Trojan ? Virus ? help (rapport Hijack)Résolu/Fermé

Question

Bonsoir tout le monde,
je crois bien que j'ai chopé un cheval de trois ou une crotte dans le genre ma barre des taches disparait parfois quand je suis sur internet explorer (donc explorer.exe) j'ai des pub ki aparaisse un peu partout ces derniers temps etc etc

mon rapport hijack this:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:01:50, on 03/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\documents and settings\compaq_propriétaire.nom-eb85c523610.000\local settings\application data\mmwygibfan.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\WinTV\WinTV2K.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\xbserdeb.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\COMPAQ~1.000\LOCALS~1\Temp\MsgPlusUninstall.exe" /Cleanup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [mmwygibfan] c:\documents and settings\compaq_propriétaire.nom-eb85c523610.000\local settings\application data\mmwygibfan.exe mmwygibfan
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 81.253.149.1 80.10.246.3
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

eam · Answer

salut 
vous avez peut etre besoin de ces deux logiciels qui sont gratuits :
Spybot S&D et Ad-Aware

Utilisateur anonyme · Answer

Bonjour

Faut arrêter avec Spybot et Ad-aware c'est des logiciels très moiyens, faudrait peut-être conseiller des logiciels efficaces tel AVG anti-spywares ou A-squared, de plus il a déjà Spybot..


Fais ceci :

Fais un clic droit sur Hijackthis, choisis "renommer" puis marque ceci : abcde.exe 
Double-clic sur HijackThis. Clic sur "I Accept" puis clic sur "do a system scan and save logfile" 
Puis copie et colle ici le rapport qu'il va te générer.

jorginho67 · Answer

Salut Boulepate !
plussum et pour suivre .....

goaaa · Answer

Bonjour tout le monde pas chez moi la semaine donc acces au pc que ce week end bref je vient de macheté un disque dur externe car mon disque interne ai déja fort plein je prefaire donc nettoyé le pc avant de copier mes fichiers voici le rapport d'aujourdhui 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:59:10, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32\glnoewmw.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\xbserdeb.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.1 81.253.149.2
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

goaaa · Answer

arghhh c'est vraiment chiant cette barre des taches ki disparait des que j'ouvre explorer j'attent votre aide dailleur jai fai une recherche avec spybot et corriger kelke saleté par contre il maffiche des messages comme koi ya des modification dans le registre bref jattend votre aide c urgent merci

goaaa · Answer

sil vous plait personne peut m'aidé ??????

goaaa · Answer

........................????

jorginho67 · Answer

Salut !
Sans vouloir marcher sur les plates bandes de Boulepate, tu as quoi en antivirus ? 

Ton MacAfee me semble bizarre.......

goaaa · Answer

oula ba effectivement j'ai mac afee pourquoi ?

jorginho67 · Answer

comme ça...

Pas de lignes 02 ni 020, ça sent l'infection Vundo !

Fais un clic droit sur  l'icone Hijackthis
http://www.cijoint.fr/cjlink.php?file=cj200803/cij5499182416009.jpg

Clic droit > choisis "renommer" marque (tu écris) : ccm.exe
http://www.cijoint.fr/cjlink.php?file=cj200803/cij7468165006040.jpg

Ensuite, relance le ,
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" -> Copier" pour copier tout le contenu du rapport

Pourquoi renommer Hijackthis ?
Parce que certaines infections Vundo ont la particularité de se "cacher" à la
détection de HJT proprement dite ou à son analyse .
la modification du nom de l'exe pallie ce problème...

Poste moi un nouveau log après avoir renommé HJT's !
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" -> Copier" pour copier tout le contenu du rapport

goaaa · Answer

voila j'espere que jme suis pas tromper (renomé relancé scanné) 



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:24:28, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\documents and settings\compaq_propriétaire.nom-eb85c523610.000\local settings\application data
tszxdzr.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32\glnoewmw.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\ocaetday.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-2988385628-595067928-2783924681-1008\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'kévin')
O4 - HKUS\S-1-5-21-2988385628-595067928-2783924681-1008\..\Run: [kkqikzzgsr] c:\documents and settings\kévin.nom-eb85c523610.000\local settings\application data\kkqikzzgsr.exe kkqikzzgsr (User 'kévin')
O4 - HKUS\S-1-5-21-2988385628-595067928-2783924681-1008\..\Run: [MS Juan] rundll32 "C:\WINDOWS\system32\hmeiwekb.dll",run (User 'kévin')
O4 - HKUS\S-1-5-21-2988385628-595067928-2783924681-1008\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\bouxybue.dll",b (User 'kévin')
O4 - HKUS\S-1-5-21-2988385628-595067928-2783924681-1008\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32
mwxnpyp.dll",s (User 'kévin')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 81.253.149.9 80.10.246.132
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 

non, c'est pas bon........

pas grave on essaye autrement !

(1)  Télécharge VundoFix.exe par Atribune  sur ton Bureau.

#  Double-clique sur VundoFix.exe afin de le lancer
  Clique sur le bouton Scan for Vundo
  Lorsque le scan est terminé, clique sur le bouton Remove Vundo
  Une invite te demandera si tu veux supprimer les fichiers, clique YES
  Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
  Tu verras une invite qui t'annonce que ton PC va redémarrer; clique sur OK

Le  rapport est situé dans C:\vundofix.txt 

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage. 
Il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

(2)  Télécharge virtumondebegone 
    
#  Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.

Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau, celui de vundofix situé dans C:\vundofix.txt et un nouveau rapport HijackThis dans ta prochaine réponse.


@+

goaaa · Answer

ok sa scan je poste tout sa au prochain message

goaaa · Answer

alors voila 


[03/07/2008, 21:57:49] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Bureau\VirtumundoBeGone.exe" )
[03/07/2008, 21:57:59] - Detected System Information:
[03/07/2008, 21:57:59] -  Windows Version: 5.1.2600, Service Pack 2
[03/07/2008, 21:57:59] -  Current Username: Compaq_Propriétaire (Admin)
[03/07/2008, 21:57:59] -  Windows is in NORMAL mode.
[03/07/2008, 21:57:59] - Searching for Browser Helper Objects:
[03/07/2008, 21:57:59] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[03/07/2008, 21:57:59] -  BHO 2: {36178E89-72AD-429A-B0ED-933EBD7DC9E3} ()
[03/07/2008, 21:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:57:59] -  Checking for HKLM\...\Winlogon\Notify\ddaby
[03/07/2008, 21:57:59] -  Key not found: HKLM\...\Winlogon\Notify\ddaby, continuing.
[03/07/2008, 21:57:59] -  BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[03/07/2008, 21:57:59] -  BHO 4: {486eeba9-f9ad-422c-ba9e-69a987057a73} ()
[03/07/2008, 21:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:57:59] -  Checking for HKLM\...\Winlogon\Notify\xqkfvxmy
[03/07/2008, 21:57:59] -  Key not found: HKLM\...\Winlogon\Notify\xqkfvxmy, continuing.
[03/07/2008, 21:57:59] -  BHO 5: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/07/2008, 21:57:59] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[03/07/2008, 21:57:59] -  BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/07/2008, 21:57:59] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:57:59] -  No filename found. Continuing.
[03/07/2008, 21:58:00] -  BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[03/07/2008, 21:58:00] -  BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[03/07/2008, 21:58:00] -  BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[03/07/2008, 21:58:00] -  BHO 11: {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} ()
[03/07/2008, 21:58:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:00] -  Checking for HKLM\...\Winlogon\Notify\iifgefc
[03/07/2008, 21:58:00] -  Found: HKLM\...\Winlogon\Notify\iifgefc - This is probably Virtumundo.
[03/07/2008, 21:58:00] -  Assigning {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} MSEvents Object
[03/07/2008, 21:58:00] - BHO list has been changed! Starting over...
[03/07/2008, 21:58:00] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[03/07/2008, 21:58:00] -  BHO 2: {36178E89-72AD-429A-B0ED-933EBD7DC9E3} ()
[03/07/2008, 21:58:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:00] -  Checking for HKLM\...\Winlogon\Notify\ddaby
[03/07/2008, 21:58:00] -  Key not found: HKLM\...\Winlogon\Notify\ddaby, continuing.
[03/07/2008, 21:58:00] -  BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[03/07/2008, 21:58:00] -  BHO 4: {486eeba9-f9ad-422c-ba9e-69a987057a73} ()
[03/07/2008, 21:58:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:01] -  Checking for HKLM\...\Winlogon\Notify\xqkfvxmy
[03/07/2008, 21:58:01] -  Key not found: HKLM\...\Winlogon\Notify\xqkfvxmy, continuing.
[03/07/2008, 21:58:01] -  BHO 5: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/07/2008, 21:58:01] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[03/07/2008, 21:58:01] -  BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/07/2008, 21:58:01] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:01] -  No filename found. Continuing.
[03/07/2008, 21:58:01] -  BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[03/07/2008, 21:58:01] -  BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[03/07/2008, 21:58:01] -  BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[03/07/2008, 21:58:01] -  BHO 11: {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} (MSEvents Object)
[03/07/2008, 21:58:01] - ALERT: Found MSEvents Object!
[03/07/2008, 21:58:01] -  BHO 12: {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} ()
[03/07/2008, 21:58:01] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:01] -  Checking for HKLM\...\Winlogon\Notify\vturs
[03/07/2008, 21:58:01] -  Key not found: HKLM\...\Winlogon\Notify\vturs, continuing.
[03/07/2008, 21:58:01] - Finished Searching Browser Helper Objects
[03/07/2008, 21:58:01] - *** Detected MSEvents Object
[03/07/2008, 21:58:01] - Trying to remove MSEvents Object...
[03/07/2008, 21:58:02] -    Terminating Process: IEXPLORE.EXE
[03/07/2008, 21:58:03] -    Terminating Process: RUNDLL32.EXE
[03/07/2008, 21:58:03] -    Disabling Automatic Shell Restart
[03/07/2008, 21:58:03] -    Terminating Process: EXPLORER.EXE
[03/07/2008, 21:58:05] -    Suspending the NT Session Manager System Service
[03/07/2008, 21:58:06] -    Terminating Windows NT Logon/Logoff Manager
[03/07/2008, 21:58:11] -    Re-enabling Automatic Shell Restart
[03/07/2008, 21:58:11] -   File to disable: C:\WINDOWS\system32\iifgefc.dll
[03/07/2008, 21:58:11] -  Renaming C:\WINDOWS\system32\iifgefc.dll -> C:\WINDOWS\system32\iifgefc.dll.vir
[03/07/2008, 21:58:12] -  File successfully renamed!
[03/07/2008, 21:58:12] -   Removing HKLM\...\Browser Helper Objects\{CE22ABA3-B540-4D26-9BE2-425AF0F411E8}
[03/07/2008, 21:58:12] -   Removing HKCR\CLSID\{CE22ABA3-B540-4D26-9BE2-425AF0F411E8}
[03/07/2008, 21:58:12] -   Adding Kill Bit for ActiveX for GUID: {CE22ABA3-B540-4D26-9BE2-425AF0F411E8}
[03/07/2008, 21:58:12] -   Deleting ATLEvents/MSEvents Registry entries
[03/07/2008, 21:58:12] -   Removing HKLM\...\Winlogon\Notify\iifgefc
[03/07/2008, 21:58:12] - Searching for Browser Helper Objects:
[03/07/2008, 21:58:12] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[03/07/2008, 21:58:12] -  BHO 2: {07147132-DD63-46B8-82F9-AF061D964403} ()
[03/07/2008, 21:58:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:12] -  Checking for HKLM\...\Winlogon\Notify\ddaby
[03/07/2008, 21:58:12] -  Key not found: HKLM\...\Winlogon\Notify\ddaby, continuing.
[03/07/2008, 21:58:12] -  BHO 3: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[03/07/2008, 21:58:12] -  BHO 4: {486eeba9-f9ad-422c-ba9e-69a987057a73} ()
[03/07/2008, 21:58:13] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:13] -  Checking for HKLM\...\Winlogon\Notify\xqkfvxmy
[03/07/2008, 21:58:13] -  Key not found: HKLM\...\Winlogon\Notify\xqkfvxmy, continuing.
[03/07/2008, 21:58:13] -  BHO 5: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[03/07/2008, 21:58:13] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[03/07/2008, 21:58:13] -  BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[03/07/2008, 21:58:13] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:13] -  No filename found. Continuing.
[03/07/2008, 21:58:13] -  BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[03/07/2008, 21:58:13] -  BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[03/07/2008, 21:58:13] -  BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[03/07/2008, 21:58:13] -  BHO 11: {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} ()
[03/07/2008, 21:58:13] - WARNING: BHO has no default name. Checking for Winlogon reference.
[03/07/2008, 21:58:13] -  Checking for HKLM\...\Winlogon\Notify\vturs
[03/07/2008, 21:58:13] -  Key not found: HKLM\...\Winlogon\Notify\vturs, continuing.
[03/07/2008, 21:58:13] - Finished Searching Browser Helper Objects
[03/07/2008, 21:58:13] - Finishing up...
[03/07/2008, 21:58:13] - A restart is needed.
[03/07/2008, 21:58:26] - Attempting to Restart via STOP error (Blue Screen!)





ENSUITE




VundoFix V7.0.1

Scan started at 21:33:04 07/03/2008

Listing files found while scanning....

C:\WINDOWS\system32\bouxybue.dll
C:\WINDOWS\system32\brgwahqn.dll
C:\WINDOWS\system32\eubyxuob.ini
C:\WINDOWS\system32\fefecxvg.ini
C:\WINDOWS\system32\gvxcefef.dll
C:\WINDOWS\system32
qhawgrb.ini
C:\WINDOWS\system32\ucfcjayi.dll
C:\windows\system32\vturs.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\bouxybue.dll
C:\WINDOWS\system32\bouxybue.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\brgwahqn.dll
C:\WINDOWS\system32\brgwahqn.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\eubyxuob.ini
C:\WINDOWS\system32\eubyxuob.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fefecxvg.ini
C:\WINDOWS\system32\fefecxvg.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gvxcefef.dll
C:\WINDOWS\system32\gvxcefef.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32
qhawgrb.ini
C:\WINDOWS\system32
qhawgrb.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ucfcjayi.dll
C:\WINDOWS\system32\ucfcjayi.dll Has been deleted!

 Attempting to delete C:\windows\system32\vturs.dll
C:\windows\system32\vturs.dll Has been deleted!

Performing Repairs to the registry.
Done!




ET HIJACK




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:08:08, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

ok, Vundofix a bien bossé....

là, il faudrait renommer Hijackthis pour voir les lignes 02/020 !

Fais un clic droit sur l'icone Hijackthis
http://www.cijoint.fr/cjlink.php?file=cj200803/cij5499182416009.jpg

Clic droit > choisis "renommer" marque (tu écris) : ccm.exe
http://www.cijoint.fr/cjlink.php?file=cj200803/cij7468165006040.jpg

Ensuite, relance le ,
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" -> Copier" pour copier tout le contenu du rapport

goaaa · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:16:38, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe  toujours pas......

sur l'icone, clic droit > renommer > tu ecris CCM

goaaa · Answer

J'ai renomer HijackThis.exe en CCM puis jai fai un scan


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:31:52, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {4af4de40-3f29-be79-c094-ee6a06f8b1e2} - {2e1b8f60-a6ee-490c-97eb-92f304ed4fa4} - C:\WINDOWS\system32muxkasf.dll
O2 - BHO: (no name) - {36178E89-72AD-429A-B0ED-933EBD7DC9E3} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D8B8DBD-836E-4733-A740-D1183EBC333A} - C:\WINDOWS\system32\ddaby.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} - (no file)
O2 - BHO: (no name) - {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} - C:\WINDOWS\system32\vturs.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

C:\Program Files\Trend Micro\HijackThis\CCM.exe  Voilààààà ...... c'est ce qu'il me fallait !

Note que maintenant  il y a des 02 et 020 sur le log....

Je regarde ça , je reviens..

goaaa · Answer

^^ jai remarqué ouaip! content que sa te fasse plaiz j'espere que tu va pouvoir m'aidé jorginho67

jorginho67 · Answer

Télécharge OTMoveIt (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous, ( en gras )

C:\WINDOWS\system32muxkasf.dll 
C:\WINDOWS\system32\uehsjtpf.dll",b  

et colle-la dans le cadre de gauche de OTMoveIt : Paste List of Files/Folders to be moved.
tutoriel en cas de doute

clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre Results à droite.
Clique sur Exit pour fermer.

Il te sera peut-être demander de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Yes.
EN CAS DE DOUTE REGARDE ce TUTO

Un rapport sera enregistré dans C:\_OTMoveIt\MovedFiles.(xxxxxxxx_xxxxxx.log)
Les x sont des chiffres qui correspondent à la date et l'heure du scan.

Poste moi le rapport ainsi q'un nouvel Hijack'

jorginho67 · Answer

Fais ceci ensuite , après ce que je t'ai delandé post #22 stp ! Il va falloir analyser un fichier suspect ! Il se peut qu'il se trouve dans les " dossiers cachés " du systeme. Il faut donc les rendre visibles pour le scan. Pour afficher les dossiers et fichiers cachés: Panneau de configuration > Options des dossiers > onglet Affichage. coche Afficher les fichiers et dossiers cachés, décoche Masquer les extensions de fichiers connus décoche Masquer les fichiers protégés du Système. Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix. Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. Lorsque tu aura fini d'intervenir dans les répertoires système, fait la manip inverse pour recacher les fichiers système. Rend toi chez Virus Total pour analyser ce fichier. Clik sur parcourir Recherche ceci : C:\WINDOWS\system32\ddaby.dll C:\WINDOWS\system32 nwgendu.dll Fais le un dossier à la fois ! Clik send et poste le rapport ici stp Comment faire <<< Aide toi de ce tuto.

goaaa · Answer

Arf ma barre des taches qui a encore disparue un moment bref voila par contre sa ma pa demander de redemarer


DllUnregisterServer procedure not found in C:\WINDOWS\system32muxkasf.dll
C:\WINDOWS\system32muxkasf.dll NOT unregistered.
C:\WINDOWS\system32muxkasf.dll moved successfully.
File/Folder C:\WINDOWS\system32\uehsjtpf.dll",b not found.
 
OTMoveIt2 v1.0.20 log created on 03072008_225230





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:55:03, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {4af4de40-3f29-be79-c094-ee6a06f8b1e2} - {2e1b8f60-a6ee-490c-97eb-92f304ed4fa4} - C:\WINDOWS\system32muxkasf.dll (file missing)
O2 - BHO: (no name) - {36178E89-72AD-429A-B0ED-933EBD7DC9E3} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D8B8DBD-836E-4733-A740-D1183EBC333A} - C:\WINDOWS\system32\ddaby.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} - (no file)
O2 - BHO: (no name) - {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} - C:\WINDOWS\system32\vturs.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

goaaa · Answer

le premier:


Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.3.4.0	2008.03.07	-
AntiVir	7.6.0.73	2008.03.07	-
Authentium	4.93.8	2008.03.07	-
Avast	4.7.1098.0	2008.03.07	-
AVG	7.5.0.516	2008.03.07	-
BitDefender	7.2	2008.03.07	-
CAT-QuickHeal	9.50	2008.03.07	-
ClamAV	0.92.1	2008.03.07	-
DrWeb	4.44.0.09170	2008.03.07	-
eSafe	7.0.15.0	2008.03.06	-
eTrust-Vet	31.3.5595	2008.03.07	-
Ewido	4.0	2008.03.07	-
FileAdvisor	1	2008.03.07	-
Fortinet	3.14.0.0	2008.03.07	-
F-Prot	4.4.2.54	2008.03.07	W32/Virtumonde.G.gen!Eldorado
F-Secure	6.70.13260.0	2008.03.07	-
Ikarus	T3.1.1.20	2008.03.07	-
Kaspersky	7.0.0.125	2008.03.07	-
McAfee	5247	2008.03.07	-
Microsoft	1.3301	2008.03.07	-
NOD32v2	2930	2008.03.07	-
Norman	5.80.02	2008.03.07	-
Panda	9.0.0.4	2008.03.07	-
Prevx1	V2	2008.03.07	Trojan.Vundo
Rising	20.34.42.00	2008.03.07	AdWare.Win32.Virtumonde.ggh
Sophos	4.27.0	2008.03.07	Sus/Behav-200
Sunbelt	3.0.930.0	2008.03.05	-
Symantec	10	2008.03.07	-
TheHacker	6.2.92.236	2008.03.07	-
VBA32	3.12.6.2	2008.03.05	-
VirusBuster	4.3.26:9	2008.03.07	Adware.Vundo.Gen!Pac.18
Webwasher-Gateway	6.6.2	2008.03.07	Win32.Malware.gen (suspicious)
Information additionnelle
File size: 293376 bytes
MD5: 48f66be9cd3c54e946114556fd1980fd
SHA1: 2a82d43fb635e243c70487631e4ad717bf8aebbe
PEiD: -
packers: PE_Patch
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=501E18CE00B124157A0E04906C561700215664AC


le deuxieme:



Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.3.4.0	2008.03.07	-
AntiVir	7.6.0.73	2008.03.07	TR/Vundo.Gen
Authentium	4.93.8	2008.03.07	-
Avast	4.7.1098.0	2008.03.07	-
AVG	7.5.0.516	2008.03.07	-
BitDefender	7.2	2008.03.07	-
CAT-QuickHeal	9.50	2008.03.07	-
ClamAV	0.92.1	2008.03.07	-
DrWeb	4.44.0.09170	2008.03.07	-
eSafe	7.0.15.0	2008.03.06	-
eTrust-Vet	31.3.5595	2008.03.07	-
Ewido	4.0	2008.03.07	-
FileAdvisor	1	2008.03.07	-
Fortinet	3.14.0.0	2008.03.07	-
F-Prot	4.4.2.54	2008.03.07	W32/Virtumonde.G.gen!Eldorado
F-Secure	6.70.13260.0	2008.03.07	-
Ikarus	T3.1.1.20	2008.03.07	-
Kaspersky	7.0.0.125	2008.03.07	-
McAfee	5247	2008.03.07	-
Microsoft	1.3301	2008.03.07	-
NOD32v2	2930	2008.03.07	-
Norman	5.80.02	2008.03.07	-
Panda	9.0.0.4	2008.03.07	Suspicious file
Prevx1	V2	2008.03.07	-
Rising	20.34.42.00	2008.03.07	-
Sophos	4.27.0	2008.03.07	Sus/Behav-200
Sunbelt	3.0.930.0	2008.03.05	-
Symantec	10	2008.03.07	Trojan.Vundo
TheHacker	6.2.92.236	2008.03.07	-
VBA32	3.12.6.2	2008.03.05	-
VirusBuster	4.3.26:9	2008.03.07	-
Webwasher-Gateway	6.6.2	2008.03.07	Trojan.Vundo.Gen
Information additionnelle
File size: 88640 bytes
MD5: 1a55f7a221fda5ec9b0ac8f6bf04b364
SHA1: 5105a5750e7284fb6a5811e2fe4800a95f00967b
PEiD: -

goaaa · Answer

toujours la jorginho67 ?

jorginho67 · Answer

yes, t'inquietes  ;-P   

c'est bien ce qui me semblait........

juste que vundofix ne l'a pas détecté.......  ( pourquoi.....) 

refais un scan avec Vundofix stp.......

goaaa · Answer

VundoFix V7.0.1

Scan started at 23:34:49 07/03/2008

Listing files found while scanning....

C:\windows\system32\ddaby.dll
C:\windows\system32\ybadd.ini
C:\windows\system32\ybadd.ini2

Beginning removal...

 Attempting to delete C:\windows\system32\ddaby.dll
C:\windows\system32\ddaby.dll Has been deleted!

 Attempting to delete C:\windows\system32\ybadd.ini
C:\windows\system32\ybadd.ini Has been deleted!

 Attempting to delete C:\windows\system32\ybadd.ini2
C:\windows\system32\ybadd.ini2 Has been deleted!

Performing Repairs to the registry.
Done!

jorginho67 · Answer

reposte un HJT stp

goaaa · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:22:06, on 08/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\documents and settings\compaq_propriétaire.nom-eb85c523610.000\local settings\application data
tszxdzr.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinTV\WinTV2K.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe
C:\Program Files\Network Associates\VirusScan\mcconsol.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {4af4de40-3f29-be79-c094-ee6a06f8b1e2} - {2e1b8f60-a6ee-490c-97eb-92f304ed4fa4} - C:\WINDOWS\system32muxkasf.dll (file missing)
O2 - BHO: (no name) - {36178E89-72AD-429A-B0ED-933EBD7DC9E3} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D8B8DBD-836E-4733-A740-D1183EBC333A} - C:\WINDOWS\system32\ddaby.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} - (no file)
O2 - BHO: (no name) - {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} - C:\WINDOWS\system32\vturs.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

ok, ça se précise...

Télécharge Combofix à partir d'un de ces liens :

ComboFix bleepingcomputer 
ComboFix forospyware 
Et important, enregistre le sur le bureau.

Si ton antivirus te signale un trojan , risktools ou quoi que ce soit, il faut choisir ignorer  car c'est une erreur de detection. 
Il detecte en fait un composant de l'outil de nettoyage.

Avant d'utiliser ComboFix :
Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
 Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt

-Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
- Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

(Merci mOe)

goaaa · Answer

probleme combofix sa fait 2 fois que jlai mis en marche et la premiere foi il c'est arreté a letape 9 et apres plus rien pendan 1 heure jai redémarer le pc et la deuxieme foi pareil il sai arété a letape 30 et  pendan plusieurs heure plu rien??????

jorginho67 · Answer

on essaye comme ceci : ( si tu n'a toujours pas réusi a aller au bout avec Combo )

Télécharge Pocket Killbox 

Démo d'utilisation (merci a Balltrap34 pour cette réalisation) 

Double clic sur killbox.exe (Pocket Killbox)
Coche delete on reboot Dans "Full Path of File to Delete"
Copie et colle:

C:\WINDOWS\system32	nwgendu.dll",s 

Clique sur la croix rouge

- une fenêtre va apparaître pour confirmation clique sur YES
- une seconde fenêtre te demande si tu veux redémarrer clique sur YES

Si ce message s’affiche ignore le :
http://tinypic.com/images/goodbye.jpg
Laisse le pc redémarrer sinon redemarre le manuellement
Et après reposte un log HijackThis.

goaaa · Answer

j'lai fait et j'ai redemarer manuellement




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:16, on 2008-03-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {4af4de40-3f29-be79-c094-ee6a06f8b1e2} - {2e1b8f60-a6ee-490c-97eb-92f304ed4fa4} - C:\WINDOWS\system32muxkasf.dll (file missing)
O2 - BHO: (no name) - {36178E89-72AD-429A-B0ED-933EBD7DC9E3} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D8B8DBD-836E-4733-A740-D1183EBC333A} - C:\WINDOWS\system32\ddaby.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} - (no file)
O2 - BHO: (no name) - {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} - C:\WINDOWS\system32\vturs.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.1 81.253.149.2
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32 nwgendu.dll",s il y est encore.... Certains Fichiers/Dossiers ne sont pas accessibles sous Windows XP. En particulier les fichiers et répertoires système. Pourtant, il est parfois nécessaire d'accéder à ces répertoires (En cas d'infection par exemple). Fais ce qui suit... Pour afficher les dossiers et fichiers cachés: Panneau de configuration > Options des dossiers > onglet Affichage. coche Afficher les fichiers et dossiers cachés, décoche Masquer les extensions de fichiers connus décoche Masquer les fichiers protégés du Système. Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix. Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. Lorsque tu aura fini d'intervenir dans les répertoires système, fait la manip inverse pour recacher les fichiers système. Retente Killbox avec la fonction rechercher ( parcourir ) C:\ > WINDOWS > system32 >tnwgendu.dll",s <<--- suis ce chemin....

goaaa · Answer

je l'ai trouver sur parcourir et jlai suprimer et mon pc a redemarer automatiqument cette foi par contre le fichier n'avait pas de ("s) a la fin c'était tnwgendu.dll  . au redemarage un message c affiché comme quoi erreur de chargement du dit fichier le module na pas eté trouver etc je suppose que s'ait normal je poste un rapport hijack ?

goaaa · Answer

jorginho67 ?

jorginho67 · Answer

oui, poste un hjt's stp

goaaa · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:59, on 2008-03-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {4af4de40-3f29-be79-c094-ee6a06f8b1e2} - {2e1b8f60-a6ee-490c-97eb-92f304ed4fa4} - C:\WINDOWS\system32muxkasf.dll (file missing)
O2 - BHO: (no name) - {36178E89-72AD-429A-B0ED-933EBD7DC9E3} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5D8B8DBD-836E-4733-A740-D1183EBC333A} - C:\WINDOWS\system32\ddaby.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {CE22ABA3-B540-4D26-9BE2-425AF0F411E8} - (no file)
O2 - BHO: (no name) - {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} - C:\WINDOWS\system32\vturs.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 81.253.149.1 80.10.246.3
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

goaaa · Answer

?

goaaa · Answer

et maintenant ????

goaaa · Answer

on dirait bien qu'il n'ya plus le meme probleme mais je prefere etre sur ....alors?

goaaa · Answer

perssonne pour verifier mon rapport?

goaaa · Answer

bon jattend votre avis au faite j'ai redémarer mon pc et jai sa qui s'affiche https://www.hiboox.com ????

jorginho67 · Answer

essaye de me faire ceci 
http://www.commentcamarche.net/forum/affich 5284981 trojan virus help rapport hijack?page=2#31

goaaa · Answer

Alors voila combofix voulai pas marché donc jme suis mi en mode sans echec et la sa a marché j'espaire que j'ai bien fait au faite mes dossiers caché nétai pas visibles pendan ke conbofix cherchai jsai pa si il falai sinan au redemarage jai toujour ses 2 messages rundll etc... par contre le truc des video movie maker et tout sa remarche bizard bref voici le rapport ComboFix 08-03-07.4 - Compaq_Propriétaire 2008-03-08 21:02:22.4 - NTFSx86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.358 [GMT 1:00] Endroit: C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.url C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.url C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Désinstaller.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.url c:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Local Settings\Application Data tszxdzr.dat c:\documents and settings\compaq_propriétaire.nom-eb85c523610.000\local settings\application data tszxdzr.exe c:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Local Settings\Application Data tszxdzr_nav.dat c:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Local Settings\Application Data tszxdzr_navps.dat C:\Documents and Settings\kévin.NOM-EB85C523610.000\Menu Démarrer\Programmes\InternetGameBox C:\Documents and Settings\kévin.NOM-EB85C523610.000\Menu Démarrer\Programmes\InternetGameBox\Conditions générales.lnk C:\Documents and Settings\kévin.NOM-EB85C523610.000\Menu Démarrer\Programmes\InternetGameBox\Confidentialité.lnk C:\Documents and Settings\kévin.NOM-EB85C523610.000\Menu Démarrer\Programmes\InternetGameBox\InternetGameBox.lnk C:\Documents and Settings\kévin.NOM-EB85C523610.000\Menu Démarrer\Programmes\InternetGameBox\Website.lnk C:\WINDOWS\BMd7e923e9.xml C:\WINDOWS\inet20126 C:\WINDOWS\system32\acerarnr.ini C:\WINDOWS\system32\amfwbqim.dll C:\WINDOWS\system32\arbdsqre.dll C:\WINDOWS\system32\avacpsqq.dll C:\WINDOWS\system32\awqeceuk.dll C:\WINDOWS\system32\bedresbx.ini C:\WINDOWS\system32\bmgymrxl.dll C:\WINDOWS\system32\ddsvojvy.dll C:\WINDOWS\system32\djyatucv.dll C:\WINDOWS\system32\epegosap.dll C:\WINDOWS\system32\evplqngp.dll C:\WINDOWS\system32\fptjsheu.ini C:\WINDOWS\system32\glnoewmw.dll C:\WINDOWS\system32\gwxejabl.dll C:\WINDOWS\system32\hmeiwekb.dll C:\WINDOWS\system32\ikxopcsy.dll C:\WINDOWS\system32\ilawjaqu.dll C:\WINDOWS\system32\ipcoobvy.dll C:\WINDOWS\system32\jdeqrhto.ini C:\WINDOWS\system32\jnpcrbar.dll C:\WINDOWS\system32\jsbnjxft.dll C:\WINDOWS\system32\kueceqwa.ini C:\WINDOWS\system32\lwfbdatp.ini C:\WINDOWS\system32\mmojtvtm.dll C:\WINDOWS\system32\mtvtjomm.ini C:\WINDOWS\system32\mvsrkksx.dll C:\WINDOWS\system32 mwxnpyp.dll C:\WINDOWS\system32\othrqedj.dll C:\WINDOWS\system32\ptadbfwl.dll C:\WINDOWS\system32\quhwoppk.dll C:\WINDOWS\system32 nrareca.dll C:\WINDOWS\system32 qkwnkvv.dll C:\WINDOWS\system32 vmprpro.dll C:\WINDOWS\system32\sobhluso.dll C:\WINDOWS\system32\srutv.ini C:\WINDOWS\system32\srutv.ini2 C:\WINDOWS\system32 dhtgaiu.dll C:\WINDOWS\system32\ubhetlnu.dll C:\WINDOWS\system32\ubrxuuck.dll C:\WINDOWS\system32\uimatncw.dll C:\WINDOWS\system32\vrbhuvjf.dll C:\WINDOWS\system32\xqkfvxmy.dll C:\WINDOWS\system32\yadteaco.ini C:\WINDOWS\system32\ypaqmbuf.dll C:\WINDOWS\system32\yscpoxki.ini C:\WINDOWS\system32\yvboocpi.ini C:\WINDOWS\system32\yvjovsdd.ini . ((((((((((((((((((((((((((((( Fichiers créés 2008-02-08 to 2008-03-08 )))))))))))))))))))))))))))))))))))) . 2008-03-08 17:26 . 2008-03-08 17:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 17:26 . 2008-03-08 17:26 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-07 22:52 . 2008-03-07 22:52 d-------- C:\_OTMoveIt 2008-03-07 21:33 . 2008-03-07 23:53 d-------- C:\VundoFix Backups 2008-03-05 20:12 . 2008-03-05 20:12 834 ---hs---- C:\WINDOWS\system32\iyajcfcu.tmp 2008-03-05 08:36 . 2008-03-05 08:36 384 --a------ C:\WINDOWS\system32 etwbix32.dll 2008-03-05 00:46 . 2008-03-05 20:10 834 ---hs---- C:\WINDOWS\system32\iyajcfcu.ini 2008-03-02 11:58 . 2008-03-02 11:58 d-------- C:\Program Files\RegSupreme 2008-03-02 11:58 . 2008-03-02 11:58 23 --ahs---- C:\WINDOWS\system32\ecedbecca_g.dll 2008-03-02 11:58 . 2008-03-02 11:58 23 --a------ C:\WINDOWS\system32\acdbbdacd_g.ocx 2008-03-02 11:41 . 2008-03-02 11:57 d-------- C:\Program Files\Safarp 2008-03-01 12:17 . 2008-03-01 12:30 d-------- C:\Program Files\CCleaner 2008-02-29 17:11 . 2008-03-01 12:39 318 --ahs---- C:\WINDOWS\system32\oqstv.ini 2008-02-29 17:06 . 2008-02-29 17:06 34,816 --a------ C:\WINDOWS\system32\iifgefc.dll.vir 2008-02-28 18:27 . 2008-02-28 18:27 d-------- C:\ConvertTemp 2008-02-28 17:50 . 2008-02-28 17:50 d-------- C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\Samsung 2008-02-28 17:42 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2008-02-28 17:41 . 2008-02-28 17:41 d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2008-02-28 17:41 . 2005-12-22 12:24 137,884 --a------ C:\WINDOWS\system32\drivers\sscdmdm.sys 2008-02-28 17:41 . 2005-12-22 12:24 80,272 --a------ C:\WINDOWS\system32\drivers\sscdbus.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,877 --a------ C:\WINDOWS\system32\drivers\sscdcmnt.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,877 --a------ C:\WINDOWS\system32\drivers\sscdcm.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,188 --a------ C:\WINDOWS\system32\drivers\sscdwhnt.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,188 --a------ C:\WINDOWS\system32\drivers\sscdwh.sys 2008-02-28 17:41 . 2005-12-22 12:24 10,864 --a------ C:\WINDOWS\system32\drivers\sscdmdfl.sys 2008-02-28 17:41 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2008-02-28 17:41 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-02-28 17:40 . 2008-02-28 17:40 d-------- C:\Program Files\Samsung 2008-02-26 23:17 . 2008-02-26 23:17 d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared 2008-02-13 16:11 . 2008-02-13 16:11 d-------- C:\WINDOWS\MaxTV 2008-02-13 16:11 . 2008-02-13 16:11 d-------- C:\Program Files\DMV 2008-02-13 08:22 . 2008-02-13 08:22 d-------- C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\JLC's Software 2008-02-13 08:22 . 2008-02-13 08:22 220,160 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\Update.exe 2008-02-13 08:22 . 2008-02-13 08:22 220,160 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\Update.exe 2008-02-13 08:22 . 2008-02-13 08:22 1,214 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\channels.dat 2008-02-13 08:22 . 2008-02-13 08:22 1,214 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\channels.dat 2008-02-12 23:34 . 2008-02-12 23:34 d-------- C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\TuneUp Software 2008-02-11 23:32 . 2008-02-11 23:32 d-------- C:\Documents and Settings\LOURENCO\Application Data\HP 2008-02-09 12:30 . 2008-02-09 12:30 d-------- C:\Program Files\Real Alternative . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-08 16:53 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\OpenOffice.org2 2008-03-08 16:52 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-08 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-07 23:38 --------- d-----w C:\Program Files\WinTV 2008-03-07 15:38 --------- d-----w C:\Program Files\MSN Messenger 2008-03-02 19:51 --------- d-----w C:\Program Files\Windows Live 2008-03-02 10:54 --------- d-----w C:\Program Files\Warcraft II BNE 2008-03-02 10:48 --------- d-----w C:\Program Files\IndustryGiant 2 2008-03-02 10:46 --------- d-----w C:\Program Files\Free FLV Converter 2008-03-02 02:58 --------- d-----w C:\Program Files\PhotoFiltre Studio 2008-02-28 16:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-26 22:19 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-02-26 17:40 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\FrostWire 2008-02-15 20:53 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\gtk-2.0 2008-02-13 11:34 --------- d-----w C:\Program Files\DivX 2008-01-31 17:08 --------- d--h--r C:\Documents and Settings\LOURENCO\Application Data\SecuROM 2008-01-31 16:58 --------- d--h--r C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\SecuROM 2008-01-30 20:53 --------- d-----w C:\Program Files\Bethesda Softworks 2008-01-30 20:50 --------- d--h--r C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\SecuROM 2008-01-30 20:40 --------- d-----w C:\Program Files\Lords of EverQuest 2008-01-30 15:56 --------- d-----w C:\Program Files\JPEG Camera 2008-01-27 21:57 --------- d-----w C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\Talkback 2008-01-27 21:48 --------- d-----w C:\Program Files\Total Video Converter 2008-01-27 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-20 07:57 --------- d-----w C:\Documents and Settings\LOURENCO\Application Data\InstallShield 2008-01-20 07:48 --------- d-----w C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\InstallShield 2008-01-19 23:14 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-01-08 01:16 630,784 ----a-w C:\WINDOWS\system32 sd1BA.tmp 2008-01-04 21:59 9,878 ----a-w C:\WINDOWS\system32 sd1B9.tmp 2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32 ss1B7.tmp 2008-01-04 21:59 4,816 ----a-w C:\WINDOWS\system32 sn1B8.tmp 2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32 sg1AE.tmp 2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32 sv1DC.tmp 2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32 sa1AD.tmp 2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32 sl1DB.tmp 2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32 sa1AC.tmp 2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32 so1B4.tmp 2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32 se1B5.tmp 2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32 sk1AB.tmp 2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32 sv1B6.tmp 2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32 sd1B3.tmp 2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32 su1A7.tmp 2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32 sk1A9.tmp 2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32 sr1B0.tmp 2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32 sz1A8.tmp 2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32 sj1A6.tmp 2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32 sb1AF.tmp 2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32 sf1AA.tmp 2008-01-04 21:56 8,835 ----a-w C:\WINDOWS\system32 sb1B1.tmp 2008-01-04 21:56 3,162 ----a-w C:\WINDOWS\system32 sr1B2.tmp 2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32 se1BB.tmp 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-11 19:39 9,728 ----a-w C:\WINDOWS\system32\Rnaph.dll 2007-10-03 18:52 2,354,472 ----a-w C:\Documents and Settings\kévin.NOM-EB85C523610.000\SVGView.exe 2007-10-03 18:52 2,354,472 ----a-w C:\Documents and Settings\kévin.NOM-EB85C523610.000\SVGView.exe 2007-07-14 22:26 0 ----a-w C:\Program Files\Virtual DJ 3.0 With All Effects 2007-06-02 12:25 40 ----a-w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\language.dat 2007-06-02 12:25 40 ----a-w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\language.dat 2007-01-14 17:04 117 ----a-w C:\Program Files\forevermopt.INI 2006-04-09 18:36 121,169 ----a-w C:\Program Files\INSTALL.LOG 2006-03-04 15:58 75,719 ----a-w C:\Program Files\UnMario.exe 2005-06-08 19:03 1,065 ----a-w C:\Program Files\Read Me 1st.txt 2005-05-11 22:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll 2004-06-12 22:45 245 ----a-w C:\Program Files\mafosav.INI 2004-06-12 20:23 1,208,826 ----a-w C:\Program Files\Info MF.exe 2004-06-06 23:37 13,762,037 ----a-w C:\Program Files\Mario Forever.exe 2004-05-20 13:02 40,792 ----a-w C:\Program Files\ktkm4.dll 2004-05-16 22:00 2,645,872 ----a-w C:\Program Files\ktkm39.dll 2004-01-01 22:12 13,506 ----a-w C:\Program Files\icoinst.bmp 2004-01-01 21:57 132,342 ----a-w C:\Program Files\leftinst.bmp 2003-10-26 18:58 524,537 ----a-w C:\Program Files\ktkm18.dll 2003-10-03 00:04 307,617 ----a-w C:\Program Files\ktkm15.dll 2002-09-15 13:59 47,104 ----a-w C:\Program Files ubberovine.dll 2002-03-03 13:34 538,410 ----a-w C:\Program Files\ktkm20.dll 2002-02-25 18:45 66,908 ----a-w C:\Program Files\ktkm17.dll 2002-02-25 18:44 209,936 ----a-w C:\Program Files\ktkm14.dll 2002-02-25 18:43 99,867 ----a-w C:\Program Files\ktkm13.dll 2002-02-25 18:42 62,631 ----a-w C:\Program Files\ktkm11.dll 2002-02-25 18:42 116,841 ----a-w C:\Program Files\ktkm26.dll 2002-02-25 18:38 81,427 ----a-w C:\Program Files\ktkm31.dll 2002-02-25 18:37 326,441 ----a-w C:\Program Files\ktkm32.dll 2002-02-25 18:35 92,400 ----a-w C:\Program Files\ktkm7.dll 2002-02-25 18:33 268,621 ----a-w C:\Program Files\ktkm33.dll 2002-02-25 18:31 197,408 ----a-w C:\Program Files\ktkm29.dll 2002-02-25 18:02 70,888 ----a-w C:\Program Files\ktkm19.dll 2002-02-25 17:57 58,192 ----a-w C:\Program Files\ktkm6.dll 2002-02-25 17:55 96,166 ----a-w C:\Program Files\ktkm1.dll 2002-02-25 17:49 55,186 ----a-w C:\Program Files\ktkm5.dll 2002-02-25 17:44 22,657 ----a-w C:\Program Files\ktkm3.dll 2002-02-25 17:37 20,926 ----a-w C:\Program Files\ktkm36.dll 2002-02-25 17:36 58,015 ----a-w C:\Program Files\ktkm10.dll 2002-02-25 17:32 20,974 ----a-w C:\Program Files\ktkm2.dll 2002-02-25 17:32 169,789 ----a-w C:\Program Files\ktkm38.dll 2002-02-25 17:31 128,042 ----a-w C:\Program Files\ktkm30.dll 2001-11-27 13:47 73,728 ----a-w C:\Program Files\CCTrans.dll 2001-11-27 13:46 285,696 ----a-w C:\Program Files\cncs232.dll 2001-09-28 15:00 164,864 ----a-w C:\Program Files\UNWISE.EXE 2000-11-05 16:56 81,920 ----a-w C:\Program Files\STrans.dll 2000-06-20 22:04 113,152 ----a-w C:\Program Files\SFTrans.dll 2005-05-13 15:12 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 09:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 19:27 422,400 --sha-r C:\WINDOWS\x2.64.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e1b8f60-a6ee-490c-97eb-92f304ed4fa4}] C:\WINDOWS\system32 muxkasf.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D8B8DBD-836E-4733-A740-D1183EBC333A}] C:\WINDOWS\system32\ddaby.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB0B543C-7D51-4036-A883-18ACAF4C4EE8}] C:\WINDOWS\system32\vturs.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 01:45 68856] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-19 16:31 3477504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 18:06 88363 C:\WINDOWS\AGRSMMSG.exe] "KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 20:02 61440] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-04 04:10 344064] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 21:47 57344 C:\WINDOWS\ALCXMNTR.EXE] "PS2"="C:\WINDOWS\system32\ps2.exe" [2003-09-12 20:13 98304] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18 241664] "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 19:00 94208] "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 02:50 139320] "Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48 147514] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 14:24 257088] "atwtusb"="atwtusb.exe" [2004-05-03 16:03 344140 C:\WINDOWS\system32\atwtusb.exe] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 22:54 253952] "EPGServiceTool"="C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe" [2006-11-28 15:07 688128] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 15:32 225280] "EEventManager"="C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 15:57 102400] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "BMd7e923e9"="C:\WINDOWS\system32 nwgendu.dll" [ ] "Waiting1690"="C:\Windows\stid1690.exe" [ ] "d4da1075"="C:\WINDOWS\system32\uehsjtpf.dll" [ ] C:\Documents and Settings\Compaq_Propri‚taire.NOM-EB85C523610.000\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-09-18 18:48:35 110592] OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-09-18 18:48:35 110592] AutoStart IR.lnk - C:\Program Files\WinTV\Ir.exe [2007-10-14 19:07:48 106551] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624] Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2005-09-24 07:05:26 29696] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Shareaza\Shareaza.exe"= "C:\Program Files\Windows Media Player\wmplayer.exe"= "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"= "C:\Program Files\BitComet\BitComet.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10100:TCP"= 10100:TCP:BitComet 10100 TCP "10100:UDP"= 10100:UDP:BitComet 10100 UDP R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-02-24 15:42] S1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-11-08 19:31] S2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [] S2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-05 19:00] S3 a94d5b89-a6c6-497e-8f6f-0115159991c4;a94d5b89-a6c6-497e-8f6f-0115159991c4;F:\Player\cds300.dll [] S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;C:\WINDOWS\system32\Drivers\cam1690.sys [2007-06-09 21:20] S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2007-02-20 14:11] S3 hcw95bda;Hauppauge MOD7700 Tuner Driver;C:\WINDOWS\system32\Drivers\hcw95bda.sys [2007-04-04 19:45] S3 hcw95rc;Hauppauge MOD7700 IR Driver;C:\WINDOWS\system32\DRIVERS\hcw95rc.sys [2007-04-04 19:48] S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-02-29 13:28:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-07 16:15:53 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2008-03-08 10:41:52 C:\WINDOWS\Tasks\WebReg Deskjet 5900 series.job" - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-08 21:09:02 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-03-08 21:11:16 ComboFix-quarantined-files.txt 2008-03-08 20:10:49 . 2008-02-13 21:47:17 --- E O F ---

goaaa · Answer

alors?

jorginho67 · Answer

Heuuuu... je dois analyser le rapport Ligne par Ligne.......

Donc 20 minutes, l'ai pas encore fini....

goaaa · Answer

oula daccord merci de prendre du temps pour moi alors c'est vraiment cool de ta part ^^

jorginho67 · Answer

Crée un nouveau document texte et nomme le CFScript.txt ( attention très important ! ) : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes en gras :

file::

C:\WINDOWS\system32\rmuxkasf.dll
C:\WINDOWS\system32\ddaby.dll
C:\WINDOWS\system32\vturs.dll 

registry::

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e1b8f60-a6ee-490c-97eb-92f304ed4fa4}]
C:\WINDOWS\system32\rmuxkasf.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D8B8DBD-836E-4733-A740-D1183EBC333A}]
C:\WINDOWS\system32\ddaby.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB0B543C-7D51-4036-A883-18ACAF4C4EE8}]
C:\WINDOWS\system32\vturs.dll



ensuite fais glisser le fichier texte sur combo.exe comme sur l'animation :
http://img.bleepingcomputer.com/combofix/usage/rc.gif

Dans la fenêtre qui suit, choisie l'option 1 puis valide
Patiente un peu, si le bureau disparait parfois durant le scan : c'est normal !
A la fin du scan, un rapport va s'afficher : poste le stp ( sinon il se situe dans ici : C:\ComboFix.txt )

goaaa · Answer

ok si je fait sa en mode sans echec ya pas de probleme?

jorginho67 · Answer

tu n'arrive pas a le faire en mode normal ?

Si non, fait le en MsE

goaaa · Answer

dac je vai essayer en normal et sinan en sE

goaaa · Answer

Bon alors mode sans echec puis rendu du rapport en mode normal apres demarage ComboFix 08-03-07.4 - Compaq_Propriétaire 2008-03-08 22:24:01.5 - NTFSx86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.355 [GMT 1:00] Endroit: C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Compaq_PropriÚtaire.NOM-EB85C523610.000\Bureau\CFScript.txt.txt . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Bureau\webmediaplayer.lnk C:\Documents and Settings\kévin.NOM-EB85C523610.000\Bureau\internetgamebox.lnk C:\Documents and Settings\kévin.NOM-EB85C523610.000\Local Settings\Application Data\kkqikzzgsr.dat C:\Documents and Settings\kévin.NOM-EB85C523610.000\Local Settings\Application Data\kkqikzzgsr.exe C:\Documents and Settings\kévin.NOM-EB85C523610.000\Local Settings\Application Data\kkqikzzgsr_nav.dat C:\Documents and Settings\kévin.NOM-EB85C523610.000\Local Settings\Application Data\kkqikzzgsr_navps.dat C:\WINDOWS\system32\ecedbecca_g.dll C:\WINDOWS\system32 etwbix32.dll . ((((((((((((((((((((((((((((( Fichiers créés 2008-02-08 to 2008-03-08 )))))))))))))))))))))))))))))))))))) . 2008-03-08 17:26 . 2008-03-08 17:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 17:26 . 2008-03-08 17:26 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-07 22:52 . 2008-03-07 22:52 d-------- C:\_OTMoveIt 2008-03-07 21:33 . 2008-03-07 23:53 d-------- C:\VundoFix Backups 2008-03-05 20:12 . 2008-03-05 20:12 834 ---hs---- C:\WINDOWS\system32\iyajcfcu.tmp 2008-03-05 00:46 . 2008-03-05 20:10 834 ---hs---- C:\WINDOWS\system32\iyajcfcu.ini 2008-03-02 11:58 . 2008-03-02 11:58 d-------- C:\Program Files\RegSupreme 2008-03-02 11:58 . 2008-03-02 11:58 23 --a------ C:\WINDOWS\system32\acdbbdacd_g.ocx 2008-03-02 11:41 . 2008-03-02 11:57 d-------- C:\Program Files\Safarp 2008-03-01 12:17 . 2008-03-01 12:30 d-------- C:\Program Files\CCleaner 2008-02-29 17:11 . 2008-03-01 12:39 318 --ahs---- C:\WINDOWS\system32\oqstv.ini 2008-02-29 17:06 . 2008-02-29 17:06 34,816 --a------ C:\WINDOWS\system32\iifgefc.dll.vir 2008-02-28 18:27 . 2008-02-28 18:27 d-------- C:\ConvertTemp 2008-02-28 17:42 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2008-02-28 17:41 . 2008-02-28 17:41 d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2008-02-28 17:41 . 2005-12-22 12:24 137,884 --a------ C:\WINDOWS\system32\drivers\sscdmdm.sys 2008-02-28 17:41 . 2005-12-22 12:24 80,272 --a------ C:\WINDOWS\system32\drivers\sscdbus.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,877 --a------ C:\WINDOWS\system32\drivers\sscdcmnt.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,877 --a------ C:\WINDOWS\system32\drivers\sscdcm.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,188 --a------ C:\WINDOWS\system32\drivers\sscdwhnt.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,188 --a------ C:\WINDOWS\system32\drivers\sscdwh.sys 2008-02-28 17:41 . 2005-12-22 12:24 10,864 --a------ C:\WINDOWS\system32\drivers\sscdmdfl.sys 2008-02-28 17:41 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2008-02-28 17:41 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-02-28 17:40 . 2008-02-28 17:40 d-------- C:\Program Files\Samsung 2008-02-26 23:17 . 2008-02-26 23:17 d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared 2008-02-13 16:11 . 2008-02-13 16:11 d-------- C:\WINDOWS\MaxTV 2008-02-13 16:11 . 2008-02-13 16:11 d-------- C:\Program Files\DMV 2008-02-11 23:32 . 2008-02-11 23:32 d-------- C:\Documents and Settings\LOURENCO\Application Data\HP 2008-02-09 12:30 . 2008-02-09 12:30 d-------- C:\Program Files\Real Alternative . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-08 21:05 --------- d-----w C:\Program Files\WinTV 2008-03-08 16:52 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-08 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-07 15:38 --------- d-----w C:\Program Files\MSN Messenger 2008-03-02 19:51 --------- d-----w C:\Program Files\Windows Live 2008-03-02 10:54 --------- d-----w C:\Program Files\Warcraft II BNE 2008-03-02 10:48 --------- d-----w C:\Program Files\IndustryGiant 2 2008-03-02 10:46 --------- d-----w C:\Program Files\Free FLV Converter 2008-03-02 02:58 --------- d-----w C:\Program Files\PhotoFiltre Studio 2008-02-28 16:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-26 22:19 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-02-13 11:34 --------- d-----w C:\Program Files\DivX 2008-01-31 17:08 --------- d--h--r C:\Documents and Settings\LOURENCO\Application Data\SecuROM 2008-01-30 20:53 --------- d-----w C:\Program Files\Bethesda Softworks 2008-01-30 20:40 --------- d-----w C:\Program Files\Lords of EverQuest 2008-01-30 15:56 --------- d-----w C:\Program Files\JPEG Camera 2008-01-27 21:48 --------- d-----w C:\Program Files\Total Video Converter 2008-01-27 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-20 07:57 --------- d-----w C:\Documents and Settings\LOURENCO\Application Data\InstallShield 2007-07-14 22:26 0 ----a-w C:\Program Files\Virtual DJ 3.0 With All Effects 2007-01-14 17:04 117 ----a-w C:\Program Files\forevermopt.INI 2006-04-09 18:36 121,169 ----a-w C:\Program Files\INSTALL.LOG 2006-03-04 15:58 75,719 ----a-w C:\Program Files\UnMario.exe 2005-06-08 19:03 1,065 ----a-w C:\Program Files\Read Me 1st.txt 2004-06-12 22:45 245 ----a-w C:\Program Files\mafosav.INI 2004-06-12 20:23 1,208,826 ----a-w C:\Program Files\Info MF.exe 2004-06-06 23:37 13,762,037 ----a-w C:\Program Files\Mario Forever.exe 2004-05-20 13:02 40,792 ----a-w C:\Program Files\ktkm4.dll 2004-05-16 22:00 2,645,872 ----a-w C:\Program Files\ktkm39.dll 2004-01-01 22:12 13,506 ----a-w C:\Program Files\icoinst.bmp 2004-01-01 21:57 132,342 ----a-w C:\Program Files\leftinst.bmp 2003-10-26 18:58 524,537 ----a-w C:\Program Files\ktkm18.dll 2003-10-03 00:04 307,617 ----a-w C:\Program Files\ktkm15.dll 2002-09-15 13:59 47,104 ----a-w C:\Program Files ubberovine.dll 2002-03-03 13:34 538,410 ----a-w C:\Program Files\ktkm20.dll 2002-02-25 18:45 66,908 ----a-w C:\Program Files\ktkm17.dll 2002-02-25 18:44 209,936 ----a-w C:\Program Files\ktkm14.dll 2002-02-25 18:43 99,867 ----a-w C:\Program Files\ktkm13.dll 2002-02-25 18:42 62,631 ----a-w C:\Program Files\ktkm11.dll 2002-02-25 18:42 116,841 ----a-w C:\Program Files\ktkm26.dll 2002-02-25 18:38 81,427 ----a-w C:\Program Files\ktkm31.dll 2002-02-25 18:37 326,441 ----a-w C:\Program Files\ktkm32.dll 2002-02-25 18:35 92,400 ----a-w C:\Program Files\ktkm7.dll 2002-02-25 18:33 268,621 ----a-w C:\Program Files\ktkm33.dll 2002-02-25 18:31 197,408 ----a-w C:\Program Files\ktkm29.dll 2002-02-25 18:02 70,888 ----a-w C:\Program Files\ktkm19.dll 2002-02-25 17:57 58,192 ----a-w C:\Program Files\ktkm6.dll 2002-02-25 17:55 96,166 ----a-w C:\Program Files\ktkm1.dll 2002-02-25 17:49 55,186 ----a-w C:\Program Files\ktkm5.dll 2002-02-25 17:44 22,657 ----a-w C:\Program Files\ktkm3.dll 2002-02-25 17:37 20,926 ----a-w C:\Program Files\ktkm36.dll 2002-02-25 17:36 58,015 ----a-w C:\Program Files\ktkm10.dll 2002-02-25 17:32 20,974 ----a-w C:\Program Files\ktkm2.dll 2002-02-25 17:32 169,789 ----a-w C:\Program Files\ktkm38.dll 2002-02-25 17:31 128,042 ----a-w C:\Program Files\ktkm30.dll 2001-11-27 13:47 73,728 ----a-w C:\Program Files\CCTrans.dll 2001-11-27 13:46 285,696 ----a-w C:\Program Files\cncs232.dll 2001-09-28 15:00 164,864 ----a-w C:\Program Files\UNWISE.EXE 2000-11-05 16:56 81,920 ----a-w C:\Program Files\STrans.dll 2000-06-20 22:04 113,152 ----a-w C:\Program Files\SFTrans.dll 2000-02-28 16:26 92,660 ----a-w C:\Program Files\bass.dll 1999-03-25 09:55 56,992 ----a-w C:\Program Files\ktkm24.dll 1998-08-11 14:08 64,070 ----a-w C:\Program Files\ktkm21.dll 1998-07-01 10:29 30,166 ----a-w C:\Program Files\ktkm9.dll 1998-06-29 03:16 10,240 ----a-w C:\Program Files\ktkm34.dll 1998-04-22 23:27 23,364 ----a-w C:\Program Files\ktkm8.dll 1997-10-09 18:27 98,442 ----a-w C:\Program Files\ktkm35.dll 1997-05-09 13:14 370,880 ----a-w C:\Program Files\ktkm22.dll 1997-03-18 08:13 803,601 ----a-w C:\Program Files\ktkm16.dll 1997-01-18 13:45 524,164 ----a-w C:\Program Files\ktkm12.dll 1996-04-02 13:02 65,092 ----a-w C:\Program Files\ktkm27.dll 1996-04-02 13:02 49,094 ----a-w C:\Program Files\ktkm25.dll 1996-04-02 13:01 126,720 ----a-w C:\Program Files\ktkm23.dll 1994-10-06 10:14 82,542 ----a-w C:\Program Files\ktkm37.dll 1994-04-01 21:26 100,786 ----a-w C:\Program Files\ktkm28.dll 2005-05-13 15:12 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 09:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 19:27 422,400 --sha-r C:\WINDOWS\x2.64.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e1b8f60-a6ee-490c-97eb-92f304ed4fa4}] C:\WINDOWS\system32 muxkasf.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D8B8DBD-836E-4733-A740-D1183EBC333A}] C:\WINDOWS\system32\ddaby.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB0B543C-7D51-4036-A883-18ACAF4C4EE8}] C:\WINDOWS\system32\vturs.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 01:45 68856] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-19 16:31 3477504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 18:06 88363 C:\WINDOWS\AGRSMMSG.exe] "KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 20:02 61440] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-04 04:10 344064] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 21:47 57344 C:\WINDOWS\ALCXMNTR.EXE] "PS2"="C:\WINDOWS\system32\ps2.exe" [2003-09-12 20:13 98304] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18 241664] "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 19:00 94208] "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 02:50 139320] "Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48 147514] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 14:24 257088] "atwtusb"="atwtusb.exe" [2004-05-03 16:03 344140 C:\WINDOWS\system32\atwtusb.exe] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 22:54 253952] "EPGServiceTool"="C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe" [2006-11-28 15:07 688128] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 15:32 225280] "EEventManager"="C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 15:57 102400] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "BMd7e923e9"="C:\WINDOWS\system32 nwgendu.dll" [ ] "Waiting1690"="C:\Windows\stid1690.exe" [ ] "d4da1075"="C:\WINDOWS\system32\uehsjtpf.dll" [ ] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Shareaza\Shareaza.exe"= "C:\Program Files\Windows Media Player\wmplayer.exe"= "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"= "C:\Program Files\BitComet\BitComet.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10100:TCP"= 10100:TCP:BitComet 10100 TCP "10100:UDP"= 10100:UDP:BitComet 10100 UDP R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11] R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-11-08 19:31] R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-05 19:00] R3 CAM1690;USB 2.0 Compliance JPEG Video Camera;C:\WINDOWS\system32\Drivers\cam1690.sys [2007-06-09 21:20] R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;C:\WINDOWS\system32\Drivers\hcw95bda.sys [2007-04-04 19:45] R3 hcw95rc;Hauppauge MOD7700 IR Driver;C:\WINDOWS\system32\DRIVERS\hcw95rc.sys [2007-04-04 19:48] R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-02-24 15:42] S2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [] S3 a94d5b89-a6c6-497e-8f6f-0115159991c4;a94d5b89-a6c6-497e-8f6f-0115159991c4;F:\Player\cds300.dll [] S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2007-02-20 14:11] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-02-29 13:28:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-07 16:15:53 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2008-03-08 10:41:52 C:\WINDOWS\Tasks\WebReg Deskjet 5900 series.job" - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-08 22:32:36 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe C:\WINDOWS\system32\CTsvcCDA.exe c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\PROGRA~1\NETWOR~1\COMMON~1 aPrdMgr.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WinTV\Ir.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe . ************************************************************************** . Temps d'accomplissement: 2008-03-08 22:36:46 - machine was rebooted [Compaq_Propri‚taire] ComboFix-quarantined-files.txt 2008-03-08 21:36:42 ComboFix2.txt 2008-03-08 20:11:17 . 2008-02-13 21:47:17 --- E O F ---

goaaa · Answer

...................c'est bon?

goaaa · Answer

jorginho67  (0 _ 0) ??

jorginho67 · Answer

Il va falloir analyser un fichier suspect ! Il se peut qu'il se trouve dans les " dossiers cachés " du systeme. Il faut donc les rendre visibles pour le scan. Pour afficher les dossiers et fichiers cachés: Panneau de configuration > Options des dossiers > onglet Affichage. coche Afficher les fichiers et dossiers cachés, décoche Masquer les extensions de fichiers connus décoche Masquer les fichiers protégés du Système. Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix. Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. Lorsque tu aura fini d'intervenir dans les répertoires système, fait la manip inverse pour recacher les fichiers système. Rend toi chez Virus Total pour analyser ce fichier. Clik sur parcourir Recherche ceci : C:\Windows\stid1690.exe C:\WINDOWS\system32\uehsjtpf.dll Fais le un dossier à la fois ! Clik send et poste le rapport ici stp Comment faire <<< Aide toi de ce tuto.

goaaa · Answer

Fichier stic1690.exe reçu le 2008.03.09 01:17:18 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/32 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 19.
L'heure estimée de démarrage est entre 101 et 145 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email: 	
	
Antivirus 	Version 	Dernière mise à jour 	Résultat
AhnLab-V3	2008.3.4.0	2008.03.07	-
AntiVir	7.6.0.73	2008.03.07	-
Authentium	4.93.8	2008.03.07	-
Avast	4.7.1098.0	2008.03.08	-
AVG	7.5.0.516	2008.03.08	-
BitDefender	7.2	2008.03.08	-
CAT-QuickHeal	9.50	2008.03.08	-
ClamAV	0.92.1	2008.03.08	-
DrWeb	4.44.0.09170	2008.03.08	-
eSafe	7.0.15.0	2008.03.06	-
eTrust-Vet	31.3.5597	2008.03.07	-
Ewido	4.0	2008.03.08	-
FileAdvisor	1	2008.03.09	-
Fortinet	3.14.0.0	2008.03.08	-
F-Prot	4.4.2.54	2008.03.08	-
F-Secure	6.70.13260.0	2008.03.08	-
Ikarus	T3.1.1.20	2008.03.08	-
Kaspersky	7.0.0.125	2008.03.09	-
McAfee	5247	2008.03.07	-
Microsoft	1.3301	2008.03.07	-
NOD32v2	2932	2008.03.09	-
Norman	5.80.02	2008.03.07	-
Panda	9.0.0.4	2008.03.08	-
Prevx1	V2	2008.03.09	-
Rising	20.34.52.00	2008.03.08	-
Sophos	4.27.0	2008.03.08	-
Sunbelt	3.0.930.0	2008.03.05	-
Symantec	10	2008.03.08	-
TheHacker	6.2.92.238	2008.03.08	-
VBA32	3.12.6.2	2008.03.05	-
VirusBuster	4.3.26:9	2008.03.08	-
Webwasher-Gateway	6.6.2	2008.03.08	-
Information additionnelle
File size: 1597440 bytes
MD5: 471ece7bd691d05e4040b68bd001df37
SHA1: a1db5962e0a0b480ee670519a6fc6c7f82e5c925
PEiD: InstallShield 2000

je n'ai pas trouver le deuxieme

jorginho67 · Answer

bon, je verrais ça demain, car je dois me lever tot...

@+

goaaa · Answer

ok +

goaaa · Answer

alors keske je fait maintenant ??

goaaa · Answer

?????

goaaa · Answer

jorginho67 si tu pouvait repasser que j'en finisse une bonne fois pour toute avec ce probleme sa srait cool ;) merci

jorginho67 · Answer

Télécharge Malwarebytes' Anti-malware <<  ici 
TUTO D'UTILISATION

Double-clique sur le fichier mbam-setup.exe pour lancer l'installation
ensuite laisse toi guider: 

cocher la case pour la mise à jour immédiate 

Clic sur " Executer un examen complet ".
lance le scan en cliquant sur Lancer l'examen....

A la fin du scan clique sur " Afficher les résultats ".
Clique ensuite sur " Supprimer la sélection ". 
une fois le nettoyage achevé,le rapport s'ouvre,  copie/colle celui ci  sur le forum.

goaaa · Answer

voila assez long tout sa voici le rapport et au faite pendant que sa scannai virusscan ma affiché sa https://www.hiboox.com  voici le rapport :

Malwarebytes' Anti-Malware 1.07
Version de la base de données: 470

Type de recherche: Examen complet (C:\|D:\|H:\|I:\|J:\|K:\|)
Eléments examinés: 224478
Temps écoulé: 2 hour(s), 7 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\SystemDefender (Rogue.SystemDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\SystemDefender\logs (Rogue.SystemDefender) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\SystemDefender\logs\1192468960.log (Rogue.SystemDefender) -> Quarantined and deleted successfully.

jorginho67 · Answer

ça m'a l'air ok çà....

reposte un hijackthis stp....

goaaa · Answer

voila j'espere que c bon  

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:52:28, on 09/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atwtusb.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\PhotoFiltre Studio\pf-studio.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {4af4de40-3f29-be79-c094-ee6a06f8b1e2} - {2e1b8f60-a6ee-490c-97eb-92f304ed4fa4} - C:\WINDOWS\system32muxkasf.dll (file missing)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: (no name) - {5D8B8DBD-836E-4733-A740-D1183EBC333A} - C:\WINDOWS\system32\ddaby.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} - C:\WINDOWS\system32\vturs.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKLM\..\Run: [Waiting1690] C:\Windows\stid1690.exe
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 81.253.149.9 80.10.246.132
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

goaaa · Answer

verdicte?

jorginho67 · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". O2 - BHO: {4af4de40-3f29-be79-c094-ee6a06f8b1e2} - {2e1b8f60-a6ee-490c-97eb-92f304ed4fa4} - C:\WINDOWS\system32 muxkasf.dll (file missing) O2 - BHO: (no name) - {5D8B8DBD-836E-4733-A740-D1183EBC333A} - C:\WINDOWS\system32\ddaby.dll (file missing) O2 - BHO: (no name) - {EB0B543C-7D51-4036-A883-18ACAF4C4EE8} - C:\WINDOWS\system32\vturs.dll (file missing) O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" tuto en images iL ya des nouvelles incrustes a chaque fois ...... Pour afficher les dossiers et fichiers cachés: Panneau de configuration > Options des dossiers > onglet Affichage. coche Afficher les fichiers et dossiers cachés, décoche Masquer les extensions de fichiers connus décoche Masquer les fichiers protégés du Système. Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix. Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. Lorsque tu aura fini d'intervenir dans les répertoires système, fait la manip inverse pour recacher les fichiers système. Rend toi chez Virus Total pour analyser ce fichier. Clik sur parcourir Recherche ceci : C:\WINDOWS\system32 nwgendu.dll C:\WINDOWS\system32\uehsjtpf.dll C:\Windows\stid1690.exe Fais le un dossier à la fois ! Clik send et poste le rapport ici stp Comment faire <<< Aide toi de ce tuto.

goaaa · Answer

voila j'ai fait c'que tu ma dit sur hijack par contre les fichiers sur virus total introuvable sauf le dernier stid1690.exe voila le rapport 

Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.3.4.0	2008.03.07	-
AntiVir	7.6.0.73	2008.03.07	-
Authentium	4.93.8	2008.03.07	-
Avast	4.7.1098.0	2008.03.09	-
AVG	7.5.0.516	2008.03.09	-
BitDefender	7.2	2008.03.09	-
CAT-QuickHeal	9.50	2008.03.08	-
ClamAV	0.92.1	2008.03.09	-
DrWeb	4.44.0.09170	2008.03.09	-
eSafe	7.0.15.0	2008.03.09	-
eTrust-Vet	31.3.5597	2008.03.07	-
Ewido	4.0	2008.03.09	-
FileAdvisor	1	2008.03.09	-
Fortinet	3.14.0.0	2008.03.08	-
F-Prot	4.4.2.54	2008.03.08	-
F-Secure	6.70.13260.0	2008.03.09	-
Ikarus	T3.1.1.20	2008.03.09	-
Kaspersky	7.0.0.125	2008.03.09	-
McAfee	5247	2008.03.07	-
Microsoft	1.3301	2008.03.07	-
NOD32v2	2932	2008.03.09	-
Norman	5.80.02	2008.03.07	-
Panda	9.0.0.4	2008.03.09	-
Prevx1	V2	2008.03.09	-
Rising	20.34.62.00	2008.03.09	-
Sophos	4.27.0	2008.03.09	-
Sunbelt	3.0.930.0	2008.03.05	-
Symantec	10	2008.03.09	-
TheHacker	6.2.92.238	2008.03.08	-
VBA32	3.12.6.2	2008.03.05	-
VirusBuster	4.3.26:9	2008.03.08	-
Webwasher-Gateway	6.6.2	2008.03.09	-
Information additionnelle
File size: 1597440 bytes
MD5: 471ece7bd691d05e4040b68bd001df37
SHA1: a1db5962e0a0b480ee670519a6fc6c7f82e5c925
PEiD: InstallShield 2000

goaaa · Answer

je viens de redémarer le pc et toujours les 2 messages RUNDLL qui s'affiche comme quoi les les modules tnwgendu.dll et uehsjtpf.dll n'on pas eté trouver

goaaa · Answer

?????????????????

jorginho67 · Answer

Nettoies ta base de registre avec Regcleaner stp
http://www.commentcamarche.net/telecharger/telecharger 171 regcleaner
Tutoriel d'utilisation

goaaa · Answer

voila c'est fait je poste autre chose ou bien c'est terminer?

jorginho67 · Answer

Tu as toujours le message d'erreur ?

goaaa · Answer

ouai toujours

goaaa · Answer

alors comment faire pour supprimer ces foutu message??

jorginho67 · Answer

C'est vrai que ça devient barbant...

reposte moi un Hijack stp...

goaaa · Answer

tu m'étonne  


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:38:27, on 09/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\svchost.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 81.253.149.9 80.10.246.132
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

goaaa · Answer

alors jorginho67 ?

jorginho67 · Answer

O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32	nwgendu.dll",s
O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b 

je cherche, je cherche......

goaaa · Answer

dac si je comprend bien ta une piste

jorginho67 · Answer

Après avoir le conseil d'une collegue, fais ce qui suit stp :

Attention, cette manip est faite pour ce cas précis ! 
Toute réutilisation pour un autre ordinateur est susceptible d'endommager gravement le système.


on reprend   
ComboFix avec CFScript :

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie/colle dedans les lignes suivantes :

file::

C:\WINDOWS\system32	nwgendu.dll
C:\WINDOWS\system32\uehsjtpf.dll
C:\WINDOWS\system32muxkasf.dll
C:\WINDOWS\system32\ddaby.dll
C:\WINDOWS\system32\vturs.dll

registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e1b8f60-a6ee-490c-97eb-92f304ed4fa4}]


[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D8B8DBD-836E-4733-A740-D1183EBC333A}]


[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB0B543C-7D51-4036-A883-18ACAF4C4EE8}]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BMd7e923e9"=-

"d4da1075"=-  




Déconnecte toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement

* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe ( sur ton bureau )
* Une fenêtre bleue va apparaître: au message qui apparaît Type 1 to continue, or 2 to abort , tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
* Poste aussi un nouveau rapport Hijackthis stp et dis moi si tu constates des améliorations ...

goaaa · Answer

alors jai fait sa en sans echec et au faite au début jai le message ki me di de fermé les programes ou je repond oui par contre (type 1 to continue, or 2 to abort) jai jamai se choix ki aparai , le scan commence direct apres avoir cré un point de restauration sinan ba jai bien deplacé le fichier text a linterieur ke jai nomé CFScript.txt avec se que tu ma dit de copier et au redémarage toujour les messages ki saffiche ComboFix 08-03-07.4 - Compaq_Propriétaire 2008-03-09 20:38:33.7 - NTFSx86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.359 [GMT 1:00] Endroit: C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Compaq_PropriÚtaire.NOM-EB85C523610.000\Bureau\CFScript.txt.txt . ((((((((((((((((((((((((((((( Fichiers créés 2008-02-09 to 2008-03-09 )))))))))))))))))))))))))))))))))))) . 2008-03-09 18:38 . 2008-03-09 18:50 d-------- C:\Program Files\RegCleaner 2008-03-09 13:12 . 2008-03-09 13:12 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-03-09 13:12 . 2008-03-09 13:12 d-------- C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\Malwarebytes 2008-03-09 13:12 . 2008-03-09 13:12 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-03-08 17:26 . 2008-03-08 17:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-08 17:26 . 2008-03-08 17:26 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-07 22:52 . 2008-03-07 22:52 d-------- C:\_OTMoveIt 2008-03-07 21:33 . 2008-03-07 23:53 d-------- C:\VundoFix Backups 2008-03-05 20:12 . 2008-03-05 20:12 834 ---hs---- C:\WINDOWS\system32\iyajcfcu.tmp 2008-03-05 00:46 . 2008-03-05 20:10 834 ---hs---- C:\WINDOWS\system32\iyajcfcu.ini 2008-03-02 11:58 . 2008-03-02 11:58 d-------- C:\Program Files\RegSupreme 2008-03-02 11:58 . 2008-03-02 11:58 23 --a------ C:\WINDOWS\system32\acdbbdacd_g.ocx 2008-03-02 11:41 . 2008-03-02 11:57 d-------- C:\Program Files\Safarp 2008-03-01 12:17 . 2008-03-01 12:30 d-------- C:\Program Files\CCleaner 2008-02-29 17:11 . 2008-03-01 12:39 318 --ahs---- C:\WINDOWS\system32\oqstv.ini 2008-02-29 17:06 . 2008-02-29 17:06 34,816 --a------ C:\WINDOWS\system32\iifgefc.dll.vir 2008-02-28 18:27 . 2008-02-28 18:27 d-------- C:\ConvertTemp 2008-02-28 17:50 . 2008-02-28 17:50 d-------- C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\Samsung 2008-02-28 17:42 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2008-02-28 17:41 . 2008-02-28 17:41 d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2008-02-28 17:41 . 2005-12-22 12:24 137,884 --a------ C:\WINDOWS\system32\drivers\sscdmdm.sys 2008-02-28 17:41 . 2005-12-22 12:24 80,272 --a------ C:\WINDOWS\system32\drivers\sscdbus.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,877 --a------ C:\WINDOWS\system32\drivers\sscdcmnt.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,877 --a------ C:\WINDOWS\system32\drivers\sscdcm.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,188 --a------ C:\WINDOWS\system32\drivers\sscdwhnt.sys 2008-02-28 17:41 . 2005-12-22 12:24 11,188 --a------ C:\WINDOWS\system32\drivers\sscdwh.sys 2008-02-28 17:41 . 2005-12-22 12:24 10,864 --a------ C:\WINDOWS\system32\drivers\sscdmdfl.sys 2008-02-28 17:41 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2008-02-28 17:41 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-02-28 17:40 . 2008-02-28 17:40 d-------- C:\Program Files\Samsung 2008-02-26 23:17 . 2008-02-26 23:17 d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared 2008-02-13 16:11 . 2008-02-13 16:11 d-------- C:\WINDOWS\MaxTV 2008-02-13 16:11 . 2008-02-13 16:11 d-------- C:\Program Files\DMV 2008-02-13 08:22 . 2008-02-13 08:22 d-------- C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\JLC's Software 2008-02-13 08:22 . 2008-02-13 08:22 220,160 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\Update.exe 2008-02-13 08:22 . 2008-02-13 08:22 220,160 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\Update.exe 2008-02-13 08:22 . 2008-02-13 08:22 1,214 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\channels.dat 2008-02-13 08:22 . 2008-02-13 08:22 1,214 --a------ C:\Documents and Settings\kévin.NOM-EB85C523610.000\channels.dat 2008-02-12 23:34 . 2008-02-12 23:34 d-------- C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\TuneUp Software 2008-02-11 23:32 . 2008-02-11 23:32 d-------- C:\Documents and Settings\LOURENCO\Application Data\HP 2008-02-09 12:30 . 2008-02-09 12:30 d-------- C:\Program Files\Real Alternative . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-09 18:21 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\OpenOffice.org2 2008-03-08 22:40 --------- d-----w C:\Program Files\WinTV 2008-03-08 16:52 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-08 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-07 15:38 --------- d-----w C:\Program Files\MSN Messenger 2008-03-02 19:51 --------- d-----w C:\Program Files\Windows Live 2008-03-02 10:54 --------- d-----w C:\Program Files\Warcraft II BNE 2008-03-02 10:48 --------- d-----w C:\Program Files\IndustryGiant 2 2008-03-02 10:46 --------- d-----w C:\Program Files\Free FLV Converter 2008-03-02 02:58 --------- d-----w C:\Program Files\PhotoFiltre Studio 2008-02-28 16:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-26 22:19 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-02-26 17:40 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\FrostWire 2008-02-15 20:53 --------- d-----w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\gtk-2.0 2008-02-13 11:34 --------- d-----w C:\Program Files\DivX 2008-01-31 17:08 --------- d--h--r C:\Documents and Settings\LOURENCO\Application Data\SecuROM 2008-01-31 16:58 --------- d--h--r C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\SecuROM 2008-01-30 20:53 --------- d-----w C:\Program Files\Bethesda Softworks 2008-01-30 20:50 --------- d--h--r C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\Application Data\SecuROM 2008-01-30 20:40 --------- d-----w C:\Program Files\Lords of EverQuest 2008-01-30 15:56 --------- d-----w C:\Program Files\JPEG Camera 2008-01-27 21:57 --------- d-----w C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\Talkback 2008-01-27 21:48 --------- d-----w C:\Program Files\Total Video Converter 2008-01-27 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-20 07:57 --------- d-----w C:\Documents and Settings\LOURENCO\Application Data\InstallShield 2008-01-20 07:48 --------- d-----w C:\Documents and Settings\kévin.NOM-EB85C523610.000\Application Data\InstallShield 2008-01-19 23:14 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-01-08 01:16 630,784 ----a-w C:\WINDOWS\system32 sd1BA.tmp 2008-01-04 21:59 9,878 ----a-w C:\WINDOWS\system32 sd1B9.tmp 2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32 ss1B7.tmp 2008-01-04 21:59 4,816 ----a-w C:\WINDOWS\system32 sn1B8.tmp 2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32 sg1AE.tmp 2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32 sv1DC.tmp 2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32 sa1AD.tmp 2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32 sl1DB.tmp 2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32 sa1AC.tmp 2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32 so1B4.tmp 2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32 se1B5.tmp 2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32 sk1AB.tmp 2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32 sv1B6.tmp 2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32 sd1B3.tmp 2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32 su1A7.tmp 2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32 sk1A9.tmp 2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32 sr1B0.tmp 2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32 sz1A8.tmp 2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32 sj1A6.tmp 2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32 sb1AF.tmp 2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32 sf1AA.tmp 2008-01-04 21:56 8,835 ----a-w C:\WINDOWS\system32 sb1B1.tmp 2008-01-04 21:56 3,162 ----a-w C:\WINDOWS\system32 sr1B2.tmp 2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32 se1BB.tmp 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-11 19:39 9,728 ----a-w C:\WINDOWS\system32\Rnaph.dll 2007-10-03 18:52 2,354,472 ----a-w C:\Documents and Settings\kévin.NOM-EB85C523610.000\SVGView.exe 2007-10-03 18:52 2,354,472 ----a-w C:\Documents and Settings\kévin.NOM-EB85C523610.000\SVGView.exe 2007-07-14 22:26 0 ----a-w C:\Program Files\Virtual DJ 3.0 With All Effects 2007-06-02 12:25 40 ----a-w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\language.dat 2007-06-02 12:25 40 ----a-w C:\Documents and Settings\Compaq_Propriétaire.NOM-EB85C523610.000\language.dat 2007-01-14 17:04 117 ----a-w C:\Program Files\forevermopt.INI 2006-04-09 18:36 121,169 ----a-w C:\Program Files\INSTALL.LOG 2006-03-04 15:58 75,719 ----a-w C:\Program Files\UnMario.exe 2005-06-08 19:03 1,065 ----a-w C:\Program Files\Read Me 1st.txt 2005-05-11 22:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll 2004-06-12 22:45 245 ----a-w C:\Program Files\mafosav.INI 2004-06-12 20:23 1,208,826 ----a-w C:\Program Files\Info MF.exe 2004-06-06 23:37 13,762,037 ----a-w C:\Program Files\Mario Forever.exe 2004-05-20 13:02 40,792 ----a-w C:\Program Files\ktkm4.dll 2004-05-16 22:00 2,645,872 ----a-w C:\Program Files\ktkm39.dll 2004-01-01 22:12 13,506 ----a-w C:\Program Files\icoinst.bmp 2004-01-01 21:57 132,342 ----a-w C:\Program Files\leftinst.bmp 2003-10-26 18:58 524,537 ----a-w C:\Program Files\ktkm18.dll 2003-10-03 00:04 307,617 ----a-w C:\Program Files\ktkm15.dll 2002-09-15 13:59 47,104 ----a-w C:\Program Files ubberovine.dll 2002-03-03 13:34 538,410 ----a-w C:\Program Files\ktkm20.dll 2002-02-25 18:45 66,908 ----a-w C:\Program Files\ktkm17.dll 2002-02-25 18:44 209,936 ----a-w C:\Program Files\ktkm14.dll 2002-02-25 18:43 99,867 ----a-w C:\Program Files\ktkm13.dll 2002-02-25 18:42 62,631 ----a-w C:\Program Files\ktkm11.dll 2002-02-25 18:42 116,841 ----a-w C:\Program Files\ktkm26.dll 2002-02-25 18:38 81,427 ----a-w C:\Program Files\ktkm31.dll 2002-02-25 18:37 326,441 ----a-w C:\Program Files\ktkm32.dll 2002-02-25 18:35 92,400 ----a-w C:\Program Files\ktkm7.dll 2002-02-25 18:33 268,621 ----a-w C:\Program Files\ktkm33.dll 2002-02-25 18:31 197,408 ----a-w C:\Program Files\ktkm29.dll 2002-02-25 18:02 70,888 ----a-w C:\Program Files\ktkm19.dll 2002-02-25 17:57 58,192 ----a-w C:\Program Files\ktkm6.dll 2002-02-25 17:55 96,166 ----a-w C:\Program Files\ktkm1.dll 2002-02-25 17:49 55,186 ----a-w C:\Program Files\ktkm5.dll 2002-02-25 17:44 22,657 ----a-w C:\Program Files\ktkm3.dll 2002-02-25 17:37 20,926 ----a-w C:\Program Files\ktkm36.dll 2002-02-25 17:36 58,015 ----a-w C:\Program Files\ktkm10.dll 2002-02-25 17:32 20,974 ----a-w C:\Program Files\ktkm2.dll 2002-02-25 17:32 169,789 ----a-w C:\Program Files\ktkm38.dll 2002-02-25 17:31 128,042 ----a-w C:\Program Files\ktkm30.dll 2001-11-27 13:47 73,728 ----a-w C:\Program Files\CCTrans.dll 2001-11-27 13:46 285,696 ----a-w C:\Program Files\cncs232.dll 2001-09-28 15:00 164,864 ----a-w C:\Program Files\UNWISE.EXE 2000-11-05 16:56 81,920 ----a-w C:\Program Files\STrans.dll 2000-06-20 22:04 113,152 ----a-w C:\Program Files\SFTrans.dll 2005-05-13 15:12 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 09:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 19:27 422,400 --sha-r C:\WINDOWS\x2.64.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 01:45 68856] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-19 16:31 3477504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 18:06 88363 C:\WINDOWS\AGRSMMSG.exe] "KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 20:02 61440] "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-04 04:10 344064] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 21:47 57344 C:\WINDOWS\ALCXMNTR.EXE] "PS2"="C:\WINDOWS\system32\ps2.exe" [2003-09-12 20:13 98304] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18 241664] "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 19:00 94208] "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 02:50 139320] "Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48 147514] "atwtusb"="atwtusb.exe" [2004-05-03 16:03 344140 C:\WINDOWS\system32\atwtusb.exe] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 22:54 253952] "EPGServiceTool"="C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe" [2006-11-28 15:07 688128] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 15:32 225280] "EEventManager"="C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 15:57 102400] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "BMd7e923e9"="C:\WINDOWS\system32 nwgendu.dll" [ ] "d4da1075"="C:\WINDOWS\system32\uehsjtpf.dll" [ ] C:\Documents and Settings\Compaq_Propri‚taire.NOM-EB85C523610.000\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-09-18 18:48:35 110592] OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-09-18 18:48:35 110592] AutoStart IR.lnk - C:\Program Files\WinTV\Ir.exe [2007-10-14 19:07:48 106551] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624] Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2005-09-24 07:05:26 29696] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Shareaza\Shareaza.exe"= "C:\Program Files\Windows Media Player\wmplayer.exe"= "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"= "C:\Program Files\BitComet\BitComet.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10100:TCP"= 10100:TCP:BitComet 10100 TCP "10100:UDP"= 10100:UDP:BitComet 10100 UDP R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys [2004-02-24 15:42] S1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-11-08 19:31] S2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [] S2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-05 19:00] S3 a94d5b89-a6c6-497e-8f6f-0115159991c4;a94d5b89-a6c6-497e-8f6f-0115159991c4;F:\Player\cds300.dll [] S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;C:\WINDOWS\system32\Drivers\cam1690.sys [2007-06-09 21:20] S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2007-02-20 14:11] S3 hcw95bda;Hauppauge MOD7700 Tuner Driver;C:\WINDOWS\system32\Drivers\hcw95bda.sys [2007-04-04 19:45] S3 hcw95rc;Hauppauge MOD7700 IR Driver;C:\WINDOWS\system32\DRIVERS\hcw95rc.sys [2007-04-04 19:48] S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-02-29 13:28:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-07 16:15:53 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2008-03-09 01:43:08 C:\WINDOWS\Tasks\WebReg Deskjet 5900 series.job" - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 20:44:57 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-03-09 20:47:32 ComboFix-quarantined-files.txt 2008-03-09 19:47:05 ComboFix2.txt 2008-03-08 21:36:47 ComboFix3.txt 2008-03-08 20:11:17 . 2008-02-13 21:47:17 --- E O F --- ____________________________________________________________________________________________ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:56:17, on 09/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\AGRSMMSG.exe C:\HP\KBD\KBD.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe C:\WINDOWS\system32\atwtusb.exe C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\WinTV\Ir.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\CTsvcCDA.exe c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.exe C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Network Associates\VirusScan\mcconsol.exe C:\Program Files\Trend Micro\HijackThis\CCM.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet ools\BitCometBHO_1.1.11.30.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [BMd7e923e9] Rundll32.exe "C:\WINDOWS\system32 nwgendu.dll",s O4 - HKLM\..\Run: [d4da1075] rundll32.exe "C:\WINDOWS\system32\uehsjtpf.dll",b O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet ools\BitCometBHO_1.1.11.30.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/ O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 80.10.246.1 81.253.149.2 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

goaaa · Answer

t'ai,toujours dessu jorginho67 ? paske jaimerai bien en finir avec se problem se soir si possible

jorginho67 · Answer

Internet Explorer v6.00 SP2 gras>Ta version IE n'est pas à jour Grosse faille de sécurité !!! Internet Explorer v6.00 SP2 (6.00.2900.2180) On en est a la 07 la Mise à Jour <--- ICI ça résoudra peut etre le probleme d'erreurs...

goaaa · Answer

a d'accord j'avait pas voulu faire la mise a jour car je pansai que la nouvelle version était plus lourde ou moins bien mais je fait la mise a jours alors

goaaa · Answer

internet explorer c bon c'est fait par contre ces 2 messages RUNDLL au demarage  komen les suprimer?????

goaaa · Answer

alors?

goaaa · Answer

comment faire disparaitre ces messages T___T ???????

goaaa · Answer

jorginho67?????

goaaa · Answer

...................????

goaaa · Answer

sinan aparament pour suprimer ces messages d'erreur jai vu que en allant sur msconfig dans demarrage je pouvait decocher les cases de ces 2 dll et il y sont dans la liste mais c'est quoi sa en faite des trojan j'mi connait pas du tout alors j'essaye de conprendre :s

goaaa · Answer

alors jorginho67 quest-ce que je fait ? desoler d'etre aussi chiant mais bon

goaaa · Answer

?

jorginho67 · Answer

allant sur msconfig dans demarrage je pouvait decocher les cases de ces 2 dll et il y sont dans la liste mais c'est quoi sa en faite des trojan j'mi connait pas du tout alors j'essaye de conprendre :s

en tout cas, elles n'appartiennent pas a windows.......

 supprime les par msconfig

goaaa · Answer

voila c fait donc maintenant je viens de redémarer et je n'ai plus ces messages d'erreur est'ce que je change le statut de la discussion en résolu ou tu pense que je cours encore un risque?

jorginho67 · Answer

envoie un nouveau Hijackthis stp !

goaaa · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:53:17, on 09/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\atwtusb.exe
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\CTsvcCDA.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\WinTV\Ir.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\CCM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q105&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - https://www.118712.fr/sortir/75_paris/sortir/
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F982134E-52FF-44CF-961A-4C39547DAC26}: NameServer = 81.253.149.1 80.10.246.3
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: EPGService - Unknown owner - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

on a réussi.....

Adobe n'est pas à jour.   Faille de sécurité !!!

Télécharge  Adobe Reader 8.1  pour Windows
L'installation d' une nouvelle version désinstallera l' ancienne si besoin est.
 Lien Direct
Décocher Téléchargez également :Adobe Photoshop® Album Édition
Dans Ajout/Suppression des programmes,  tu supprimes toutes les autres versions.


La console Java n'est pas à jour.  Faille de sécurité !!!
Clique sur Download Latest Version

Choisis la première ligne de téléchargement puis installe java.
En fin d'installation, revient sur la page pour vérifier ton installation.
Quand l'installation a réussi, ouvre le panneau de configuration >
Ajout/suppression de programmes et supprimes les anciennes versions (de java) afin d’éliminer les failles de sécurité présentes dans ces anciennes versions.
Fais cela pour chacune d'elle, une a une, fais redémarrer ton PC quand cela te le sera demandé . 
Tu gardes la Java\jre1.6.0_05 !

Pour nettoyer les outils téléchargés pendant cette désinfection qui ne te serviront  plus, vu qu'ils sont mis a jour régulierement, il vaut mieux les télécharger en cas de besoin au dernier moment .......:

Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.

Clique droit sur ToolsCleaner2.bat et  " éxécuter en tant que Administrateur ".

Clique sur Recherche et laisse le scan se terminer.
Clique, sur Suppression pour finaliser.
Tu pourras, si tu le souhaites, te servir des Options facultatives.
- Point de Restauration.
- Corbeille. ------------------------------------------------> a faire !
- Nettoyage des fichiers Temporaires.------------------------> a faire !
Clique sur quitter, pour que le rapport puisse se créer.

Ferme le rapport qui s'ouvre, et poste le dans ta prochaine réponse.
  Il se trouve a la racine du disque C:\TCleaner.txt

goaaa · Answer

j'ai tout fait sauf que avec ToolsCleaner2.bat apres la supression un message d'erreur saffichai comme quoi en quitant le rapport ne pouvait pas etre créé .

jorginho67 · Answer

Bon, supprimes Tools cleaner via ajout/suppression de progr's et fais comme ceci :

Pour supprimer les outils utilisés devenus inutiles, ainsi que les quarantaines éventuelles; procedes comme ceci:
Clique sur "Démarrer" - Clic droit sur le "Poste de Travail" > dans "Propriétés" > onglet "Restauration du système" - Cocher la case "Désactiver la restauration du système" et cliquer sur "Appliquer".

Lance OTMoveIt.exe par double-clic
Clique sur CleanUp! (le programme va télécharger un fichier texte qui servira à nettoyer les programmes que l'on a téléchargés).
NOTE : Normalement, ton Firewall (parefeu) devrait te demander si _OTMoveIt peut accéder à Internet. Autorise-le.
Une liste apparaît dans la partie gauche d' _OTMoveIt.
Un message apparaît pour confirmer le nettoyage. Confirme
Ce programme supprime les outils utilisés ainsi que les quarantaines éventuelles.
La manoeuvre nécessitera un reboot (=redémarrage) initié par le programme.

ensuite je te donne quelques conseils pourque tu puisses surfer en tranquilité !

tu pourras alors  mettre le sujet en résolu !

au dessus de ton message inintial

Modifier le statut de la discussion
Afin d'améliorer la qualité des échanges, merci d'indiquer si la discussion ci-dessous a répondu à votre attente : 
O Problème non résolu 
O Problème résolu  
cocher la case et AJOUER ou Valider.

goaaa · Answer

voila c'est fait

jorginho67 · Answer

Voici quelques conseils utiles à ne pas négliger... prends le temps de lire ceci ! ° Maintenant que ton ordinateur est propre je te conseille de créer un point de restauration sain, comme ça en cas de probleme (virus , plantage ..ect) tu pourras toujours revenir en arriere Désactive ta "Restauration du système" puis réactive la. (1) Désactivation Clique droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > coche la case "Désactiver la Restauration du système sur tous les lecteurs" Appliquer . patiente jusqu a que cela soit marqué "désactivée" puis Ok. (2) Activation Suivre le même chemin ; décoche la case "Désactiver la Restauration du système sur tous les lecteurs" Appliquer. attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarre l'ordinateur ! ------------------------------------------------------------------------------------------------------------ Conseils de base pour surfer en sécurité °Utiliser le navigateur Mozzilla plus sur que IE7 POURQUOI ? Lire Attentivement ceci Tutoriel pour le sécuriser ° Vérifie les mises a jours des différents softs régulièrement ici https://www.flexera.com/products/operations/software-vulnerability-management.html Tuto https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/ Pour java il faut désinstaller les anciennes versions (de java) via panneau de config / ajouts et suppression de programme ° Ne pas telecharger n'importe quoi, eviter les programes gratuits genre smileys, Macrogaming\SweetIM, Boonty games ...ect °Toujours analyser les fichiers telechargés depuis un peer to peer (emule ,Shareaza, kazza ... ect) avant de les executer Un peu de lecture à ce sujet : °Ne pas ouvrir les pieces jointes d'un expediteur inconnu et toujours les analyser avant de les ouvrir °Toujours analyser les fichiers reçus via MSN ou autre avec ton antivirus ° MSN PREVENTION ---------------------------------------------------------------------------------------------------------------- ° Passe regulierement les antispywares ( ad aware spybot avg as 7.5 ),pense a les mettre a jour avant de les lancer c'est tres important Ad-aware 2007 free 7.0.2.6 > http://www.commentcamarche.net/telecharger/telecharger 83 ad aware 2007 free spybot 1.5.1 > http://www.commentcamarche.net/telecharger/telecharger 122 spybot AVG as 7.5.1.43 > http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware ° Supprime regulierement les fichiers inutiles (fichiers temporaires , cookies .. ect) a l'aide de CCleaner https://www.malekal.com/tutoriel-ccleaner/ CCleaner 2.04.543 > http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner ° Nettoie ta base de registre avec regcleaner https://www.malekal.com/nettoyer-sa-base-de-registre-avec-windows-registry-cleaner/ RegCleaner 4.3.0.780 >http://www.commentcamarche.net/telecharger/telecharger 171 regcleaner ------------------------------------------------------------------------------------------------------------------ Il est possible de temps en temps de supprimer le contenu du dossier c/windows/prefetch pour accelerer le demarrage de windows , mais seulement le contenu non le dossier... VIDE le !!! - Clique sur l'icône Poste de travail - Sélectionne le disque c:\ - Positionne toi dans le dossier c:\Windows\Prefetch - Sélectionne le Menu Edition, Sélectionner tout - Appuie sur le touche Suppr du clavier afin de vider ce dossier ------------------------------------------------------------------------------------------------------------------- ° Pense a défragmenter ton Disque Dur au moins une fois par mois ! comment ? http://www.infetech.com/article.php3?id_article=69 -------------------------------------------------------------------------------------------------------------------- Encore un peu de lecture : sécuriser son pc et connaitre les menaces tu peux mettre le sujet en résolu ! au dessus de ton message inintial Modifier le statut de la discussion Afin d'améliorer la qualité des échanges, merci d'indiquer si la discussion ci-dessous a répondu à votre attente : O Problème non résolu O Problème résolu cocher la case et Ajouter ou Valider. Merci et bon surf ! @ plus ! Jo.

goaaa · Answer

Ouf! et bien je vais regardé tout sa en tout cas merci beaucoup pour t'on aide jo. et bravo pour tout ce travail que vous faite sur le forum sa doit etre assez crevant kameme merci encore  ^^ + ....

jorginho67 · Answer

disons qu'on aime ça même si certains cas sont plus durs a traiter que d'autres...
si jamais tu retrouve un probleme, reviens me voir ici, j'en serais averti !

@+

goaaa · Answer

Effectivement si j'ai un probleme c'est avec grand plaisir que je reviendrai par ici crois moi .Sur ceu  bonne soirée ;)

jorginho67 · Answer

@+

Trojan ? Virus ? help (rapport Hijack)

107 réponses

Discussions similaires

Newsletters