Ouverture intempestive de internet explorer [Résolu]

Réponse

+0

jano68 28Messages postés 7 juillet 2005Date d'inscription 1 mars 2006 à 12:36

salut rypley38 bienvenue sur ccm

les url que tu affiche sont des spywares...

charge hijackthis

http://www.01net.com/telecharger/windows/Internet/internet_utlitaire/fiches/29061.html
- Installe le dans son propre dossier.
Par exemple, C:\HijackThis
Choisis l'option "do a scan and a logfile", il va te générer un rapport, copie et colle sur le forum.
Regarde la démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

ton anti virus??? ( tu parles de norton internet security qui est un firewal) ewido est considere comme anti trojan, spy, donc pas de probl. de cohabitation avec 1 AV)

ccleanner
http://www.ccleaner.com/
fais un nettoyage

cleanup40 ( pour virer les temp)laisse la config originale et passe le

http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/democleanup.htm

avast 4 home ( bon anti virus et gratuit)
http://www.avast.com/i_kat_207.php?lang=FRE
fais 1 scan (vire tout ce qu il va trouver)

envoie le rapport hjt stp a+

Ajouter un commentaire

ripley38- 1 mars 2006 à 12:41

merci jano68
j'ai imprimé ta réponse, jevais faire ce que tu me dits
et je te répondrai + tard.
il est l'heure d'aller manger alors je reporte tout ca à + tard.

merci je te tiens au courant

ripley 38

P.Y.T - 14 janv. 2009 à 13:43

Slt jano!
J'ai le mm pb de s fenêtres intempestives, pourrais je t'envoyer le rapport hitjack?
De plus, je n'arrive pas a télécharger ccleaner, jai fait un activscan, il y a des fichiers infectés, mais évidemment il faut payer pour désinfecter! je ne sais pas comment m'en débarrasser!
Merci d'avance pour ton aide!

Réponse

+2

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 18:33

voila jano68
le rapport de hijack this

Logfile of HijackThis v1.99.1
Scan saved at 18:24:29, on 01/03/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\telechargement\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

ripley38

Ajouter un commentaire

Réponse

+0

jano68 28Messages postés 7 juillet 2005Date d'inscription 1 mars 2006 à 20:14

re

coches les cases devant ces lignes avec hijackthis et fix checked

O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll

Affiches tous les fichiers
==============================
panneau de config. / Options des dossiers / Affichage
coches "afficher les fichiers cachés"
décoches "masquer les extensions des types connus"
décoches "masquer les fichiers protégés du système d'exploitation"

charges ce log
smitfraud fix
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
L'exécuter, puis double-cliquer sur Smitfraudfix.cmd
Choisir l’option 1, il va générer un rapport
Copie-colle ce dernier dans un message sur le forum.
En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

12mfix
l2mfix.exe sur http://www.downloads.subratam.org/l2mfix.exe
- Quitte le net, le navigateur, et toutes autres fenêtres d'applications ;
- Dézippe l2mfix.exe sur le bureau ;
- Dans le dossier du programme, double-cliquer sur l2mfix.bat ;
- Choisir OPTION 1 (Run find log) et valider par la touche [Entrée] ;
=> Un rapport sera généré dans le Bloc-notes, se reconnecter et le poster ici

a+

Ajouter un commentaire

ripley38- 1 mars 2006 à 20:20

bon merci j'imprime ta réponse et je vais appliquer tes indiquations.
a+

ripley38- 1 mars 2006 à 20:23

a jano 38
est ce que je dois me déconnecter et débrancher mon rj 45 avant de faire ceque tu me dits?

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 20:35

voila le rapport
par contre quand j'ai relancé hijackthis il n'y avait plus que la ligne
020 winlogon nitify.................

SmitFraudFix v2.21

Rapport fait à 20:32:43,23 le 01/03/2006
Executé à partir de D:\telechargement\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

voila ....

Ajouter un commentaire

Réponse

+1

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 20:42

voila le rapport apres 12mfix

L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\lvj0091me.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{7981C5A0-BB8E-5A22-C5DB-6D37B3227FC8}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension feuille de propri‚t‚ de mise … jour automatique"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{9CEB8C67-CAE4-4FA7-9C6F-C5C73B1DA080}"=""
"{7CC960E0-E995-4773-AC71-3124591A9A46}"=""
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{33F7642B-3B07-40B9-8722-DBB1BBF84975}"=""
"{FD9C2CA0-CB74-4721-847E-0AB0879F28CD}"=""
"{5693005C-AFB7-4277-B491-18787A23381E}"=""
"{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\InprocServer32]
@="C:\\WINDOWS\\system32\\lurt.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
lvj009~1.dll Wed 1 Mar 2006 10:32:20 A.... 236 546 231,00 K
n0n60a~1.dll Wed 1 Mar 2006 18:18:44 ..S.R 237 196 231,64 K
s32evnt1.dll Tue 31 Jan 2006 14:35:34 A.... 91 904 89,75 K

3 items found: 3 files (1 H/S), 0 directories.
Total of file sizes: 565 646 bytes 552,39 K
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
__dele~1.tmp Wed 1 Mar 2006 18:47:04 ..... 236 546 231,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 236 546 bytes 231,00 K
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 30DD-01F3

R‚pertoire de C:\WINDOWS\System32

01/03/2006 18:46 <REP> dllcache
01/03/2006 18:18 237ÿ196 n0n60a5sed.dll
28/02/2006 13:41 <REP> Microsoft
1 fichier(s) 237ÿ196 octets
2 R‚p(s) 37ÿ853ÿ556ÿ736 octets libres

a+

Ajouter un commentaire

boulepate- 1 mars 2006 à 20:48

Salut,

Relance L2MFIX et choisis l'option 2, colles le rapport ici, quand il aura redemarré puis mets un nouveau rapport hijackthis

A++

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 21:00

L2mfix 010406
Creating Account.
La commande s'est termin‚e correctement.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 572 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 668 'winlogon.exe'
Killing PID 668 'winlogon.exe'
Killing PID 668 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 4032 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 2248 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
Deleting: C:\WINDOWS\system32\lvj0091me.dll
Successfully Deleted: C:\WINDOWS\system32\lvj0091me.dll
Deleting: C:\WINDOWS\system32\n0n60a5sed.dll
Successfully Deleted: C:\WINDOWS\system32\n0n60a5sed.dll
Deleting: C:\WINDOWS\system32\__delete_on_reboot__guard.tmp
Successfully Deleted: C:\WINDOWS\system32\__delete_on_reboot__guard.tmp

msg11?.dll
0 fichier(s) copi‚(s).

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\lvj0091me.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

The following are the files found:
****************************************************************************
C:\WINDOWS\system32\lvj0091me.dll
C:\WINDOWS\system32\n0n60a5sed.dll
C:\WINDOWS\system32\__delete_on_reboot__guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}\InprocServer32]
@="C:\\WINDOWS\\system32\\lurt.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{9CEB8C67-CAE4-4FA7-9C6F-C5C73B1DA080}"=-
"{7CC960E0-E995-4773-AC71-3124591A9A46}"=-
"{33F7642B-3B07-40B9-8722-DBB1BBF84975}"=-
"{FD9C2CA0-CB74-4721-847E-0AB0879F28CD}"=-
"{5693005C-AFB7-4277-B491-18787A23381E}"=-
"{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}"=-
[-HKEY_CLASSES_ROOT\CLSID\{9CEB8C67-CAE4-4FA7-9C6F-C5C73B1DA080}]
[-HKEY_CLASSES_ROOT\CLSID\{7CC960E0-E995-4773-AC71-3124591A9A46}]
[-HKEY_CLASSES_ROOT\CLSID\{33F7642B-3B07-40B9-8722-DBB1BBF84975}]
[-HKEY_CLASSES_ROOT\CLSID\{FD9C2CA0-CB74-4721-847E-0AB0879F28CD}]
[-HKEY_CLASSES_ROOT\CLSID\{5693005C-AFB7-4277-B491-18787A23381E}]
[-HKEY_CLASSES_ROOT\CLSID\{264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************

voila le rapport option 2 de l2mfix******************************************************

**********************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/lvj0091me.dll (164 bytes security) (deflated 5%)
adding: dlls/n0n60a5sed.dll (164 bytes security) (deflated 5%)
adding: dlls/__delete_on_reboot__guard.tmp (164 bytes security) (deflated 5%)
adding: backregs/264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6.reg (212 bytes security) (deflated 70%)
adding: backregs/5693005C-AFB7-4277-B491-18787A23381E.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 21:02

voila le rapport de hijackthisLogfile of HijackThis v1.99.1
Scan saved at 21:01:27, on 01/03/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
D:\telechargement\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

A+

Ajouter un commentaire

boulepate- 1 mars 2006 à 21:09

Re,

ou en sont tes problémes?

Réponse

+0

jano68 28Messages postés 7 juillet 2005Date d'inscription 1 mars 2006 à 21:06

re

non,te deconnecter tout simplement.

ok pour smitfraud

regarde dans ajout /supp des progr. si tu trouve ces 2 prog.

winsysupd
gimmygames

si oui desinstaller

- réouvres le dossier L2Mfix créé sur le bureau
- doubles-cliquer sur L2Mfix.bat, choisir l'option 2 Run Fix (entrer 2) et appuies sur n'importe quelle touche pour redémarrer l'ordinateur
Après redémarrage, le bureau et les icônes vont apparaître puis disparaître, c'est normal !
- L2Mfix va rescanner le disque ; après 1 ou 2 minutes de recherche, ouverture du Bloc-note ; postes le contenu sur le forum

fais 1 scan on line ici

Bitdefender:
http://www.bitdefender.fr
envoie le rapport

et 1 nouveau rapport hjt

un peu long mais on y arrive

a++

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 21:37

voila le rapport de l2mfix
L2mfix 010406
Creating Account.
La commande s'est termin‚e correctement.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 588 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 672 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1956 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Error, Cannot find a process with an image name of rundll32.exe
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\lvj0091me.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/lvj0091me.dll (164 bytes security) (deflated 5%)
adding: dlls/n0n60a5sed.dll (164 bytes security) (deflated 5%)
adding: dlls/__delete_on_reboot__guard.tmp (164 bytes security) (deflated 5%)
adding: backregs/264F5D18-5E79-4A0A-BA04-D6CE3CC54FB6.reg (212 bytes security) (deflated 70%)
adding: backregs/5693005C-AFB7-4277-B491-18787A23381E.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 74%)

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 22:36

voila le rapport de bitdefender
<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner - Rapport d'analyse</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >

<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
BitDefender Online Scanner
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>
<tr>
<td colspan="3" width="912">
Rapport d'analyse généré à: Wed, Mar 01, 2006 - 22:31:49
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
Voie d'analyse: A:\;C:\;D:\;E:\;F:\;
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
 
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Statistiques
</td>
</tr>
<tr>
<td width="57%">
Temps
</td>
<td width="43%" align="right">
00:51:40
</td>
</tr>
<tr>
<td width="57%">
Fichiers
</td>
<td width="43%" align="right">
254297
</td>
</tr>
<tr>
<td width="57%">
Directoires
</td>
<td width="43%" align="right">
874
</td>
</tr>
<tr>
<td width="57%">
Secteurs de boot
</td>
<td width="43%" align="right">
4
</td>
</tr>
<tr>
<td width="57%">
Archives
</td>
<td width="43%" align="right">
754
</td>
</tr>
<tr>
<td width="57%">
Paquets programmes
</td>
<td width="43%" align="right">
40411
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Résultats
</td>
</tr>
<tr>
<td width="57%">
Virus identifiés
</td>
<td width="43%" align="right">
18
</td>
</tr>
<tr>
<td width="57%">
Fichiers infectés
</td>
<td width="43%" align="right">
58
</td>
</tr>
<tr>
<td width="57%">
Fichiers suspects
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Avertissements
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Désinfectés
</td>
<td width="43%" align="right">
0
</td>
</tr>
<tr>
<td width="57%">
Fichiers effacés
</td>
<td width="43%" align="right">
99
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Info sur les moteurs
</td>
</tr>
<tr>
<td width="57%">
Définition virus
</td>
<td width="43%" align="right">
289403
</td>
</tr>
<tr>
<td width="57%">
Version des moteurs
</td>
<td width="43%" align="right">
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)
</td>
</tr>
<tr>
<td width="57%">
Analyse des plugins
</td>
<td width="43%" align="right">
13
</td>
</tr>
<tr>
<td width="57%">
Archive des plugins
</td>
<td width="43%" align="right">
39
</td>
</tr>
<tr>
<td width="57%">
Unpack des plugins
</td>
<td width="43%" align="right">
4
</td>
</tr>
<tr>
<td width="57%">
E-mail plugins
</td>
<td width="43%" align="right">
6
</td>
</tr>
<tr>
<td width="57%">
Système plugins
</td>
<td width="43%" align="right">
1
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
Paramètres d'analyse
</td>
</tr>
<tr>
<td width="57%">
Première action
</td>
<td width="43%" align="right">
Désinfecté
</td>
</tr>
<tr>
<td width="57%">
Seconde Action
</td>
<td width="43%" align="right">
Supprimé
</td>
</tr>
<tr>
<td width="57%">
Heuristique
</td>
<td width="43%" align="right">
Oui
</td>
</tr>
<tr>
<td width="57%">
Acceptez les avertissements
</td>
<td width="43%" align="right">
Oui
</td>
</tr>
<tr>
<td width="57%">
Extensions analysées
</td>
<td width="43%" align="right">
*;
</td>
</tr>

<tr>
<td width="57%">
Excludez les extensions
</td>
<td width="43%" align="right">
 
</td>
</tr>
<tr>
<td width="57%">
Analyse d'emails
</td>
<td width="43%" align="right">
Oui
</td>
</tr>
<tr>
<td width="57%">
Analyse des Archives
</td>
<td width="43%" align="right">
Oui
</td>
</tr>
<tr>
<td width="57%">
Analyser paquets programmes
</td>
<td width="43%" align="right">
Oui
</td>
</tr>
<tr>
<td width="57%">
Analyse des fichiers
</td>
<td width="43%" align="right">
Oui
</td>
</tr>
<tr>
<td width="57%">
Analyse de boot
</td>
<td width="43%" align="right">
Oui
</td>
</tr>
</table>
</td>
<td width="40%">
 
</td>
<td width="10%">
 
</td>
</tr>

<tr>
<td colspan=2>
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
Fichier analysé
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
 Statut
</td>
</tr>
<tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/lvj0091me.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/lvj0091me.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip
</td>
<td width="43%" align="left">
Mis à jour
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/n0n60a5sed.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/n0n60a5sed.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip
</td>
<td width="43%" align="left">
Mis à jour
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/__delete_on_reboot__guard.tmp
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip=>dlls/__delete_on_reboot__guard.tmp
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\backup.zip
</td>
<td width="43%" align="left">
Mis à jour
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\lvj0091me.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\lvj0091me.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\n0n60a5sed.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\n0n60a5sed.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\__delete_on_reboot__guard.tmp
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\Documents and Settings\bensaou\Bureau\l2mfix\dlls\__delete_on_reboot__guard.tmp
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\DR21206.exe
</td>
<td width="43%" align="left">
Infecté par: Dropped:Trojan.Clicker.Small.G
</td>
</tr><tr>
<td width="57%">
C:\DR21206.exe
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\DR21206.exe
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C5F1398.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Canbede.L
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C5F1398.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C5F1398.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\26604593.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Backdoor.Sdbot.AIG
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\26604593.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\26604593.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\34AA22EF.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Agent.FE
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\34AA22EF.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\34AA22EF.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\395B39F5.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Canbede.L
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\395B39F5.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\395B39F5.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E8C10F9.dll=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Clicker.Small.G
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E8C10F9.dll=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\3E8C10F9.dll=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44EB75F4.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Small.BUY
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\44EB75F4.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B268B5.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Proxy.493
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B268B5.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B268B5.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B93CAD.avi=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Dropper.Agent.AAC
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B93CAD.avi=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49BF10A6.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.TSUpdate.L
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49BF10A6.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49C6649F.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.TSUpdate.P
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49C6649F.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49CC3898.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Tsupdate.N
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49CC3898.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49CC3898.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49D9608A.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Tsupdate.F
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49D9608A.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49D9608A.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F4306D.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Proxy.493
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F4306D.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F4306D.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F75A69.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Dropper.Agent.AAC
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49F75A69.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49FA0466.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Agent.FE
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49FA0466.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49FA0466.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A04025B.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Small.BUY
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A04025B.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A0E0050.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Tsupdate.O
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A0E0050.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A0E0050.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A145449.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Tsupdate.O
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A145449.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A145449.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1E523E.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Tsupdate.N
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1E523E.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4A1E523E.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7B942B6F.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Backdoor.Rbot.AEM
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7B942B6F.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7B942B6F.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7F2317F4.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Infecté par: Trojan.Dropper.Agent.AAC
</td>
</tr><tr>
<td width="57%">
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7F2317F4.exe=>(Quarantine-2)
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000405.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000405.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000421.exe
</td>
<td width="43%" align="left">
Infecté par: GenPack:Backdoor.RBot.E3DB09FB
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000421.exe
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000421.exe
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000422.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000422.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000433.exe
</td>
<td width="43%" align="left">
Infecté par: Trojan.Downloader.Smar.M
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000433.exe
</td>
<td width="43%" align="left">
Echec de la désinfection
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP3\A0000433.exe
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000444.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000444.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000445.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000445.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000503.dll
</td>
<td width="43%" align="left">
Détecté avec: Adware.Dinky.A.Trojan
</td>
</tr><tr>
<td width="57%">
C:\System Volume Information\_restore{CE55B7BE-BFA1-497A-AB84-C2DF831EE98D}\RP4\A0000503.dll
</td>
<td width="43%" align="left">
Supprimé
</td>
</tr><tr&g

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 22:39

voila le rapport le hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 22:36:47, on 01/03/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
D:\telechargement\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

du chinois pour moi, mais si quand j'espere tout sera résolu, pourras tu m'expliquer succintement le principe et les differentes phases du nettoyage.
merci a+
ripley38

Ajouter un commentaire

Réponse

+0

jano68 28Messages postés 7 juillet 2005Date d'inscription 1 mars 2006 à 23:21

re
fixe cette ligne avec hijackthis
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\lvj0091me.dll (file missing)

desactive la
restauration systeme
dans..> pannean de configuration...> systeme...>restauration du systeme...>
coche la case ...>>>desactiver la restaur. system sur ts les lecteurs...<<<
fenetre d avertissements,,passe outre......et appliquer ...ok

vide la quarantaine de norton

demarre en mode sans echec

Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5)

recherche ce fichier et supp
C:\WINDOWS\system32\===>lvj0091me.dll

repasse ewido

envoie 1 rapport hijack a+

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 23:27

ou se trouve la quarantaine de norton?
svp

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 1 mars 2006 à 23:34

excuse je suis allé dans norton , j'ai trouvé les rapports de quarantaine.
par contre, je n'ai rien en quarantaine.
donc là je continue la suite avec le redémarrage.
a+

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 2 mars 2006 à 00:09

j'ai redémarré en mode ss echec
recherche de lvj0091me.dll rien trouvé
recherche de lv*.* tjrs pas trouvé

j'ai lancé ewido
et voila le rapport hijack
Logfile of HijackThis v1.99.1
Scan saved at 00:06:17, on 02/03/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
D:\telechargement\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.videoposte.com/statique/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

a+
ripley 38

Ajouter un commentaire

Réponse

+0

jano68 28Messages postés 7 juillet 2005Date d'inscription 2 mars 2006 à 00:39

re

ton log hijack est clean

ou en sont tes soucis?

Ajouter un commentaire

Réponse

+0

ripley38 138Messages postés 22 février 2006Date d'inscription 11 mars 2012Dernière intervention 2 mars 2006 à 00:45

je n'ai plus de fenetres intempestives
tiens si tu l'as pas, voila ma petite contribution
http://telechargement.zebulon.fr/160-Patch-fran%C3%A7ais-pour-HijackThis.html

est ce que c'est terminé enfin, parceque
c'est vraiment l'enfer pour qqn qui n'a pas l'habitude

Ajouter un commentaire

Réponse

+0

jano68 28Messages postés 7 juillet 2005Date d'inscription 2 mars 2006 à 01:05

re
termine!!

recache tes doss/fichiers
reactive la restaur.systeme

ne garde qu un seul AV .. ok pour norton et 1 seul firewal NIS ok

merci pour hjt chez zeb.. j ai fr.et anglais

mets ton windows a jour ( sp2) micros.windows update, pour ton info tu peux commander le cd ( sp2 ) (plus simple a installer)
si probl n hesites pas.....

salut bon surf.

Ajouter un commentaire

Ouverture intempestive de internet explorer [Résolu]

Ouverture intempestive de internet explorer »

Passage au tout numérique : quel coût pour les particuliers ?