000 -> Adware.NaviPromo : Erreur durant le nettoyage	[2832] VM_00C81000 -> Adware.NaviPromo : Erreur durant le nettoyage	[3928] VM_015B1000 -> Adware.NaviPromo : Erreur durant le nettoyage	[2820] C:\Program Files\Solucevir Toolbar\solucevir.dll -> Spyware.Softomate : Erreur durant le nettoyage	C:\Documents and Settings\delage\Cookies\delage@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Nettoyer et sauvegarder	C:\Documents and Settings\delage\Cookies\delage@casinotropez[1].txt -> Spyware.Cookie.Casinotropez : Nettoyer et sauvegarder	C:\Documents and Settings\delage\Cookies\delage@estat[1].txt -> Spyware.Cookie.Estat : Nettoyer et sauvegarder	C:\Documents and Settings\delage\Cookies\delage@tradedoubler[2].txt -> Spyware.Cookie.Tradedoubler : Nettoyer et sauvegarder	C:\Documents and Settings\delage\Cookies\delage@weborama[1].txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder	C:\Documents and Settings\delage\Cookies\delage@wreport.weborama[1].txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder	C:\Documents and Settings\delage\Cookies\delage@www.casinotropez[2].txt -> Spyware.Cookie.Casinotropez : Nettoyer et sauvegarder	C:\Documents and Settings\delage\Cookies\delage@www.smartadserver[2].txt -> Spyware.Cookie.Smartadserver : Nettoyer et sauvegarder	C:\Program Files\Solucevir Toolbar\__delete_on_reboot__solucevir.dll -> Spyware.Softomate : Nettoyer et sauvegarder	C:\WINDOWS\system32\drivers\erssdd.sys -> Trojan.Rootkit.Agent.af : Nettoyer et sauvegarder	C:\WINDOWS\system32\sysinetsvc32.dll -> Dialer.Generic : Nettoyer et sauvegarder	C:\WINDOWS\system32\sysnetsvc32.dll -> Dialer.Generic : Nettoyer et sauvegarder::Fin du rapport

Bekinz · Answer

Logfile of HijackThis v1.99.1Scan saved at 15:41:36, on 27/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\fswsclds.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXEC:\Program Files\D-Tools\daemon.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\windows\system32\hknxqabuo.exeC:\WINDOWS\system32\ctfmon.exeC:\program files\mailskinner\mailskinner.exeC:\Program Files\Nikon\NkView6\NkvMon.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: XBTB07697 - {3C6825DC-F3DD-4666-8597-4FDF0D0A0143} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLL (file missing)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLL (file missing)O3 - Toolbar: Solucevir Toolbar - {86B676AA-2483-411B-B088-EF1ED833FF12} - C:\Program Files\Solucevir Toolbar\solucevir.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -localO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exeO4 - HKLM\..\Run: [WMCRRS] C:\WINDOWS\system32\WMCRRS.EXEO4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [hknxqabuo] c:\windows\system32\hknxqabuo.exe hknxqabuoO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Emule_Init] C:\Program Files\emule\share.exeO4 - HKCU\..\Run: [MailSkinner] c:\program files\mailskinner\mailskinner.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1046.dll,InstantAccessO4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm338YYFRO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htmO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CABO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} (Driver_Detective_v43_Non_Member.DD_v43) - http://www.drivershq.com/cab/prod/Driver_Detective_v43_Non_Member.CABO16 - DPF: {8B3B8135-9DAA-40E7-8941-962795F9C1CB} - http://scripts.downloadv3.com/binaries/IA/syswbsvc32_FR_XP.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.extrafilm.fr/import/ImageUploader3.cabO16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/sysinetsvc32_FR_XP.cabO16 - DPF: {BA14D944-0D8C-4F16-A950-6E53EEBB558F} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1040_FR_XP.cabO16 - DPF: {C6760A07-A574-4705-B113-7856315922C3} - http://akamai.downloadv3.com/binaries/IA/sysnetsvc32_FR_XP.cabO16 - DPF: {D8B94E9A-A34B-4253-BF48-C7CB7F2CFDB0} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1046_FR_XP.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{4DEE3B75-B798-414A-A6B1-BB3C34FACDC5}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeO23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tuser.exe (file missing)O23 - Service: NTLOAD - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tsrv.exe (file missing)O23 - Service: NTSVCMGR - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tsrv.exe (file missing)

Bekinz · Answer

ok merci je vais essayé!

Bekinz · Answer

j'ai tout fait comme tu ml'avais dit mais je n'arrive pas à trouver les fichiers (ntuser.exe et ntsrv.exe) et le fichier (WMCRRS.EXE) je l'ai trouvé mais je n'arrive pas a le supprimer çà me marque "Impossible de supprimerWMCRRS: cette ressource est utilisée par une autre personne ou un autre programme" je t'envoi quand même le rapport hijackthis:Logfile of HijackThis v1.99.1Scan saved at 17:48:25, on 27/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\fswsclds.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXEC:\Program Files\D-Tools\daemon.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\windows\system32\hknxqabuo.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\WINDOWS\system32\ctfmon.exeC:\program files\mailskinner\mailskinner.exeC:\Program Files\Nikon\NkView6\NkvMon.exeC:\Hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dllO2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLL (file missing)O3 - Toolbar: Solucevir Toolbar - {86B676AA-2483-411B-B088-EF1ED833FF12} - C:\Program Files\Solucevir Toolbar\solucevir.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -localO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exeO4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [hknxqabuo] c:\windows\system32\hknxqabuo.exe hknxqabuoO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Emule_Init] C:\Program Files\emule\share.exeO4 - HKCU\..\Run: [MailSkinner] c:\program files\mailskinner\mailskinner.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1046.dll,InstantAccessO4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm338YYFRO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.htmlO8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htmO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar3.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeO23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

Kristopher · Answer

Hello :)Fais ceci: Affiche tous les fichiers et dossiers : Clique sur démarrer, panneau de configuration, outil, option des dossiers, affichage Coche: afficher les fichiers et dossiers cachés Décoche la case: -masquer les fichiers protégés du système d'exploitation (recommandé) -masquer les extensions dont le type est connu Appliquer, puis ok

Bekinz · Answer

Merci Kristopher ! j'ai réussi a les éffacés ( je pense et je l'espère...) je te remet un rapport hijackthis:Logfile of HijackThis v1.99.1Scan saved at 19:07:19, on 27/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\fswsclds.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\windows\system32\hknxqabuo.exeC:\WINDOWS\system32\ctfmon.exeC:\program files\mailskinner\mailskinner.exeC:\Program Files\Nikon\NkView6\NkvMon.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dllO2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLL (file missing)O3 - Toolbar: Solucevir Toolbar - {86B676AA-2483-411B-B088-EF1ED833FF12} - C:\Program Files\Solucevir Toolbar\solucevir.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -localO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exeO4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [hknxqabuo] c:\windows\system32\hknxqabuo.exe hknxqabuoO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Emule_Init] C:\Program Files\emule\share.exeO4 - HKCU\..\Run: [MailSkinner] c:\program files\mailskinner\mailskinner.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1046.dll,InstantAccessO4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm338YYFRO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.htmlO8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htmO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar3.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O17 - HKLM\System\CCS\Services\Tcpip\..\{4DEE3B75-B798-414A-A6B1-BB3C34FACDC5}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeO23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeAu fait mes logiciels anti spyware sont: Ad-Aware SE Personnal, Spybot - Search & Destroy et donc ewido anti-malware.

Kristopher · Answer

Hello :)Oui, il semblerait que les fichiers cités plus haut ont bien disparus.Néanmoins, tu es toujours très infecté :- Scannes ton PC avec cet antivirus en ligne : http://www.pandasoftware.com/activescan/fr/activescan_principal.htm Copie/colle le rapport sur le forum.Aller, je te souhaite bonne chance :)++

Bekinz · Answer

Merci beaucoup les manips ont résolu un de mes pblms mais j'ai toujours le mess d'erreur "erreur de chargement de p2esocks_1046.dll le module spécifié est introuvable."

boulepate · Answer

c'est une erreur de virus ;-)remet un rapport HijackThis

Bekinz · Answer

voici le rapport de l'antivirus panda:Incident                                                                        Statut                        Analyse                                                                                                                                                                                                                                                         Spyware:Cookie/24/7 Realmedia                                                   No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@247realmedia[1].txt                                                                                                                                                                                             Spyware:Cookie/2o7.net                                                          No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@2o7[2].txt                                                                                                                                                                                                      Spyware:Cookie/Adtech                                                           No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@adtech[1].txt                                                                                                                                                                                                   Spyware:Cookie/Bluestreak                                                       No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@bluestreak[2].txt                                                                                                                                                                                               Spyware:Cookie/fe.lea.lycos                                                     No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@fe.lea.lycos[1].txt                                                                                                                                                                                             Spyware:Cookie/Overture                                                         No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@perf.overture[1].txt                                                                                                                                                                                            Spyware:Cookie/Reliablestats                                                    No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@stats1.reliablestats[1].txt                                                                                                                                                                                     Spyware:Cookie/Xiti                                                             No Désinfecté                 C:\Documents and Settings\delage\Cookies\delage@xiti[1].txt                                                                                                                                                                                                     Dialer:Dialer.B                                                                 No Désinfecté                 C:\Hijackthis\backups\backup-20060127-165637-317.inf                                                                                                                                                                                                            Dialer:Dialer.B                                                                 No Désinfecté                 C:\Hijackthis\backups\backup-20060127-165637-886.inf                                                                                                                                                                                                            Outil indésirable:Application/Winfixer2005                                      No Désinfecté                 C:\Program Files\Fichiers communs\ErrorSafe\PCheck.dll                                                                                                                                                                                                          Adware:Adware/NaviPromo                                                         No Désinfecté                 C:\Program Files\MailSkinner\OESkinner.dll                                                                                                                                                                                                                      Hacktool:Hacktool/HideItX                                                       No Désinfecté                 C:\Win32\dll\Win32k.exe                                                                                                                                                                                                                                         Adware:adware/navipromo                                                         No Désinfecté                 C:\WINDOWS\system32\hknxqabuo_nav.dat                                                                                                                                                                                                                           Adware:Adware/NaviPromo                                                         No Désinfecté                 C:\WINDOWS\system32\__delete_on_reboot__msclock32.dll                                                                                                                                                                                                           Dialer:dialer.b                                                                 No Désinfecté                 C:\WINDOWS	mlpcert2005

Bekinz · Answer

Voici mon rapport d' hijackthis: Logfile of HijackThis v1.99.1Scan saved at 21:57:42, on 27/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\Program Files\Securitoo\av_fw\fswsclds.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\windows\system32\hknxqabuo.exeC:\WINDOWS\system32\ctfmon.exeC:\program files\mailskinner\mailskinner.exeC:\Program Files\Nikon\NkView6\NkvMon.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dllO2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLL (file missing)O3 - Toolbar: Solucevir Toolbar - {86B676AA-2483-411B-B088-EF1ED833FF12} - C:\Program Files\Solucevir Toolbar\solucevir.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [Win32] C:\Win32\dll\Win32k.exe -starthide C:\Win32\dll\Win32.exe -localO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exeO4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [hknxqabuo] c:\windows\system32\hknxqabuo.exe hknxqabuoO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Emule_Init] C:\Program Files\emule\share.exeO4 - HKCU\..\Run: [MailSkinner] c:\program files\mailskinner\mailskinner.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1046.dll,InstantAccessO4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm338YYFRO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.htmlO8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htmO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar3.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{4DEE3B75-B798-414A-A6B1-BB3C34FACDC5}: NameServer = 80.10.246.130 80.10.246.3O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeO23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

Bekinz · Answer

J'ai supprimer les fichiers Win32k.exe ,Win32.exe et hknxqabuo.exe . mais j'ai toujours le mess d'erreur "erreur de chargement de p2esocks_1046.dll le module specifié est introuvable" je t'envoi le rapport d'hijackthis (merci encore de ne pas laissé tombé):Logfile of HijackThis v1.99.1Scan saved at 13:05:54, on 28/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\av_fw\backweb\1044199\Program\BackWeb-1044199.exeC:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Securitoo\av_fw\fswsclds.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEC:\Program Files\Securitoo\av_fw\Common\FSMB32.EXEC:\Program Files\Securitoo\av_fw\Common\FCH32.EXEC:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Securitoo\av_fw\Common\FSM32.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXEC:\Program Files\D-Tools\daemon.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\program files\mailskinner\mailskinner.exeC:\Program Files\Nikon\NkView6\NkvMon.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\xpuyjov.exeC:\Hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLLO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dllO2 - BHO: ToolHelper - {BBBE1C1A-89F7-4AF6-ABD1-F8FBCFA47408} - C:\PROGRA~1\SOLUCE~1\SOLUCE~1.DLL (file missing)O3 - Toolbar: Solucevir Toolbar - {86B676AA-2483-411B-B088-EF1ED833FF12} - C:\Program Files\Solucevir Toolbar\solucevir.dll (file missing)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALLO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exeO4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [xpuyjov] c:\windows\system32\xpuyjov.exe xpuyjovO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Emule_Init] C:\Program Files\emule\share.exeO4 - HKCU\..\Run: [MailSkinner] c:\program files\mailskinner\mailskinner.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1046.dll,InstantAccessO4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exeO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.htmlO8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htmO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar3.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{4DEE3B75-B798-414A-A6B1-BB3C34FACDC5}: NameServer = 80.10.246.1 80.10.246.132O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exeO23 - Service: F-Secure Authentication Agent (FSAA) - Unknown owner - C:\Program Files\Securitoo\av_fw\Common\FSAA.EXE (file missing)O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\1044199\program\fsbwsys.exeO23 - Service: F-Secure Distributed Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\DFW\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXEO23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

Kristopher · Answer

Hello :)Essaie cette manip. :- Redémarre le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou bien F5 selon la version de Windows) et tu choisis le mode sans échec)- Ensuite, tu cliques sur Démarrer ,éxecuter, regedit et tu navigues jusqu'à la clé : HKEY_Current_User\Software\Microsoft\Windows\CurrentVersion\Run :Cliquer sur Instant Access REG_SZ rundll32.exe EGDHTM_1024.dll,InstantAccess et tu supprimes .- Si vous trouvez également le fichier navpmc à cet endroit vous le supprimez également (merci à balltrap pour cette manip.)- Télécharge CCLEANER et nettoie ton PC avec : http://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html  Tutorial là : http://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.phpBon courage.++

Bekinz · Answer

Merci beaucoup à Boulepate et à Kristopher pour votre aide maintenant çà marche à merveille! et CCLEANER est un super logiciel en plus...Bonne continuation a vous.

Pblm avec le processeur NTDM et p2esocks!

17 réponses

Discussions similaires

Newsletters