Logfile of HijackThis v1.99.1
Scan saved at 01:04:31, on 14/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\PeDevice\PeDev.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\abcd.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neufportail.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {BA876FEA-FD25-81A2-2370-F31A019C5C91} - C:\WINDOWS\System32\ytsliwmh.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {8BAA5FEF-D013-C4E1-0E34-CB3734AC71A5} - C:\WINDOWS\System32\ytsliwmh.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O2 - BHO: (no name) - {73CEC8B4-016A-42A0-BD2E-6B33390386E0} - C:\WINDOWS\System32\awvvu.dll (file missing)
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\System32\puhkvoxk.dll
O2 - BHO: (no name) - {8BAA5FEF-D013-C4E1-0E34-CB3734AC71A5} - C:\WINDOWS\System32\ytsliwmh.dll
O2 - BHO: (no name) - {BA876FEA-FD25-81A2-2370-F31A019C5C91} - C:\WINDOWS\System32\ytsliwmh.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\FICHIE~1\{3849B~1\Bar888.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll
O2 - BHO: PEDEV_IEListener Class - {E1412445-4FF8-410e-8D24-F2CF86B171A4} - C:\Program Files\PeDevice\PeDev.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E8109C5-341F-48C2-ADD2-838227DDD687}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
plus rapor vbg
[01/14/2007, 1:00:16] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\cris\Local Settings\Temporary Internet Files\Content.IE5\J5NFDHF6\VirtumundoBeGone[1].exe" )
[01/14/2007, 1:00:26] - Detected System Information:
[01/14/2007, 1:00:26] - Windows Version: 5.1.2600, Service Pack 1
[01/14/2007, 1:00:26] - Current Username: cris (Admin)
[01/14/2007, 1:00:26] - Windows is in NORMAL mode.
[01/14/2007, 1:00:26] - Searching for Browser Helper Objects:
[01/14/2007, 1:00:26] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[01/14/2007, 1:00:26] - BHO 2: {2BF5E85D-BA5A-45AA-BA9F-1359E56056F2} ()
[01/14/2007, 1:00:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:26] - Checking for HKLM\...\Winlogon\Notify\pmnnn
[01/14/2007, 1:00:26] - Found: HKLM\...\Winlogon\Notify\pmnnn - This is probably Virtumundo.
[01/14/2007, 1:00:26] - Assigning {2BF5E85D-BA5A-45AA-BA9F-1359E56056F2} MSEvents Object
[01/14/2007, 1:00:26] - BHO list has been changed! Starting over...
[01/14/2007, 1:00:26] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[01/14/2007, 1:00:26] - BHO 2: {2BF5E85D-BA5A-45AA-BA9F-1359E56056F2} (MSEvents Object)
[01/14/2007, 1:00:26] - ALERT: Found MSEvents Object!
[01/14/2007, 1:00:26] - BHO 3: {46A4E9D9-B30E-452A-8157-DBBEC8573B03} ()
[01/14/2007, 1:00:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:26] - Checking for HKLM\...\Winlogon\Notify\VSAdd-in
[01/14/2007, 1:00:26] - Key not found: HKLM\...\Winlogon\Notify\VSAdd-in, continuing.
[01/14/2007, 1:00:26] - BHO 4: {73CEC8B4-016A-42A0-BD2E-6B33390386E0} ()
[01/14/2007, 1:00:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:26] - Checking for HKLM\...\Winlogon\Notify\awvvu
[01/14/2007, 1:00:26] - Key not found: HKLM\...\Winlogon\Notify\awvvu, continuing.
[01/14/2007, 1:00:26] - BHO 5: {7DA39570-5FD2-4f18-94B4-20730CB3F727} ()
[01/14/2007, 1:00:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:26] - Checking for HKLM\...\Winlogon\Notify\puhkvoxk
[01/14/2007, 1:00:26] - Key not found: HKLM\...\Winlogon\Notify\puhkvoxk, continuing.
[01/14/2007, 1:00:26] - BHO 6: {8BAA5FEF-D013-C4E1-0E34-CB3734AC71A5} ()
[01/14/2007, 1:00:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:26] - Checking for HKLM\...\Winlogon\Notify\ytsliwmh
[01/14/2007, 1:00:26] - Key not found: HKLM\...\Winlogon\Notify\ytsliwmh, continuing.
[01/14/2007, 1:00:26] - BHO 7: {BA876FEA-FD25-81A2-2370-F31A019C5C91} ()
[01/14/2007, 1:00:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:26] - Checking for HKLM\...\Winlogon\Notify\ytsliwmh
[01/14/2007, 1:00:26] - Key not found: HKLM\...\Winlogon\Notify\ytsliwmh, continuing.
[01/14/2007, 1:00:26] - BHO 8: {BDF3E430-B101-42AD-A544-FADC6B084872} (CNavExtBho Class)
[01/14/2007, 1:00:26] - BHO 9: {C1B4DEC2-2623-438e-9CA2-C9043AB28508} (Bar888)
[01/14/2007, 1:00:26] - BHO 10: {c900b400-cdfe-11d3-976a-00e02913a9e0} (WhIeHelperObj Class)
[01/14/2007, 1:00:26] - BHO 11: {E1412445-4FF8-410e-8D24-F2CF86B171A4} (PEDEV_IEListener Class)
[01/14/2007, 1:00:26] - Finished Searching Browser Helper Objects
[01/14/2007, 1:00:26] - *** Detected MSEvents Object
[01/14/2007, 1:00:26] - Trying to remove MSEvents Object...
[01/14/2007, 1:00:27] - Terminating Process: IEXPLORE.EXE
[01/14/2007, 1:00:27] - Terminating Process: RUNDLL32.EXE
[01/14/2007, 1:00:28] - Disabling Automatic Shell Restart
[01/14/2007, 1:00:28] - Terminating Process: EXPLORER.EXE
[01/14/2007, 1:00:28] - Suspending the NT Session Manager System Service
[01/14/2007, 1:00:28] - Terminating Windows NT Logon/Logoff Manager
[01/14/2007, 1:00:28] - Re-enabling Automatic Shell Restart
[01/14/2007, 1:00:28] - File to disable: C:\WINDOWS\System32\pmnnn.dll
[01/14/2007, 1:00:28] - Renaming C:\WINDOWS\System32\pmnnn.dll -> C:\WINDOWS\System32\pmnnn.dll.vir
[01/14/2007, 1:00:28] - File successfully renamed!
[01/14/2007, 1:00:28] - Removing HKLM\...\Browser Helper Objects\{2BF5E85D-BA5A-45AA-BA9F-1359E56056F2}
[01/14/2007, 1:00:28] - Removing HKCR\CLSID\{2BF5E85D-BA5A-45AA-BA9F-1359E56056F2}
[01/14/2007, 1:00:28] - Adding Kill Bit for ActiveX for GUID: {2BF5E85D-BA5A-45AA-BA9F-1359E56056F2}
[01/14/2007, 1:00:28] - Deleting ATLEvents/MSEvents Registry entries
[01/14/2007, 1:00:28] - Removing HKLM\...\Winlogon\Notify\pmnnn
[01/14/2007, 1:00:28] - Searching for Browser Helper Objects:
[01/14/2007, 1:00:28] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[01/14/2007, 1:00:28] - BHO 2: {46A4E9D9-B30E-452A-8157-DBBEC8573B03} ()
[01/14/2007, 1:00:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:28] - Checking for HKLM\...\Winlogon\Notify\VSAdd-in
[01/14/2007, 1:00:28] - Key not found: HKLM\...\Winlogon\Notify\VSAdd-in, continuing.
[01/14/2007, 1:00:28] - BHO 3: {73CEC8B4-016A-42A0-BD2E-6B33390386E0} ()
[01/14/2007, 1:00:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:28] - Checking for HKLM\...\Winlogon\Notify\awvvu
[01/14/2007, 1:00:28] - Key not found: HKLM\...\Winlogon\Notify\awvvu, continuing.
[01/14/2007, 1:00:28] - BHO 4: {7DA39570-5FD2-4f18-94B4-20730CB3F727} ()
[01/14/2007, 1:00:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:28] - Checking for HKLM\...\Winlogon\Notify\puhkvoxk
[01/14/2007, 1:00:28] - Key not found: HKLM\...\Winlogon\Notify\puhkvoxk, continuing.
[01/14/2007, 1:00:28] - BHO 5: {8BAA5FEF-D013-C4E1-0E34-CB3734AC71A5} ()
[01/14/2007, 1:00:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:28] - Checking for HKLM\...\Winlogon\Notify\ytsliwmh
[01/14/2007, 1:00:28] - Key not found: HKLM\...\Winlogon\Notify\ytsliwmh, continuing.
[01/14/2007, 1:00:28] - BHO 6: {BA876FEA-FD25-81A2-2370-F31A019C5C91} ()
[01/14/2007, 1:00:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[01/14/2007, 1:00:28] - Checking for HKLM\...\Winlogon\Notify\ytsliwmh
[01/14/2007, 1:00:28] - Key not found: HKLM\...\Winlogon\Notify\ytsliwmh, continuing.
[01/14/2007, 1:00:28] - BHO 7: {BDF3E430-B101-42AD-A544-FADC6B084872} (CNavExtBho Class)
[01/14/2007, 1:00:28] - BHO 8: {C1B4DEC2-2623-438e-9CA2-C9043AB28508} (Bar888)
[01/14/2007, 1:00:28] - BHO 9: {c900b400-cdfe-11d3-976a-00e02913a9e0} (WhIeHelperObj Class)
[01/14/2007, 1:00:28] - BHO 10: {E1412445-4FF8-410e-8D24-F2CF86B171A4} (PEDEV_IEListener Class)
[01/14/2007, 1:00:28] - Finished Searching Browser Helper Objects
[01/14/2007, 1:00:28] - Finishing up...
[01/14/2007, 1:00:28] - A restart is needed.
[01/14/2007, 1:00:42] - Attempting to Restart via STOP error (Blue Screen!)
