Je suis infecté !

Question

Bonjour à tous.

Je pense être infecté par je sais pas quoi et ça commence à me gonfler sérieusement j'ai autre chose à faire de ma vie que réparer le pc toutes les 5mn ! Je vous explique le problème:

Lorsque que je charge une page web, elle se charge normalement puis l'écran freeze quelques secondes et certains mots sont souligné comme: sex, cat, chat, car, register, ... et un lien est associé avec. Lorsque je laisse ma flèche dessus ça me met: Best sex, Best cat, ... et je ne clique pas dessus (je suis pas taré non plus). Malgré un usage intensif de a², ad-aware
SE , et spybot search&destroy ça me fait toujours la même chose.

Petit précision, lorsque ça charge les liens et que ça souligne les mots dans le gestionnaire de tâches aucune nouvelle application n'est lancée, le CU est utilisé entre 80% et 100% et IEXPLORER.EXE peux utiliser jusqu'as 300 000ko...

J'espère que vous aurez la solution à mon problème, merci d'avance et bonne journée :)

Afficher la suite

Utilisateur anonyme · Answer

Saluttelecharges ca et scannes puis colles le rapport icihttp://209.133.47.12/~merijn/files/HijackThis.exe

steveboy · Answer

salut
je te conseille de faire un scanonline de ton disque dur

http://www.f-secure.com

tu auras á la fin du processus un rapport de tes disques durs locaux
avec les fichiers infectés,f-secure t´aidera a les supprimer.

tchao...........................................

Narco · Answer

Salut, cette adresse:

http://209.133.47.12/~merijn/files/HijackThis.exe

M'envoie à celle-ci ...

http://www.begin2search.com/error.html

Mon pc tourne de plus en plus mal :/ Je vais tenter de DL Hijackthis sur un autre site et je vous met le log ici.

Merci

Utilisateur anonyme · Answer

corrompue.........http://tomcoyote.com/hjt/#Top

NArco · Answer

Voila voila:Logfile of HijackThis v1.97.7Scan saved at 15:30:19, on 25/11/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32undll32.exeC:\WINDOWS\System32\CTHELPER.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\InfoKing\InfoPenMSN\Pro\InfoPenIM.exeC:\WINDOWS\logon.exeC:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\K34NUHMZ\HijackThis[1].exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://specific911.com/_start/?R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://specific911.com/_startR1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://specific911.com/_startR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32
drzs.dll/sp.html#29126R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://default-homepage-network.com/start.cgi?hkcuR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://home.free.fr/R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://specific911.com/_start/?R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://specific911.com/_start/?R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)O1 - Hosts: 64.246.26.137 winlink.bizO1 - Hosts: 64.246.26.137 winlink.wsO1 - Hosts: 64.246.26.137 ad45.comO1 - Hosts: 64.246.26.137 www.ad45.comO1 - Hosts: 64.246.26.137 ad77.comO1 - Hosts: 64.246.26.137 www.ad77.comO1 - Hosts: 64.246.26.137 ad86.comO1 - Hosts: 64.246.26.137 www.ad86.comO1 - Hosts: 64.246.26.137 ad25.comO1 - Hosts: 64.246.26.137 www.ad25.comO1 - Hosts: 64.246.26.137 00hq.comO1 - Hosts: 64.246.26.137 www.00hq.comO1 - Hosts: 64.246.26.137 8ad.comO1 - Hosts: 64.246.26.137 www.8ad.comO1 - Hosts: 64.246.26.137 searchv.comO1 - Hosts: 64.246.26.137 www.searchv.comO1 - Hosts: 64.246.26.137 008k.comO1 - Hosts: 64.246.26.137 www.008k.comO1 - Hosts: 64.246.26.137 searchmyrequest.comO1 - Hosts: 64.246.26.137 sina.com.cnO1 - Hosts: 64.246.26.137 163.comO1 - Hosts: 64.246.26.137 sohu.comO1 - Hosts: 64.246.26.137 line-plus.comO1 - Hosts: 64.246.26.137 list2004.comO1 - Hosts: 64.246.26.137 worldmpeg.comO1 - Hosts: 64.246.26.137 install.xxxtoolbar.comO1 - Hosts: 64.246.26.137 ewebsearch.netO1 - Hosts: 64.246.26.137 casino.comO1 - Hosts: 64.246.26.137 lycos.comO1 - Hosts: 64.246.26.137 excite.comO1 - Hosts: 64.246.26.137 dmoz.orgO1 - Hosts: 64.246.26.137 wisenut.comO1 - Hosts: 64.246.26.137 teoma.comO1 - Hosts: 64.246.26.137 search.comO1 - Hosts: 64.246.26.137 yahoo.comO1 - Hosts: 64.246.26.137 geosites.comO1 - Hosts: 64.246.26.137 i-lookup.comO1 - Hosts: 64.246.26.137 sexocean.comO1 - Hosts: 64.246.26.137 sexsq.comO1 - Hosts: 64.246.26.137 onlyteenstgp.comO1 - Hosts: 64.246.26.137 worldsex.comO1 - Hosts: 64.246.26.137 in.webcounter.ccO1 - Hosts: 64.246.26.137 penisbot.comO1 - Hosts: 64.246.26.137 1freepornfinder.comO1 - Hosts: 64.246.26.137 megapornlinks.comO1 - Hosts: 64.246.26.137 wowtgp.comO1 - Hosts: 64.246.26.137 hereistheporn.comO1 - Hosts: 64.246.26.137 persiankitty.comO1 - Hosts: 64.246.26.137 porndirectory.comO1 - Hosts: 64.246.26.137 jk-porn.comO1 - Hosts: 64.246.26.137 www.pizdato.bizO1 - Hosts: 64.246.26.137 pichunter.comO1 - Hosts: 64.246.26.137 pizdato.bizO1 - Hosts: 64.246.26.137 www.search-motor.comO1 - Hosts: 64.246.26.137 38.117.144.162O1 - Hosts: 64.246.26.137 209.66.114.129O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - C:\WINDOWS\mslagent\4b_1,0,1,2_mslagent.dll (file missing)O2 - BHO: (no name) - {5E98A737-F955-2341-8318-F6BA73211958} - C:\WINDOWS\system32\mfcij.dll (file missing)O2 - BHO: (no name) - {9056A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - (no file)O2 - BHO: ohb - {CB5B2BC6-F957-4D8A-BE67-83F3EC58BA01} - C:\WINDOWS\System32\dsktrf.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLLO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [InfoPenMSN] C:\Program Files\InfoKing\InfoPenMSN\Pro\InfoPenIM.exeO4 - HKLM\..\Run: [WinLogon] C:\WINDOWS\logon.exeO4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [WinMX] C:\Progra~1\WinMX\WinMX.exe -mO4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silentO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142YYFRO9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O15 - Trusted Zone: *.skoobidoo.comO16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_old.exeO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cabO16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cabO16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cabO16 - DPF: {DDF44FD9-749F-4761-89BB-E8A59339E459} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_9_FR_XP.cabO16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{38661474-A9FA-4E58-BA03-D69A431F34CC}: NameServer = 212.27.32.176O17 - HKLM\System\CS1\Services\Tcpip\..\{38661474-A9FA-4E58-BA03-D69A431F34CC}: NameServer = 212.27.32.176O17 - HKLM\System\CS2\Services\Tcpip\..\{38661474-A9FA-4E58-BA03-D69A431F34CC}: NameServer = 212.27.32.176Merci

Utilisateur anonyme · Answer

utilises le lien au post 4 .......version plus recente....

NArco · Answer

Je n'avais pas vue. Donc voila:Logfile of HijackThis v1.98.2Scan saved at 15:59:06, on 25/11/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32undll32.exeC:\WINDOWS\System32\CTHELPER.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\InfoKing\InfoPenMSN\Pro\InfoPenIM.exeC:\WINDOWS\logon.exeC:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Temp\Rar$EX00.593\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://specific911.com/_start/?R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://specific911.com/_start/?R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://specific911.com/_startR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://specific911.com/_start/?R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32
drzs.dll/sp.html#29126R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://specific911.com/_startR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://default-homepage-network.com/start.cgi?hkcuR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.htmlR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - C:\WINDOWS\mslagent\4b_1,0,1,2_mslagent.dll (file missing)O2 - BHO: (no name) - {5E98A737-F955-2341-8318-F6BA73211958} - C:\WINDOWS\system32\mfcij.dll (file missing)O2 - BHO: (no name) - {9056A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - (no file)O2 - BHO: ohb - {CB5B2BC6-F957-4D8A-BE67-83F3EC58BA01} - C:\WINDOWS\System32\dsktrf.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLLO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [InfoPenMSN] C:\Program Files\InfoKing\InfoPenMSN\Pro\InfoPenIM.exeO4 - HKLM\..\Run: [WinLogon] C:\WINDOWS\logon.exeO4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [WinMX] C:\Progra~1\WinMX\WinMX.exe -mO4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silentO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142YYFRO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO15 - Trusted Zone: *.skoobidoo.comO16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_old.exeO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cabO16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cabO16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cabO16 - DPF: {DDF44FD9-749F-4761-89BB-E8A59339E459} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_9_FR_XP.cabO16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{38661474-A9FA-4E58-BA03-D69A431F34CC}: NameServer = 212.27.32.176O17 - HKLM\System\CS1\Services\Tcpip\..\{38661474-A9FA-4E58-BA03-D69A431F34CC}: NameServer = 212.27.32.176O17 - HKLM\System\CS2\Services\Tcpip\..\{38661474-A9FA-4E58-BA03-D69A431F34CC}: NameServer = 212.27.32.176O21 - SSODL: System - {0023A0BD-9A1D-4661-906A-2B37CFF29C59} - (no file)Merci encore de passer votre temps pour nos problèmes.

Utilisateur anonyme · Answer

en mode sna s echec coches et fixes ca R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://specific911.com/_start/? R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://specific911.com/_start/? R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://specific911.com/_start R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://specific911.com/_start/? R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32
drzs.dll/sp.html#29126 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://specific911.com/_start R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://default-homepage-network.com/start.cgi?hkcu R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - C:\WINDOWS\mslagent\4b_1,0,1,2_mslagent.dll (file missing) O2 - BHO: (no name) - {5E98A737-F955-2341-8318-F6BA73211958} - C:\WINDOWS\system32\mfcij.dll (file missing) O2 - BHO: (no name) - {9056A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - (no file) O2 - BHO: ohb - {CB5B2BC6-F957-4D8A-BE67-83F3EC58BA01} - C:\WINDOWS\System32\dsktrf.dll O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142YYFR O15 - Trusted Zone: *.skoobidoo.com O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_old.exe O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cab O16 - DPF: {92ABACFE-EF6E-42C7-A824-D50A914B5B70} (MastaCash Loader Class) - http://dx.mastacash.com/loader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O16 - DPF: {DDF44FD9-749F-4761-89BB-E8A59339E459} - http://akamai.downloadv3.com/binaries/LiveService/LiveService_9_FR_XP.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O21 - SSODL: System - {0023A0BD-9A1D-4661-906A-2B37CFF29C59} - (no file)

NArco · Answer

Super, un très grand merci, tu es un magicien :)

Utilisateur anonyme · Answer

De rien.......par contre je te recommande un scan ici pour etre sur que rien ne traine http://www.pandasoftware.com/activescan/fr/activescan_principal.htm

Tormento · Answer

je me permets de poster a la suite de ce topic, car mon probleme est similair, et je n'arrive pas a le resoudre...:une "coolbar" est affichée de base sur mon IE, et malgré que j'aie effacé (avec hijackthis) la ligne contenant "http://www.thecoolbar.com/installfiles/coolbar.cab ", la coolbar est toujours la (j'avais bien sur fermé toutes mes fenetres IE avant de proceder)mon log hijackthis: ------------------------------------------Logfile of HijackThis v1.98.2Scan saved at 16:47:19, on 15/12/2004Platform: Windows 2000 SP2 (WinNT 5.00.2195)MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)Running processes:D:\WINNT\System32\smss.exeD:\WINNT\SYSTEM32\winlogon.exeD:\WINNT\system32\services.exeD:\WINNT\system32\lsass.exeD:\WINNT\system32\svchost.exeD:\WINNT\system32\spoolsv.exeD:\WINNT\System32\svchost.exeD:\WINNT\System32
vsvc32.exeD:\WINNT\system32egsvc.exeD:\WINNT\system32\MSTask.exeD:\WINNT\system32\stisvc.exeD:\WINNT\System32\WBEM\WinMgmt.exeD:\WINNT\System32\mspmspsv.exeD:\WINNT\Explorer.EXED:\Program Files\Logitech\iTouch\iTouch.exeD:\WINNT\System32\GSICON.EXED:\WINNT\System32\dslagent.exeD:\Program Files\Logitech\MouseWare\system\em_exec.exeD:\Program Files\CyberLink\PowerDVD\PDVDServ.exeD:\WINNT\loadqm.exeD:\Program Files\eMule\emule.exeD:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exeD:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exeD:\Program Files\WinAce\WinAce.exeD:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exeD:\Program Files\Internet Explorer\IEXPLORE.EXED:\PROGRA~1\FICHIE~1\KAVSHA~1\RepView.exeD:\Documents and Settings\Yoshi Torenaga\Bureau\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neogeofans.com/leforumR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://D:\WINNT\jfgfq.dll/sp.html#28129R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\WINNT\jfgfq.dll/sp.html#28129R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://D:\WINNT\jfgfq.dll/sp.html#28129R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WINNT\jfgfq.dll/sp.html#28129R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Fizzlebar.clsFwBar - {9056A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - c:\sysfwb\1117668488\iefwbar.dllO2 - BHO: (no name) - {F6FBEF53-BF96-99F0-0567-A196C405EC43} - D:\WINNT\system32\mfcex32.dll (file missing)O3 - Toolbar: @msdxmLC.dll,-1@1036,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocxO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb09.exeO4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exeO4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.ExeO4 - HKLM\..\Run: [GSICONEXE] GSICON.EXEO4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USBO4 - HKLM\..\Run: [OfficeGuard RegChecker] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"O4 - HKLM\..\Run: [AVPCC] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /waitO4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"O4 - HKLM\..\Run: [LoadQM] loadqm.exeO14 - IERESET.INF: START_PAGE_URL=http://www.fr.msn.comO14 - IERESET.INF: MS_START_PAGE_URL=http://www.fr.msn.comO15 - Trusted Zone: *.frame.crazywinnings.comO15 - Trusted Zone: *.static.topconverting.comO16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=fab19f64c271dfd5b772fcfb344ed4d5f8217f7b03e9b7145eeb15c7b73869070b857bc819ac1ca41787ff055d83fcb743482bfaec:0a002003c3f6d5950937c6314a45eb37O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{77534BCD-4344-4474-A1BE-6830984FF97B}: NameServer = 80.10.246.1 80.10.246.132-------------------------------------------------note concernant les lignes "015 - trusted zone"! je les supprime, mais elles reapparraissent a chaque scan...merci d'avance!

Ho@ker · Answer

Moi aussi, je suis infecté... Un virus a infecté rundll32.exe et infecté iexplorer.exe, voilà mon log "hijackthis" :Logfile of HijackThis v1.99.0Scan saved at 17:54:43, on 06/02/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exeC:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exeC:\WINDOWS\system32\slserv.exeC:\WINDOWS\system32\svchost.exec:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.exeC:\WINDOWS\system32\wscntfy.exeC:\PROGRA~1\MOZILL~1\FIREFOX.EXEC:\Documents and Settings\Kim\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\servlet32.exeF2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [Disk Monitor] C:\Program Files\Generic\USB Card Reader Driver v2.2(D)\Disk_Monitor.exeO4 - HKLM\..\Run: [PMCS] C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe -host -clearDebugO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exeO4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exeO4 - HKLM\..\Run: [KAV50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe" -run -n PersonalPro -v 5.0.0.0O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTARTO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exeO4 - HKLM\..\Run: [servlet] C:\WINDOWS\servlet32.exeO4 - HKLM\..\Run: [crrscr] c:\windows\system32\crrscr32.exeO4 - HKLM\..\Run: [EanthologyApp] "C:\Program Files\Fichiers communs\eAcceleration\eanthology.exe" /b StartupO4 - HKLM\..\Run: [webscan] C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe -kO4 - HKLM\..\RunServices: [servlet] C:\WINDOWS\servlet32.exeO4 - HKLM\..\RunServices: [crrscr] c:\windows\system32\crrscr32.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exeO4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDiscO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silentO4 - HKCU\..\Run: [servlet] C:\WINDOWS\servlet32.exeO4 - HKCU\..\RunServices: [servlet] C:\WINDOWS\servlet32.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeO7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099395702937O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\system32\imapi.exeO23 - Service: KLBLMain - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exeO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\system32\mnmsrvc.exeO23 - Service: Pinnacle Systems Media Service - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exeO23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)O23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exeO23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\system32\wbem\wmiapsrv.exeQue dois-je faire ?

Mitdh · Answer

J'ai le même problème que les gens précédemment. Par ailleurs, je n'arrive pas à copier les différentes lignes qui apparaissent après le lancement d'HijackThis. Merci d'avance

Mitdh · Answer

Ok, j'ai compris comment faire pour mettre les "lignes" ici.Logfile of HijackThis v1.99.0Scan saved at 18:15:51, on 06/02/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\System32\CTSvcCDA.EXEC:\WINDOWS\System32\gearsec.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\system32\sdkcv32.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\iTunes\iTunesHelper.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\iPod\bin\iPodService.exeC:	emp\salm.exeC:\Program Files\Windows AdControl\WinAdCtl.exeC:\WINDOWS\system32\iemr.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Windows AdControl\WinAdAlt.exeC:\Program Files\mkc001\mkc001.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\DOCUME~1\Michael\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exeC:\Program Files\Messenger\msmsgs.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32	fhxl.dll/sp.html#12345R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32	fhxl.dll/sp.html#12345R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32	fhxl.dll/sp.html#12345R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32	fhxl.dll/sp.html#12345R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32	fhxl.dll/sp.html#12345R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32	fhxl.dll/sp.html#12345R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32	fhxl.dll/sp.html#12345R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.indymedia.ch/frR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {8A402A73-D74F-29E4-67DE-8A44CC69FD23} - C:\WINDOWS\apixt32.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"O4 - HKLM\..\Run: [salm] c:	emp\salm.exeO4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exeO4 - HKLM\..\Run: [iemr.exe] C:\WINDOWS\system32\iemr.exeO4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silentO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=ff3132c1f1165ed87c5eb83386157f48ff902b60e6761397d62d367e7e25fc73023f21ef98dd5d11facc77917e4b6421e4b1f7feb4:b26d5d59881e3d3ce8ab2292e6aa4d79O16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cabO16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1107638970687O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cabO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXEO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Service de sécurité matérielle - GEAR Software - C:\WINDOWS\System32\gearsec.exeO23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exeO23 - Service: iPod Service - Unknown - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exeO23 - Service: Service Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exeO23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exeO23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exeO23 - Service: Workstation NetLogon Service - Unknown - C:\WINDOWS\system32\sdkcv32.exe

Je suis infecté !

14 réponses

Votre réponse

Discussions similaires

Newsletters