Pubs +lenteur pc,voici mon rapport hijackthisRésolu/Fermé

Question

Bonjour a tous, alors voila depuis quelque temps mon pc est lent et depui hier je me retrouve avec des pubs  pendant mes navigations et toujours depuis hier,ma conection a largement chutté,en ddl je suis passé de 220ko/sec  a 53 max ko/sec,qu'en pensez vous?

Je vous met mon rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:32:09, on 22/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\TELECH~1\FREEDO~1\fdm.exe
C:\Hijackthis\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\efccaxw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D8D96A4B-E429-4D89-B32D-50D1835A302F} - (no file)
O2 - BHO: (no name) - {FAD9A2D7-BC1D-41C2-8B61-671D75523203} - C:\WINDOWS\System32\ssttq.dll
O2 - BHO: (no name) - {FDC56D23-6F27-4A12-AA0E-38C3362CB404} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\System32\fmhxxdfd.dll",setvm
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A3F0187-FB56-4E91-B628-EFE300DBE2E4}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F485F06-896F-4E4E-9817-EA858E2AE1E9}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.100 85.255.112.63
O17 - HKLM\System\CS1\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.100 85.255.112.63
O17 - HKLM\System\CS2\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.100 85.255.112.63
O20 - Winlogon Notify: ddayv - C:\WINDOWS\System32\ddayv.dll (file missing)
O20 - Winlogon Notify: efccaxw - C:\WINDOWS\SYSTEM32\efccaxw.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O20 - Winlogon Notify: khfffgf - C:\WINDOWS\SYSTEM32\khfffgf.dll
O20 - Winlogon Notify: nnnomjj - C:\WINDOWS\SYSTEM32
nnomjj.dll
O20 - Winlogon Notify: rqronlj - C:\WINDOWS\SYSTEM32qronlj.dll
O20 - Winlogon Notify: ssttq - C:\WINDOWS\System32\ssttq.dll
O20 - Winlogon Notify: tuvvtqq - C:\WINDOWS\SYSTEM32	uvvtqq.dll
O20 - Winlogon Notify: urqqomm - urqqomm.dll (file missing)
O20 - Winlogon Notify: xxyaxvt - C:\WINDOWS\SYSTEM32\xxyaxvt.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

sly4ever · Answer

Personne pour m aider?:(

green day · Answer

Salut

 c'est vraiment pas triste :)

* Télécharge FixWareout d'un de ces deux sites sur le bureau: 
http://downloads.subratam.org/Fixwareout.exe 
http://swandog46.geekstogo.com/Fixwareout.exe 

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish. 
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal. 

*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) 

ensuite : 

Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

O17 - HKLM\System\CCS\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A3F0187-FB56-4E91-B628-EFE300DBE2E4}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F485F06-896F-4E4E-9817-EA858E2AE1E9}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.100 85.255.112.63
O17 - HKLM\System\CS1\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.100 85.255.112.63
O17 - HKLM\System\CS2\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: NameServer = 85.255.114.100,85.255.112.63
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.100 85.255.112.63 

et enfin, remets un nouveau hijack stp

++

sly4ever · Answer

Fixwareout Last edited 4/5/2007
Post this report in the forums please 
...
»»»»»Prerun check

»»»»» System restarted
 
»»»»» Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "System"="" 
....
....
»»»»» Misc files. 
....
»»»»» Checking for older varients.
....

Search five digit cs, dm, kd, jb, other, files.
The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection. 



Click browse, find the file then click submit.
http://www.virustotal.com/flash/index_en.html
Or https://virusscan.jotti.org/

»»»»» Other



»»»»» Current runs 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent"
"SoundMan"="SOUNDMAN.EXE"
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"
"NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP"
"AGRSMMSG"="AGRSMMSG.exe"
"NvMediaCenter"="RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit"
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe"
"VX3000"="C:\WINDOWS\vVX3000.exe"
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup"
"ISUSScheduler"="\"C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe\" -start"
"PrintDrive"="rundll32.exe \"C:\WINDOWS\System32\fmhxxdfd.dll\",setvm"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe"
"MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»

Voila ce rapport je fix avec hijack this et jte le repport aussi

sly4ever · Answer

et voila mon rapport hijackthis : 

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 20:45:22, on 22/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32undll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Hijackthis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\efccaxw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} - C:\WINDOWS\System32\ssttq.dll
O2 - BHO: (no name) - {D8D96A4B-E429-4D89-B32D-50D1835A302F} - (no file)
O2 - BHO: (no name) - {FDC56D23-6F27-4A12-AA0E-38C3362CB404} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\System32\fmhxxdfd.dll",setvm
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: ddayv - C:\WINDOWS\System32\ddayv.dll (file missing)
O20 - Winlogon Notify: efccaxw - C:\WINDOWS\SYSTEM32\efccaxw.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O20 - Winlogon Notify: khfffgf - C:\WINDOWS\SYSTEM32\khfffgf.dll
O20 - Winlogon Notify: nnnomjj - C:\WINDOWS\SYSTEM32
nnomjj.dll
O20 - Winlogon Notify: rqronlj - C:\WINDOWS\SYSTEM32qronlj.dll
O20 - Winlogon Notify: ssttq - C:\WINDOWS\System32\ssttq.dll
O20 - Winlogon Notify: tuvvtqq - C:\WINDOWS\SYSTEM32	uvvtqq.dll
O20 - Winlogon Notify: urqqomm - urqqomm.dll (file missing)
O20 - Winlogon Notify: xxyaxvt - C:\WINDOWS\SYSTEM32\xxyaxvt.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

green day · Answer

ça avance !

Téléchargez VundoFix.exe (par Atribune) sur ton Bureau : 

 http://www.atribune.org/ccount/click.php?id=4

*Double-clique VundoFix.exe afin de le lancer.
* Cliquez sur le bouton Scan for Vundo.
* Lorsque le scan est complété, cliquez sur le bouton Remove Vundo.
* Une invite vous demandera  supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
 * le PC va s'éteindre ("shutdown") :  clique OK
 * Démarrez votre PC à nouveau
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse. 


++

sly4ever · Answer

Voila voila :)

VundoFix V6.3.19

Checking Java version...

Sun Java not detected
Scan started at 20:50:15 22/04/2007

Listing files found while scanning....

C:\WINDOWS\system32\dfdxxhmf.ini
C:\WINDOWS\system32\fmhxxdfd.dll
C:\WINDOWS\System32\ssttq.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\dfdxxhmf.ini
C:\WINDOWS\system32\dfdxxhmf.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fmhxxdfd.dll
C:\WINDOWS\system32\fmhxxdfd.dll Has been deleted!

 Attempting to delete C:\WINDOWS\System32\ssttq.dll
C:\WINDOWS\System32\ssttq.dll Has been deleted!

Performing Repairs to the registry.
Done!





Et voici aussi le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 20:58:21, on 22/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32undll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Hijackthis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\efccaxw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} - C:\WINDOWS\System32\ssttq.dll (file missing)
O2 - BHO: (no name) - {D8D96A4B-E429-4D89-B32D-50D1835A302F} - (no file)
O2 - BHO: (no name) - {FDC56D23-6F27-4A12-AA0E-38C3362CB404} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\System32\fmhxxdfd.dll",setvm
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: ddayv - C:\WINDOWS\System32\ddayv.dll (file missing)
O20 - Winlogon Notify: efccaxw - C:\WINDOWS\SYSTEM32\efccaxw.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O20 - Winlogon Notify: khfffgf - C:\WINDOWS\SYSTEM32\khfffgf.dll
O20 - Winlogon Notify: nnnomjj - C:\WINDOWS\SYSTEM32
nnomjj.dll
O20 - Winlogon Notify: rqronlj - C:\WINDOWS\SYSTEM32qronlj.dll
O20 - Winlogon Notify: tuvvtqq - C:\WINDOWS\SYSTEM32	uvvtqq.dll
O20 - Winlogon Notify: urqqomm - urqqomm.dll (file missing)
O20 - Winlogon Notify: xxyaxvt - C:\WINDOWS\SYSTEM32\xxyaxvt.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

merci de m aider:)

green day · Answer

On continue :

Télécharger l2mfix.exe sur http://www.downloads.subratam.org/l2mfix.exe 


- Quitter le net, le navigateur, et toutes autres fenêtres d'applications ; 
- Dézipper l2mfix.exe sur le bureau ; 
- Dans le dossier du programme, double-cliquer sur l2mfix.bat ; 
- Choisir OPTION 1 (Run find log) et valider par la touche [Entrée] ; 
=> Un rapport sera généré dans le Bloc-notes, se reconnecter pour le poster au forum. 


++

sly4ever · Answer

Voila: L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddayv] "Asynchronous"=dword:00000001 "DllName"="C:\WINDOWS\System32\ddayv.dll" "Impersonate"=dword:00000000 "Startup"="SysLogon" "Logoff"="SysLogoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efccaxw] "Asynchronous"=dword:00000001 "DllName"="efccaxw.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkijkh] "Asynchronous"=dword:00000001 "DllName"="jkkijkh.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfffgf] "Asynchronous"=dword:00000001 "DllName"="khfffgf.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify nnomjj] "Asynchronous"=dword:00000001 "DllName"="nnnomjj.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify qronlj] "Asynchronous"=dword:00000001 "DllName"="rqronlj.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ermsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify uvvtqq] "Asynchronous"=dword:00000001 "DllName"="tuvvtqq.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqqomm] "Asynchronous"=dword:00000001 "DllName"="urqqomm.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] "EulaAccepted"=dword:00000000 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyaxvt] "Asynchronous"=dword:00000001 "DllName"="xxyaxvt.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension" "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders" "{e82a2d71-5b2f-43a0-97b8-81be15854de8}"="ShellLink for Application References" "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}"="Shell Icon Handler for Application References" "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}"="PhoneBrowser" "{C0C4375A-5B72-4efe-929D-3B848C3A1E91}"="Message View" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ awtqrqp.dll Mon 16 Apr 2007 12:33:36 A.... 26 714 26,09 K cbxvwxv.dll Sun 22 Apr 2007 11:14:20 A.... 26 714 26,09 K ddcyyyw.dll Thu 19 Apr 2007 11:57:06 A.... 26 714 26,09 K efccaxw.dll Thu 19 Apr 2007 18:02:38 A.... 26 714 26,09 K gebbaya.dll Sat 14 Apr 2007 10:20:22 A.... 26 714 26,09 K hgghfgf.dll Wed 18 Apr 2007 12:24:22 A.... 26 714 26,09 K jkkijkh.dll Thu 19 Apr 2007 10:13:14 A.... 26 714 26,09 K kdfapi.dll Fri 9 Feb 2007 19:34:26 A.... 57 344 56,00 K kdfhok.dll Fri 9 Feb 2007 19:34:26 A.... 48 128 47,00 K khfffgf.dll Fri 20 Apr 2007 10:55:52 A.... 26 714 26,09 K ljjghhi.dll Tue 17 Apr 2007 16:42:32 A.... 26 714 26,09 K medial~1.dll Mon 12 Feb 2007 19:29:26 A.... 257 376 251,34 K nnnomjj.dll Wed 18 Apr 2007 9:57:02 A.... 26 714 26,09 K opnkih~1.dll Sat 21 Apr 2007 19:50:28 A.... 26 714 26,09 K opnoom~1.dll Sat 21 Apr 2007 22:28:40 A.... 26 714 26,09 K pmnopp~1.dll Sat 21 Apr 2007 19:37:46 A.... 26 714 26,09 K rqronlj.dll Tue 17 Apr 2007 8:40:06 A.... 26 714 26,09 K source~1.dll Mon 12 Feb 2007 19:29:26 A.... 59 232 57,84 K tuvvtqq.dll Sat 14 Apr 2007 21:41:08 A.... 26 714 26,09 K xxyaxvt.dll Sun 15 Apr 2007 17:03:00 A.... 26 714 26,09 K 20 items found: 20 files, 0 directories. Total of file sizes: 849 504 bytes 829,59 K Locate .tmp files: C:\WINDOWS\SYSTEM32\ bcbeg.tmp Sun 22 Apr 2007 15:58:50 A.... 499 712 488,00 K vyadd.tmp Fri 6 Apr 2007 12:35:56 ..SH. 2 882 2,81 K 2 items found: 2 files (1 H/S), 0 directories. Total of file sizes: 502 594 bytes 490,81 K ********************************************************************************** Directory Listing of system files: Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est 040D-1BA0 R‚pertoire de C:\WINDOWS\System32 22/04/2007 20:54 522ÿ419 qttss.ini 22/04/2007 17:12 497ÿ498 qttss.bak1 06/04/2007 12:35 2ÿ882 vyadd.tmp 06/04/2007 12:33 2ÿ882 vyadd.ini 24/03/2007 20:37 dllcache 01/07/2006 18:40 Microsoft 4 fichier(s) 1ÿ025ÿ681 octets 2 R‚p(s) 42ÿ347ÿ413ÿ504 octets libres

green day · Answer

ok, 

Prendre connaissance du contenu du lien suivant: 
http://www.f-secure.com/products/license-terms/eult_fra.pdf 
Tu as donc pris connaissance et accepté les conditions d'utilisations du programme blacklight qui est inclus dans le dossier compressé navilog1.zip que tu vas télécharger. 
Maintenant fais un clic droit sur ce lien : 
http://perso.orange.fr/il.mafioso/Navifix/navilog1.zip 
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Fais un clic droit sur navilog1.zip et choisis "tout extraire" 
Ensuite double clique sur navilog1.bat 
Laisses-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2 sans notre avis/accord) 
Patientes jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuies sur une touche comme demandé, le blocnote va s'ouvrir. 
Copies-colles l'intégralité dans une réponse. Refermes le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt) 


++

sly4ever · Answer

C'est fait:

Search Navipromo version 1.1.5 commencé le 22/04/2007 à 21:17:05,32
 
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Documents and Settings\marwoan\Bureau
Mise a jour le 13.04.2007 a 20h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes *** 

 


*** Recherche dossiers dans C:\WINDOWS ***




*** Recherche dossiers dans C:\Program Files ***




*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\marwoan\Application Data ***



*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en


F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of April, 2007.
Version information: 2.2.1061.

[+] Started on 04/22/07 at 21:17:06.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ....................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 04/22/07 at 21:24:43 (return code = 0).


*** Recherche fichiers *** 




*** Recherche cles registre ***


Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs] 
 
 

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage] 
 
 

Recherche Clé Magic Control 
 
 
 
*** Module de Recherche complémentaire *** 
(Recherche fichiers spécifiques) 
 
1)Recherche fichiers connus:

C:\WINDOWS\system32\vyadd.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\pstwa.bak1 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\qttss.bak1 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche Heuristique :
* 
** 
*** 
**** 
***** 
****** 
******* 
******** 
 
 
*** Analyse Terminé le 22/04/2007 à 21:24:59,39 ***

green day · Answer

bien :

Télécharge clean.zip 
http://www.malekal.com/download/clean.zip 
Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean. 
Ouvre le dossier Clean qui se trouve sur ton bureau. 
Double-clic sur clean.cmd. 
Une fenêtre noire va apparaître, choisis l'option 1 
Poste le rapport qui se trouve ici C:\rapport_clean.txt 


ensuite : 

# Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 

Double-clic sur clean.cmd. 
Une fenêtre noire va apparaître, choisis l'option 2
Poste le rapport qui se trouve ici C:\rapport_clean.txt 


++

sly4ever · Answer

22/04/2007 a 21:31:38,06 
 
*** Recherche des fichiers dans C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
 
*** Recherche des fichiers dans C:\Program Files 
"C:\Program Files\Multi_Media_France\" FOUND 
"C:\Program Files\Viewpoint\" FOUND 
*** Fin du rapport ! 

Bon je vais essayer el mode sans echec,cependant hier j'ai deja voulu y acceder mai aucun moyen,ca reste noir quand j vais,je n ai pas de bureau....est ce normal? bon je vais réessayer...

sly4ever · Answer

Ca y est j'ai reussi a faire ce que tu m as demander et voici le rapport:

Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 22/04/2007 a 21:36:59,64 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
 
*** Suppression des fichiers dans C:\Program Files 
tentative de suppression de "C:\Program Files\Multi_Media_France\" 
tentative de suppression de "C:\Program Files\Viewpoint\" 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

green day · Answer

ok,

# Télécharge ceci: (merci a S!RI pour ce petit programme). 

 http://siri.urz.free.fr/Fix/SmitfraudFix.zip

Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, 
voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php 
il va générer un rapport : copie/colle le sur le poste stp.

++

sly4ever · Answer

Voici le rapport:

SmitFraudFix v2.171

Rapport fait à 21:48:19,07, 22/04/2007
Executé à partir de C:\Documents and Settings\marwoan\Bureau\smit
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\marwoan


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\marwoan\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\marwoan\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CCS\Services\Tcpip\..\{4A3F0187-FB56-4E91-B628-EFE300DBE2E4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6F485F06-896F-4E4E-9817-EA858E2AE1E9}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B53EA7E8-404E-4101-91ED-94EE480AA1D9}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CS1\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4A3F0187-FB56-4E91-B628-EFE300DBE2E4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{6F485F06-896F-4E4E-9817-EA858E2AE1E9}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B53EA7E8-404E-4101-91ED-94EE480AA1D9}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CS2\Services\Tcpip\..\{265C4CA6-36D5-419E-994D-0158A61C56D7}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4A3F0187-FB56-4E91-B628-EFE300DBE2E4}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{6F485F06-896F-4E4E-9817-EA858E2AE1E9}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B53EA7E8-404E-4101-91ED-94EE480AA1D9}: DhcpNameServer=85.255.114.100,85.255.112.63
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

green day · Answer

On regarde un peut ce qu'il y a sous toutes les coutures, à la fin, tu pourras virer une bonne partie de ce que je t'ai fait télécharger !

 Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis. 
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu 

++

sly4ever · Answer

Voila :

[04/22/2007, 22:05:23] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\marwoan\Bureau\VirtumundoBeGone.exe" )
[04/22/2007, 22:05:32] - Detected System Information:
[04/22/2007, 22:05:32] -  Windows Version: 5.1.2600, Service Pack 1
[04/22/2007, 22:05:32] -  Current Username: marwoan (Admin)
[04/22/2007, 22:05:32] -  Windows is in NORMAL mode.
[04/22/2007, 22:05:32] - Searching for Browser Helper Objects:
[04/22/2007, 22:05:32] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/22/2007, 22:05:32] -  BHO 2: {17244C30-1DA0-4616-9A7A-1E0068088546} ()
[04/22/2007, 22:05:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:32] -  Checking for HKLM\...\Winlogon\Notify\awtsp
[04/22/2007, 22:05:32] -  Found: HKLM\...\Winlogon\Notify\awtsp - This is probably Virtumundo.
[04/22/2007, 22:05:32] -  Assigning {17244C30-1DA0-4616-9A7A-1E0068088546} MSEvents Object
[04/22/2007, 22:05:32] - BHO list has been changed! Starting over...
[04/22/2007, 22:05:32] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/22/2007, 22:05:32] -  BHO 2: {17244C30-1DA0-4616-9A7A-1E0068088546} (MSEvents Object)
[04/22/2007, 22:05:32] - ALERT: Found MSEvents Object!
[04/22/2007, 22:05:32] -  BHO 3: {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} ()
[04/22/2007, 22:05:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:32] -  Checking for HKLM\...\Winlogon\Notify\efccaxw
[04/22/2007, 22:05:32] -  Found: HKLM\...\Winlogon\Notify\efccaxw - This is probably Virtumundo.
[04/22/2007, 22:05:32] -  Assigning {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} MSEvents Object
[04/22/2007, 22:05:32] - BHO list has been changed! Starting over...
[04/22/2007, 22:05:32] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/22/2007, 22:05:32] -  BHO 2: {17244C30-1DA0-4616-9A7A-1E0068088546} (MSEvents Object)
[04/22/2007, 22:05:32] - ALERT: Found MSEvents Object!
[04/22/2007, 22:05:32] -  BHO 3: {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} (MSEvents Object)
[04/22/2007, 22:05:32] - ALERT: Found MSEvents Object!
[04/22/2007, 22:05:32] -  BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[04/22/2007, 22:05:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:32] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[04/22/2007, 22:05:32] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[04/22/2007, 22:05:32] -  BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[04/22/2007, 22:05:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:32] -  No filename found. Continuing.
[04/22/2007, 22:05:32] -  BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[04/22/2007, 22:05:32] -  BHO 7: {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} ()
[04/22/2007, 22:05:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:32] -  Checking for HKLM\...\Winlogon\Notify\ssttq
[04/22/2007, 22:05:32] -  Key not found: HKLM\...\Winlogon\Notify\ssttq, continuing.
[04/22/2007, 22:05:32] -  BHO 8: {D8D96A4B-E429-4D89-B32D-50D1835A302F} ()
[04/22/2007, 22:05:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:32] -  No filename found. Continuing.
[04/22/2007, 22:05:32] -  BHO 9: {FDC56D23-6F27-4A12-AA0E-38C3362CB404} ()
[04/22/2007, 22:05:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:32] -  No filename found. Continuing.
[04/22/2007, 22:05:32] - Finished Searching Browser Helper Objects
[04/22/2007, 22:05:32] - *** Detected MSEvents Object
[04/22/2007, 22:05:32] - Trying to remove MSEvents Object...
[04/22/2007, 22:05:33] -    Terminating Process: IEXPLORE.EXE
[04/22/2007, 22:05:33] -    Terminating Process: RUNDLL32.EXE
[04/22/2007, 22:05:34] -    Disabling Automatic Shell Restart
[04/22/2007, 22:05:34] -    Terminating Process: EXPLORER.EXE
[04/22/2007, 22:05:34] -    Suspending the NT Session Manager System Service
[04/22/2007, 22:05:34] -    Terminating Windows NT Logon/Logoff Manager
[04/22/2007, 22:05:34] -    Re-enabling Automatic Shell Restart
[04/22/2007, 22:05:34] -   File to disable: C:\WINDOWS\System32\awtsp.dll
[04/22/2007, 22:05:34] -  Renaming C:\WINDOWS\System32\awtsp.dll -> C:\WINDOWS\System32\awtsp.dll.vir
[04/22/2007, 22:05:34] -  File successfully renamed!
[04/22/2007, 22:05:34] -   Removing HKLM\...\Browser Helper Objects\{17244C30-1DA0-4616-9A7A-1E0068088546}
[04/22/2007, 22:05:34] -   Removing HKCR\CLSID\{17244C30-1DA0-4616-9A7A-1E0068088546}
[04/22/2007, 22:05:34] -   Adding Kill Bit for ActiveX for GUID: {17244C30-1DA0-4616-9A7A-1E0068088546}
[04/22/2007, 22:05:34] -   Deleting ATLEvents/MSEvents Registry entries
[04/22/2007, 22:05:34] -   Removing HKLM\...\Winlogon\Notify\awtsp
[04/22/2007, 22:05:34] - Searching for Browser Helper Objects:
[04/22/2007, 22:05:34] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/22/2007, 22:05:34] -  BHO 2: {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} (MSEvents Object)
[04/22/2007, 22:05:34] - ALERT: Found MSEvents Object!
[04/22/2007, 22:05:34] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[04/22/2007, 22:05:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:34] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[04/22/2007, 22:05:34] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[04/22/2007, 22:05:34] -  BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[04/22/2007, 22:05:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:34] -  No filename found. Continuing.
[04/22/2007, 22:05:34] -  BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[04/22/2007, 22:05:34] -  BHO 6: {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} ()
[04/22/2007, 22:05:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:34] -  Checking for HKLM\...\Winlogon\Notify\ssttq
[04/22/2007, 22:05:34] -  Key not found: HKLM\...\Winlogon\Notify\ssttq, continuing.
[04/22/2007, 22:05:34] -  BHO 7: {D8D96A4B-E429-4D89-B32D-50D1835A302F} ()
[04/22/2007, 22:05:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:34] -  No filename found. Continuing.
[04/22/2007, 22:05:34] -  BHO 8: {FDC56D23-6F27-4A12-AA0E-38C3362CB404} ()
[04/22/2007, 22:05:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:34] -  No filename found. Continuing.
[04/22/2007, 22:05:34] - Finished Searching Browser Helper Objects
[04/22/2007, 22:05:34] - *** Detected MSEvents Object
[04/22/2007, 22:05:34] - Trying to remove MSEvents Object...
[04/22/2007, 22:05:35] -    Terminating Process: IEXPLORE.EXE
[04/22/2007, 22:05:35] -    Terminating Process: RUNDLL32.EXE
[04/22/2007, 22:05:35] -    Disabling Automatic Shell Restart
[04/22/2007, 22:05:35] -    Terminating Process: EXPLORER.EXE
[04/22/2007, 22:05:36] -    Suspending the NT Session Manager System Service
[04/22/2007, 22:05:36] -    Terminating Windows NT Logon/Logoff Manager
[04/22/2007, 22:05:36] -    Re-enabling Automatic Shell Restart
[04/22/2007, 22:05:36] -   File to disable: C:\WINDOWS\system32\efccaxw.dll
[04/22/2007, 22:05:36] -  Renaming C:\WINDOWS\system32\efccaxw.dll -> C:\WINDOWS\system32\efccaxw.dll.vir
[04/22/2007, 22:05:36] -  File successfully renamed!
[04/22/2007, 22:05:36] -   Removing HKLM\...\Browser Helper Objects\{3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}
[04/22/2007, 22:05:36] -   Removing HKCR\CLSID\{3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}
[04/22/2007, 22:05:36] -   Adding Kill Bit for ActiveX for GUID: {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}
[04/22/2007, 22:05:36] -   Deleting ATLEvents/MSEvents Registry entries
[04/22/2007, 22:05:36] -   Removing HKLM\...\Winlogon\Notify\efccaxw
[04/22/2007, 22:05:36] - Searching for Browser Helper Objects:
[04/22/2007, 22:05:36] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/22/2007, 22:05:36] -  BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[04/22/2007, 22:05:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:36] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[04/22/2007, 22:05:36] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[04/22/2007, 22:05:36] -  BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[04/22/2007, 22:05:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:36] -  No filename found. Continuing.
[04/22/2007, 22:05:36] -  BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[04/22/2007, 22:05:36] -  BHO 5: {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} ()
[04/22/2007, 22:05:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:36] -  Checking for HKLM\...\Winlogon\Notify\ssttq
[04/22/2007, 22:05:36] -  Key not found: HKLM\...\Winlogon\Notify\ssttq, continuing.
[04/22/2007, 22:05:36] -  BHO 6: {D8D96A4B-E429-4D89-B32D-50D1835A302F} ()
[04/22/2007, 22:05:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:36] -  No filename found. Continuing.
[04/22/2007, 22:05:36] -  BHO 7: {FDC56D23-6F27-4A12-AA0E-38C3362CB404} ()
[04/22/2007, 22:05:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/22/2007, 22:05:36] -  No filename found. Continuing.
[04/22/2007, 22:05:36] - Finished Searching Browser Helper Objects
[04/22/2007, 22:05:36] - Finishing up...
[04/22/2007, 22:05:36] - A restart is needed.
[04/22/2007, 22:05:41] - Attempting to Restart via STOP error (Blue Screen!)

[04/22/2007, 22:08:46] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\marwoan\Bureau\VirtumundoBeGone.exe" )
[04/22/2007, 22:09:29] - User choose NOT to continue. Exiting...

[04/22/2007, 22:09:52] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\marwoan\Bureau\VirtumundoBeGone.exe" )
[04/22/2007, 22:09:53] - User choose NOT to continue. Exiting...

Et enfin voila hijack this:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:14:37, on 22/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32undll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Hijackthis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} - C:\WINDOWS\System32\ssttq.dll (file missing)
O2 - BHO: (no name) - {D8D96A4B-E429-4D89-B32D-50D1835A302F} - (no file)
O2 - BHO: (no name) - {FDC56D23-6F27-4A12-AA0E-38C3362CB404} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: ddayv - C:\WINDOWS\System32\ddayv.dll (file missing)
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O20 - Winlogon Notify: khfffgf - C:\WINDOWS\SYSTEM32\khfffgf.dll
O20 - Winlogon Notify: nnnomjj - C:\WINDOWS\SYSTEM32
nnomjj.dll
O20 - Winlogon Notify: rqronlj - C:\WINDOWS\SYSTEM32qronlj.dll
O20 - Winlogon Notify: tuvvtqq - C:\WINDOWS\SYSTEM32	uvvtqq.dll
O20 - Winlogon Notify: urqqomm - urqqomm.dll (file missing)
O20 - Winlogon Notify: xxyaxvt - C:\WINDOWS\SYSTEM32\xxyaxvt.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

green day · Answer

bien :

 fais les manips de ce lien stp :

virus methode preliminaire de desinfection version fr

++

sly4ever · Answer

Voici mon rapport AVG et hijackthis,cependant bitdefender je l avais deja fais hier,parce que je connaissai cette page et avant de m aventurer dans le forum j avais fais ces methode,vu qu'il est extrement long je le referai pas par contre le reste j'ai refait aujourd'hui...

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	22:55:54 22/04/2007

 + Résultat de l'analyse:	



C:\Documents and Settings\marwoan\Cookies\marwoan@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Aucune action entreprise.


Fin du rapport


et hijackthis:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:57:52, on 22/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\wuauclt.exe
C:\TELECH~1\FREEDO~1\fdm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hijackthis\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E2D9552-61DF-45C1-B8DF-F54253489F08} - C:\WINDOWS\System32\jkhfg.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} - (no file)
O2 - BHO: (no name) - {D8D96A4B-E429-4D89-B32D-50D1835A302F} - (no file)
O2 - BHO: (no name) - {FDC56D23-6F27-4A12-AA0E-38C3362CB404} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Avg spyware\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: ddayv - C:\WINDOWS\System32\ddayv.dll (file missing)
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\System32\jkhfg.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O20 - Winlogon Notify: khfffgf - C:\WINDOWS\SYSTEM32\khfffgf.dll
O20 - Winlogon Notify: nnnomjj - C:\WINDOWS\SYSTEM32
nnomjj.dll
O20 - Winlogon Notify: rqronlj - C:\WINDOWS\SYSTEM32qronlj.dll
O20 - Winlogon Notify: tuvvtqq - C:\WINDOWS\SYSTEM32	uvvtqq.dll
O20 - Winlogon Notify: urqqomm - urqqomm.dll (file missing)
O20 - Winlogon Notify: xxyaxvt - C:\WINDOWS\SYSTEM32\xxyaxvt.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Avg spyware\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

green day · Answer

ok, mais refais au moins le scan avec avg stp

++

sly4ever · Answer

je l'ai fais le scan c le premier rapoort regarde :

--------------------------------------------------------- 
AVG Anti-Spyware - Rapport d'analyse 
--------------------------------------------------------- 

+ Créé à: 22:55:54 22/04/2007 

+ Résultat de l'analyse: 



C:\Documents and Settings\marwoan\Cookies\marwoan@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Aucune action entreprise. 


Fin du rapport 

il y avait un cookies que j'ai enlever,au sinon cette aprem j'ai fais aussi un scan avec mon AVG free et celui ci n avait rien trouvé

green day · Answer

ok, où en est la situation ???

++

sly4ever · Answer

Et bien j'ai toujours autant de pubs....et au fait en faisant ccleaner dans les erreurs il en reste toujours une depuis un moment....elle ne s'efface pas...

green day · Answer

Des fenêtres Cid ???

++

sly4ever · Answer

Cid?je ne comprend pas désolé....

sly4ever · Answer

en fenetre j'ai drive cleaner,win pro spyware et aussi des tite fenetre clignotant sur un site disant que j'ai des errors ect....

green day · Answer

Oups ! est-ce qu'il y a dans le titre des fenêtres de pub écrit Cid

 comme ici :

 comment bloquer les fenetres cid

++

sly4ever · Answer

oui il y a ce genre,fenetre de skate,de voiture + fenetre de anti spyware comme drive cleaner ect

green day · Answer

ok, dans ce cas, suis les indications et tiens moi au courant !

après on supprimera les dll suspects !

++

sly4ever · Answer

Et bien j'ai lu ce qu'il faut et euh bein on a deja tout fait non?j'ai ete en mode sans echec je n'ai pas de cid dans mes programmes et pour le reste on a deja fait: clean en mode sans echec tu me la fais faire tout a l'heure et avg aussi....

sly4ever · Answer

On s occupe des dll suspect?

green day · Answer

Donc pas de fenêtre Cid :)

S'il n'y a pas de  Cid machin ou sponsor msn a désinstaller, voici la suite :

# Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

O2 - BHO: (no name) - {0E2D9552-61DF-45C1-B8DF-F54253489F08} - C:\WINDOWS\System32\jkhfg.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {D4EA6253-9465-4FD5-83FB-DF0F30BD3CA2} - (no file)
O2 - BHO: (no name) - {D8D96A4B-E429-4D89-B32D-50D1835A302F} - (no file)
O2 - BHO: (no name) - {FDC56D23-6F27-4A12-AA0E-38C3362CB404} - (no file) 

O20 - Winlogon Notify: ddayv - C:\WINDOWS\System32\ddayv.dll (file missing)
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\System32\jkhfg.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O20 - Winlogon Notify: khfffgf - C:\WINDOWS\SYSTEM32\khfffgf.dll
O20 - Winlogon Notify: nnnomjj - C:\WINDOWS\SYSTEM32
nnomjj.dll
O20 - Winlogon Notify: rqronlj - C:\WINDOWS\SYSTEM32qronlj.dll
O20 - Winlogon Notify: tuvvtqq - C:\WINDOWS\SYSTEM32	uvvtqq.dll
O20 - Winlogon Notify: urqqomm - urqqomm.dll (file missing)
O20 - Winlogon Notify: xxyaxvt - C:\WINDOWS\SYSTEM32\xxyaxvt.dll 

# Affiche les dossiers système et fichiers cachés : 
Ouvrir le poste de travail : 
- Outils --> Options des dossiers 
- Affichage --> zone Paramètres avancés 
- Cocher : Afficher le contenu des dossiers système 
- Cocher : Afficher les fichiers et dossiers cachés 
- Décocher : Masquer les extensions des fichiers dont le type est connu 
- Décocher : Masquer les fichiers protégés du système d'exploitation (recommandé) 
répondre Oui au message 
Clique sur "Appliquer à tous les dossiers" 
Clique sur OK 

# Télécharge Killbox sur ton Bureau : 

http://www.downloads.subratam.org/KillBox.exe 

Double-clique killbox.exe. 

Copie le texte gras ci-bas (sélectionne tout avec ta souris, clic-droit et "Copier") : 

C:\WINDOWS\System32\ddayv.dll 
C:\WINDOWS\System32\jkhfg.dll
C:\WINDOWS\SYSTEM32\jkkijkh.dll
C:\WINDOWS\SYSTEM32\khfffgf.dll
C:\WINDOWS\SYSTEM32
nnomjj.dll
C:\WINDOWS\SYSTEM32qronlj.dll
C:\WINDOWS\SYSTEM32	uvvtqq.dll
C:\WINDOWS\SYSTEM32\xxyaxvt.dll 

* Sélectionnz "delete on reboot" 
* Cliquez sur le menu "File" -> "Past from clip board" 
* Cliquez sur All Files 
* Cliquez sur la croix rouge et et blanche 
* Répondez yes et laisse redémarrer ton pc. 
*poste un nouveau blacklight 

cf démo : http://mickael.barroux.free.fr/securite/killbox.html 

et reposte un hijack en précisant l'évolution !

++

sly4ever · Answer

euh...j'ai un petit probleme,apres avoir cliquer sur la croix rouge il dit qu'il va redemarer,apres son compte a rebour un message d erreur apparait : "PendingFileRenameOperations Registry Data has been Removed by External process!"

green day · Answer

Pas grave, redemarre le pc s'il ne la pas fait !

++

sly4ever · Answer

Voila apre rebootage :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 00:07:13, on 23/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32undll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Avg spyware\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Hijackthis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E04158A4-E06F-4C17-A06A-1294CC42AC4D} - C:\WINDOWS\System32\jkhfg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Avg spyware\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\System32\jkhfg.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Avg spyware\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

sly4ever · Answer

Alors est ce concluant?  :p

sly4ever · Answer

Re un petit up ^^ 

J ai poster ci dessus mon dernier rapport, y a t il encore des choses suspects? merci

green day · Answer

Salut

 où en sont tes soucis ???

 il y a encore des lignes suspectes !

++

sly4ever · Answer

Salut, je vais aller dodo, mais je passe voir si y a des nouvelles avant, merci d etre la :)

Alors oui effectivement j ai encore quelques pubs qui viennent quand je surf un peu sur le net mais beaucoup moins qu avant, et la vitesse du PC est revenu a la normal je pense :)

Que faire alors pour ces lignes suspects et ces quelques pubs?

green day · Answer

Salut

on va procédé autrement :

*Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll 
O2 - BHO: (no name) - {E04158A4-E06F-4C17-A06A-1294CC42AC4D} - C:\WINDOWS\System32\jkhfg.dll 

O20 - Winlogon Notify: jkhfg - C:\WINDOWS\System32\jkhfg.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll 


*Clique sur "Démarrer" et sur "Exécuter". Une boîte va apparaître, copie-colle (pour éviter les fautes de frappes) :

regsvr32 /u /s C:\WINDOWS\System32\jkhfg.dll
Clique sur "OK".

de même ce fichier :

regsvr32 /u /s C:\WINDOWS\SYSTEM32\jkkijkh.dll
 

Ensuite, supprime les fichiers suivants en gras  (si tu le trouve) :

 C:\WINDOWS\System32\jkhfg.dll
C:\WINDOWS\SYSTEM32\jkkijkh.dll

et enfin, refais un scan avec avg et reposte un nouveau hijack !

@+

sly4ever · Answer

salut

les deux fichiers :
C:\WINDOWS\System32\jkhfg.dll 
C:\WINDOWS\SYSTEM32\jkkijkh.dll 

ne veulent pas etre fixés ni etre supprimés( meme en mode sans echec) que faire? ...

voici le rapport:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:16:01, on 24/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Hijackthis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2C847993-9FDA-497F-9989-B523F2C0B6BE} - C:\WINDOWS\System32\jkhfg.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\System32\jkhfg.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

green day · Answer

re

tu as un message d'erreur ou autre quand tu essaye de les supprimer ???

 pourquoi font ils de la resistance ??? :/

++

sly4ever · Answer

Oui quand je veux les supprimer, j ai un message d erreur me disant qu ils sont utilisés et qu il fau les fermer avant de les supprimer...
ps: aucunes des lignes que tu m as demander de fixer avec hijackthis ne sont partis....

comment faire?  :(

green day · Answer

On va pas se laisser faire !  :)

 Télécharge SDFix sur ton bureau 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
Redémarre ton ordinateur en mode sans échec 
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis stp

@+

sly4ever · Answer

Salut

Oui lol, c est un corriace celui qui m as accrocher :(
Alors voila le rapport de SDFix :

SDFix: Version 1.79

Run by marwoan - 25/04/2007 -  1:00:50,79

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\marwoan\Bureau\SDFix\SDFix

Safe Mode:
Checking Services: 






Restoring Windows Registry Values
Restoring Windows Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found...




Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder 
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.



                                 Final Check:

Remaining Services:
------------------




Remaining Files:
---------------


Checking For Files with Hidden Attributes:

C:\WINDOWS\system32\awtsp.dll.vir
C:\Jeux\DOMO\MS_MY_Client_v07041702.exe
C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp
C:\WINDOWS\system32\vyadd.tmp
C:\Divx\Manga\Magikano-08{Requiem}.zip
C:\Divx\Manga\Magikano-09{Requiem}.zip
C:\Divx\Manga\Magikano_-_10{Requiem}.zip
C:\Divx\Manga\Magikano_-_11{Requiem}.zip
C:\Documents and Settings\marwoan\Mes documents\Granado_Espada_O.S.T_CD2_Vol.1.zip
C:\Jeux\Voyage Century\expansion2.zip

                                 Finished

ET voila le rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 01:13:35, on 25/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Hijackthis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {8D2F6CBE-3B89-4EC2-ABDE-BCF5F14F2F59} - C:\WINDOWS\System32\jkhfg.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\System32\jkhfg.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

sly4ever · Answer

Salut

Petit up pour que tu puisse retrouve plus facilemen le sujet :)

green day · Answer

Salut

ne t'inquiète pas, ton message remonte dans mes contributions :)

télécharge ceci, fais un scan et poste le rapport stp :

avg anti rootkit

@+

sly4ever · Answer

Salut

Lol je savais pas que mon sujet tu pouvai le voir comme ca ^^
Alors j ai fai comme tu m as di avec AVG anti rootkit, et le resultat c est:  CONGRATULATION, no root found
nothing found...

Pourtant j ai encore ces lignes suspects et des fenetre de pubs comme antispyware etc drivecleaner aussi....

green day · Answer

re

 fais un clic droit sur chacun des deux fichiers, et regarde dans les propriétés s'ils ne sont pas en lecture seule, si c'est le cas, décoche cette option et essaye de les supprimer !

sinon : 

Créer un fichier avec le bloc note : tu mets ce que tu veux à l'intérieur ! 
Donne lui le même nom et l'extension du fichier que tu veux virer.
Windows va te dire qu'il existe et va te  demander si tu veux le remplacer :  tu dis oui et ensuite tu supprimes le fichier que tu as crée !

tiens moi au courant !

@+

sly4ever · Answer

Salut :)

Nonnnnn c est une malediction!!!!!
Ils ne sont pas en lecture seule, et quand je veux les remplacer voila ce que j ai comme message : 

Impossible de cree le fichier C:\WINDOWS\system32\jkhfg.dll
verifier que le nom et le chemin d accès sont corrects ...

c est quoi ces trojants???Jamais vu qu ils s accrochent autant :(

green day · Answer

re

Ce "torjan" est love de toi :)))

 télécharge OTMoveIt :
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

    C:\WINDOWS\System32\jkhfg.dll
C:\WINDOWS\SYSTEM32\jkkijkh.dll 


clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

++

sly4ever · Answer

Salut green day

Voila j ai fait comme tu m as demander et voila le rapport:

DllUnregisterServer procedure not found in C:\WINDOWS\System32\jkhfg.dll
C:\WINDOWS\System32\jkhfg.dll NOT unregistered.
File move failed. C:\WINDOWS\System32\jkhfg.dll scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\SYSTEM32\jkkijkh.dll
C:\WINDOWS\SYSTEM32\jkkijkh.dll NOT unregistered.
File move failed. C:\WINDOWS\SYSTEM32\jkkijkh.dll scheduled to be moved on reboot.
 
Created on 04/25/2007 23:49:05

green day · Answer

re

ok !

reposte un nouveau hijack stp

++

sly4ever · Answer

Salut!

je t envoie mon rapport hijackthis avant dodo :



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 02:27:41, on 26/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Hijackthis\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - C:\WINDOWS\system32\jkkijkh.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54DE00E2-7247-4D62-9262-6FD590B791C4} - C:\WINDOWS\System32\jkhfg.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\System32\hgkpnhul.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\System32\jkhfg.dll
O20 - Winlogon Notify: jkkijkh - C:\WINDOWS\SYSTEM32\jkkijkh.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

green day · Answer

Salut

 est-ce que tu as encore ces deux fichiers ???

++

sly4ever · Answer

Salut!!

Oui je les ai toujours et en prime, j ai refai un scan avec AVG anti virus et j ai trouver quelque chose que je n avais pas avant, je te l ajoute en fichier join j ai pris un screen...

sly4ever · Answer

Mince j arrive pa a t ajouter le screen..

En gros AVG free antivirus me trouve quelque chose, mais ce n est pas un threat, il est dan la section "virus result" et je ne peut pa le supprimer de cette fenetre... 

c est une error d apres ce que je comprend :

C:\WINDOWS\System32\drivers\etc\hosts

le result c est: "reading error"
status : " error"

j ai toujours les deux autres fichiers aussi...  :(

green day · Answer

Salut

 ok,


clik droit sur le lien ci dessous
http://perso.numericable.fr/~altshift/Info/Fichiers/Winsoftware.bfu

et Enregistrer sous
avant de faire enregistrer met type sur tous fichiers

ensuite double clik sur bfu.exe
Clique sur le petit dossier jaune, à la droite de la boîte "Scriptline to execute", et double-clique sur : Winsoftware.bfu
- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\Winsoftware.bfu
Clique sur "Execute" et laisse-le faire son travail.
Attendre que "Complete script execution" apparaîsse et clique sur OK.
Clique exit pour fermer le programme BFU.
Recommence encore une fois. 

++

sly4ever · Answer

Green day, 

j ai un problem je ne peu pas dl ce programme, quand je fai ce que tu me dit, il me dit, le site n est pas trouvable ou indisponible...   :(
J ai essayer de le prendre d ailleurs, mais c etai un fichier inutilisable...

green day · Answer

Salut

 il faut faire un clic droit sur le le lien puis enregistrer la cible sous ...

++

sly4ever · Answer

Salut 

marche pas le clic droit,le site est mort je pense...

balltrap34 · Answer

salut

l adresse pour Winsoftware.bfu 
http://www.alt-shift-return.org/Info/Fichi...Winsoftware.bfu 

dans le rapport smitfraud fix il y a des traces de detournement dns
fait lui passer l option 5
et plusieur passage de vundofix
a++

green day · Answer

Merci :-)

 Sly : essaye avec cette nouvelle adresse, puis, on fera l'option 5 avec smitfraud.fix


@+

Lyonnais92 · Answer

Bonjour,

décidement ce lien est difficile : 
http://www.alt-shift-return.org/Info/Fichiers/Winsoftware.bfu

Bonne suite.

green day · Answer

Salut

 Je viens de retenter : clic droit < enregister la cible sous ...

 et lorsque je veux l'ouvrir, il me demande avec quel programme l'ouvrir ???

 merci à vous !

++

sly4ever · Answer

Bonsoir....et bien j'ai essayé tout les liens mais aucun ne marchent....

green day · Answer

Oups !

 il fallait que je résume le tout :)

Télécharge Brute Force Uninstaller (de Merijn) ici: http://www.merijn.org/files/bfu.zip
Créé un nouveau dossier directement à la racine de ton disque dur ou l'endroit qui te convient, nomme ce dossier BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (par exemple C:\BFU)
Ensuite, télécharge Winsoftware.bfu :

Fais un clik droit ici : http://www.alt-shift-return.org/Info/Fichiers/Winsoftware.bfu

 et choisis 

"Enregistrer la cible sous..." afin de télécharger EGDACCESS.bfu (de Metallica).
Sauvegarde dans le dossier créé (C:\BFU).
**Note : si tu utilises Internet Explorer ; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".

Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU :   Winsoftware.bfu et BFU.exe (très important).


Lance "Brute Force Uninstaller" en double-cliquant BFU.exe (Dans le dossier C:\BFU)
- Clique sur le petit dossier jaune, et clique sur : Winsoftware.bfu
- Coches la case Show log after scrïpt ends
- Clique sur Execute pour que le fix fasse son boulot : Attends que le message Complete scrïpt execution apparaîsse et clique sur OK.
Un rapport va s'afficher dans la fenetre du programme, copie et colle dans le bloc-notes, puis sauvegardes le, tu le posteras plus tard sur le forum.
Clique Exit pour fermer le programme BFU.
-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

poste le rapport que tu auras sauvegarder stp

@+

sly4ever · Answer

Salut Green day

Voila j ai fait comme tu m as dit et voila le rapport :


BFU v1.00.9
Windows XP SP1 (WinNT 5.01.2600 SP1)
Script started at 01:07:14, on 30/04/2007

Option Unload Explorer: Yes
Failed: ServiceStop FWSvc (service not found)
Failed: ServiceDisable FWSvc (service not found)
Failed: ServiceDelete FWSvc (service not found)
Failed: DllUnregister C:\Program Files\DriveCleaner 2006 Free\UDCPChk.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\DriveCleaner 2006 Free\UDCShell.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\df_fixer.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\df_proxy.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\ecc.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\esSPCheck.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\FFWraper.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\FixCore.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\FiFxr5.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\FTRec.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\MMFix.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\ErrorSafe\StrRes.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\compclr.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\df_fixer.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\df_proxy.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\FFWrapr.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\flfxr10.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\FTRec.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\FxCore.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\MMFx.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SysProtect\StrRes.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\SystemDoctor 2006 Free\order.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006\AsAgents.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006\shellext.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\AsAgents.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\shellext.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\uwas6chk.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\was6chk.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\avkernel.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\IEFWBHO.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\libfn.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\rpt.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\winpgi.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\compcln.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\df_fixer.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\df_proxy.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\ffCom.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\FFWraper.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\FileTypeRecognizer.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\FixCore.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\MMFix.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\OEDrop.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\WinFixer 2005\StrRes.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\Common Files\Companion Wizard\WapCHK.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\Common Files\WinAntiSpyware 2006\was6chk.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\Common Files\WinAntiVirus Pro 2006\WapCHK.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\Common Files\WinSoftware\CrXML.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\Common Files\WinSoftware\PCheck.dll|1 (file not found)
Failed: DllUnregister C:\Program Files\Fichiers communs\WinFixer  2005\uwappchk.dll|1 (file not found)
Failed: DllUnregister C:\WINDOWS\System32\SpOrder.dll|1 (file not found)
Failed: DllUnregister C:\WINDOWS\syst32.dll|1 (file not found)
Failed: FileDelete C:\Program Files\Common Files\Companion Wizard\WapCHK{*}.dll (operation failed)
Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.1\U*_*_*NetInstaller.exe (operation failed)
Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.2\U*_*_*NetInstaller.exe (operation failed)
Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.3\U*_*_*NetInstaller.exe (operation failed)
Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.4\U*_*_*NetInstaller.exe (operation failed)
Failed: FolderDelete C:\Documents and Settings\marwoan\Application Data\systemdoctor 2006 free (folder not found)
Failed: FolderDelete C:\Documents and Settings\marwoan\Application Data\WinAntiVirus Pro 2006 (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Application Data\WinAntiVirus Corp (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006 (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DriveCleaner 2006 Free (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ErrorSafe (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\SystemDoctor 2006 Unregistered Version (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinAntiSpyware 2006 (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinAntiSpyware 2006 Scanner (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinAntiVirus Pro 2006 (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinFixer 2005 (folder not found)
Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\SysProtect (folder not found)
Failed: FolderDelete C:\Program Files\DriveCleaner 2006 Free (folder not found)
Failed: FolderDelete C:\Program Files\erroguard (folder not found)
Failed: FolderDelete C:\Program Files\Error Safe (folder not found)
Failed: FolderDelete C:\Program Files\Error Safe Free (folder not found)
Failed: FolderDelete C:\Program Files\ErrorSafe (folder not found)
Failed: FolderDelete C:\Program Files\errorsafe free (folder not found)
Failed: FolderDelete C:\Program Files\SysProtect Free (folder not found)
Failed: FolderDelete C:\Program Files\SystemDoctor 2006 Free (folder not found)
Failed: FolderDelete C:\Program Files\WinAntiSpyware 2006 (folder not found)
Failed: FolderDelete C:\Program Files\WinAntiSpyware 2006 Free (folder not found)
Failed: FolderDelete C:\Program Files\WinAntiSpyware 2006 Scanner (folder not found)
Failed: FolderDelete C:\Program Files\WinAntiVirus 2005 (folder not found)
Failed: FolderDelete C:\Program Files\WinAntiVirus Pro 2006 (folder not found)
Failed: FolderDelete C:\Program Files\WinFixer 2005 (folder not found)
Failed: FolderDelete C:\Program Files\WinPopupGuard 2005 (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\DriveCleaner 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\DriveCleaner 2006 Free (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\DriveCleaner Free (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\Error Safe (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\erroguard (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\errorguard (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\ErrorSafe (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\SystemDoctor 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\WinAntiSpyware 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\WinAntiVirus Pro 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\WinFixer 2005 (folder not found)
Failed: FolderDelete C:\Program Files\Archivos comunes\WinSoftware (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\DriveCleaner 2006 Free (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\erroguard (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\errorguard (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\ErrorSafe (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\SysProtect (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\SystemDoctor 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\WinAntiSpyware 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\WinAntiVirus Pro 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\WinFixer 2005 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\WinSoftware (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\DriveCleaner 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\DriveCleaner 2006 Free (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\DriveCleaner Free (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\Error Safe (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\erroguard (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\errorguard (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\ErrorSafe (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\SystemDoctor 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\WinAntiSpyware 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\WinAntiVirus Pro 2006 (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\WinAntivirus Pro 2007 (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\WinFixer  2005 (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\WinFixer 2005 (folder not found)
Failed: FolderDelete C:\Program Files\Fichiers communs\WinSoftware (folder not found)
Failed: FolderDelete C:\WinAntiVirus Pro 2006 (folder not found)
Failed: FileDelete %USERPROFILE%\Cookies\*@*drivecleaner*.txt (operation failed)
Failed: FileDelete %USERPROFILE%\Cookies\*@*errorsafe*.txt (operation failed)
Failed: FileDelete %USERPROFILE%\Cookies\*@*systemdoctor*.txt (operation failed)
Failed: FileDelete %USERPROFILE%\Cookies\*@*WinAntiSpyware*.txt (operation failed)
Failed: FileDelete %USERPROFILE%\Cookies\*@*winantivirus*.txt (operation failed)
Failed: FileDelete %USERPROFILE%\Cookies\*@*winfixer*.txt (operation failed)
Failed: FileDelete %USERPROFILE%\Cookies\*@*yieldmanager*.txt (operation failed)
Failed: FolderDelete C:\Documents and Settings\marwoan\Local Settings\Temporary Internet Files\Content.IE5\BI0LHLBX (operation failed)
Failed: FolderDelete C:\Documents and Settings\marwoan\Local Settings\Temporary Internet Files\Content.IE5\K383QFON (operation failed)
Failed: FileDelete C:\DOCUME~1\marwoan\LOCALS~1\Temp\~DFC4AE.tmp (operation failed)
Script completed.


Ca m as pas l air tres super tout ca....  :(

green day · Answer

Salut

 passe ccleaner et vundo.fix en mode sans echec !

 et poste celui de vundo stp

++

sly4ever · Answer

Salut!!

Voila ce que ca donne :



VundoFix V6.3.21

Checking Java version...

Sun Java not detected
Scan started at 21:11:10 30/04/2007

Listing files found while scanning....

C:\WINDOWS\system32\boffbubd.dll
C:\WINDOWS\system32\dbubffob.ini
C:\WINDOWS\System32\gfhkj.bak1
C:\WINDOWS\System32\gfhkj.bak2
C:\WINDOWS\System32\gfhkj.ini
C:\WINDOWS\system32\gwfuaqbu.dll
C:\WINDOWS\system32\hfjmwxpb.dll
C:\WINDOWS\system32\hgkpnhul.dll
C:\WINDOWS\System32\jkhfg.dll
C:\WINDOWS\system32\jkkijkh.dll
C:\WINDOWS\system32\luhnpkgh.ini
C:\WINDOWS\system32\wuwrogsk.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\boffbubd.dll
C:\WINDOWS\system32\boffbubd.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\dbubffob.ini
C:\WINDOWS\system32\dbubffob.ini Has been deleted!

 Attempting to delete C:\WINDOWS\System32\gfhkj.bak1
C:\WINDOWS\System32\gfhkj.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\System32\gfhkj.bak2
C:\WINDOWS\System32\gfhkj.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\System32\gfhkj.ini
C:\WINDOWS\System32\gfhkj.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gwfuaqbu.dll
C:\WINDOWS\system32\gwfuaqbu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hfjmwxpb.dll
C:\WINDOWS\system32\hfjmwxpb.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hgkpnhul.dll
C:\WINDOWS\system32\hgkpnhul.dll Has been deleted!

 Attempting to delete C:\WINDOWS\System32\jkhfg.dll
C:\WINDOWS\System32\jkhfg.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\jkkijkh.dll
C:\WINDOWS\system32\jkkijkh.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\luhnpkgh.ini
C:\WINDOWS\system32\luhnpkgh.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wuwrogsk.dll
C:\WINDOWS\system32\wuwrogsk.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\System32\gfhkj.ini
C:\WINDOWS\System32\gfhkj.ini Has been deleted!

 Attempting to delete C:\WINDOWS\System32\jkhfg.dll
C:\WINDOWS\System32\jkhfg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkkijkh.dll
C:\WINDOWS\system32\jkkijkh.dll Has been deleted!

Performing Repairs to the registry.
Done!


Qu en pense tu?  :)

green day · Answer

Could not be deleted ... toujours les mêmes ...

 Télécharge ComboFix (par sUBs) d'un de ces liens sur ton bureau: 

http://www.techsupportforum.com/sectools/combofix.exe 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


Double clique combofix.exe et suis les invites, à la fin poste le rapport stp

++

sly4ever · Answer

Salut green day !! Ah lol je croyai ca avai viré apres le redemarrage du PC pq c etait marquer: "Performing Repairs to the registry. Done! Beginning removal... Attempting to delete C:\WINDOWS\System32\gfhkj.ini C:\WINDOWS\System32\gfhkj.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\jkhfg.dll C:\WINDOWS\System32\jkhfg.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\jkkijkh.dll C:\WINDOWS\system32\jkkijkh.dll Has been deleted! Performing Repairs to the registry. Done! " Sinon j ai fait comme tu m as dit avec combofix et voila le rapport : ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\marwoan\Bureau\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-01 to 2007-05-01 )))))))))))))))))))))))))))))))))) 2007-04-30 21:11 d-------- C:\VundoFix Backups 2007-04-28 14:17 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-04-24 13:15 d-------- C:\Hijackthis 2007-04-22 22:28 d-------- C:\WINDOWS\BDOSCAN8 2007-04-22 22:24 d-------- C:\Avg spyware 2007-04-22 21:48 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-04-22 21:48 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-04-22 21:48 2,484 --a------ C:\WINDOWS\system32 mp.reg 2007-04-22 21:08 497,538 --------- C:\WINDOWS\system32\pstwa.bak1 2007-04-22 21:08 281,172 --ahs---- C:\WINDOWS\system32\awtsp.dll.vir 2007-04-22 21:02 73,728 --a------ C:\WINDOWS\system32\pv.exe 2007-04-22 21:02 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-04-22 21:02 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-04-22 21:02 16,384 --a------ C:\WINDOWS\system32 estart.exe 2007-04-22 21:02 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-04-22 21:02 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-04-22 17:12 497,498 --------- C:\WINDOWS\system32\qttss.bak1 2007-04-22 15:45 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-04-22 11:14 26,714 --a------ C:\WINDOWS\system32\cbxvwxv.dll 2007-04-21 22:28 26,714 --a------ C:\WINDOWS\system32\opnoomk(2).dll 2007-04-21 20:46 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft(2) 2007-04-21 19:50 26,714 --a------ C:\WINDOWS\system32\opnkihf(2).dll 2007-04-21 19:37 26,714 --a------ C:\WINDOWS\system32\pmnoppq(2).dll 2007-04-20 15:55 4,456,448 --a------ C:\DOCUME~1\marwoan tuser.dat 2007-04-19 18:02 26,714 --a------ C:\WINDOWS\system32\efccaxw.dll.vir 2007-04-19 11:57 26,714 --a------ C:\WINDOWS\system32\ddcyyyw.dll 2007-04-18 12:24 26,714 --a------ C:\WINDOWS\system32\hgghfgf.dll 2007-04-17 16:42 26,714 --a------ C:\WINDOWS\system32\ljjghhi.dll 2007-04-17 16:31 d-------- C:\Ccleaner 2007-04-16 17:25 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2007-04-16 17:23 d-------- C:\Spybot 2007-04-16 12:33 26,714 --a------ C:\WINDOWS\system32\awtqrqp.dll 2007-04-14 10:20 26,714 --a------ C:\WINDOWS\system32\gebbaya.dll 2007-04-06 12:35 2,903 --------- C:\WINDOWS\system32\vyadd.ini2 2007-04-01 21:51 d-------- C:\QuickZip (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-01 13:08 1825 --a------ C:\DOCUME~1\marwoan\APPLIC~1\quickzip45.ini 2007-04-25 01:07 71248 --a------ C:\WINDOWS\system32\perfc00c.dat 2007-04-25 01:07 458230 --a------ C:\WINDOWS\system32\perfh00c.dat 2007-03-31 05:16 31844 --------- C:\WINDOWS\system32\awvtt.exe 2007-03-30 16:54 -------- d-------- C:\DOCUME~1\marwoan\APPLIC~1\secondlife 2007-03-29 14:06 -------- d-------- C:\DOCUME~1\marwoan\APPLIC~1\pc suite 2007-03-20 20:25 39 --a------ C:\WINDOWS\winomnifile.dat 2007-03-04 17:47 -------- d-------- C:\Program Files\Fichiers communs eal 2007-02-12 19:29 59232 --a------ C:\WINDOWS\system32\sourceplug.dll 2007-02-12 19:29 257376 --a------ C:\WINDOWS\system32\medialogic.dll 2007-02-09 19:34 57344 --a------ C:\WINDOWS\system32\kdfapi.dll 2007-02-09 19:34 48128 --a------ C:\WINDOWS\system32\kdfhok.dll 2007-02-09 19:34 155648 --a------ C:\WINDOWS\system32\kdfmgr.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Adobe reader\ActiveX\AcroIEHelper.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un] "BluetoothAuthenticationAgent"="rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent" "SoundMan"="SOUNDMAN.EXE" "QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime" "NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" "AGRSMMSG"="AGRSMMSG.exe" "NvMediaCenter"="RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" "VX3000"="C:\WINDOWS\vVX3000.exe" "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup" "ISUSScheduler"="\"C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe\" -start" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion un] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background" [HKEY_USERS\.default\software\microsoft\windows\currentversion un] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 Contents of the 'Scheduled Tasks' folder C:\WINDOWS asks\FRU Task #Hewlett-Packard#hp psc 1100 series#1156517496.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-01 20:30:59 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-05-01 20:31:03 C:\ComboFix-quarantined-files.txt ... 07-05-01 20:31

green day · Answer

Salut

 je crois que c'est enfin parti :)

 poste un nouveau hijack stp

++

sly4ever · Answer

Salut green !

YEahhh waouuu lol   Number one donc c est Vundo :)
En tout cas merci pour tout green day :)
Voila je te poste le rapport hijackthis en esperant que c est positif :)


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 09:06:25, on 02/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Imprimante\Digital Imaging\bin\hpohmr08.exe
C:\Avg spyware\AVG Anti-Spyware 7.5\guard.exe
C:\Imprimante\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Imprimante\Digital Imaging\bin\hpoevm08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Imprimante\Digital Imaging\Bin\hpoSTS08.exe
C:\Spybot\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Hijackthis\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Adobe reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2A220FAB-5BDA-4DBE-BEEC-691E5CE84903} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Telechargeur\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll
O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Avg spyware\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32
etdde.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

green day · Answer

Salut :-)

 c'est nickel !

petit détail au passage : ligne à fixer !

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ? 

O16 - DPF: {1E15B1A7-95CA-4377-B893-697CD95951AE} (ClientATXCtrl Control) - http://www.wayi.com.tw/gameup/ClientATXCtrl.OCX
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.fr/computercheckup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} - http://monatoweb.nefficient.co.kr/monatoweb/inca/nProtect/Netizen/npx.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
O16 - DPF: {F2D47376-7118-421F-AD84-4D4AEA43005C} (SpyDrRun Control) - http://down.spy-dr.co.kr/spydr/partner/activex/SpyDrRun.cab 

et tu installe un parefeu !

 voir ici : securite proteger un ordinateur contre les malwares d internet

@+

;-))

sly4ever · Answer

Salut!

Super, j ai fait t es derniere instructions et installé un par feu conseiller dans ton lien :)

Il est temps de te dire un grand merci pour ton aide sans quoi j aurai ete noyé de trojan et virus ;)
Et bonne continuation !

salut

green day · Answer

Salut !

 Pas d'quoi

 Bonne continuation itoo ... ;-))

++

Pubs +lenteur pc,voici mon rapport hijackthis

77 réponses

Newsletters