*.frame.crazywinning.com

Question

Bonjour

j'ai un problème je n'arrive pas à supprimer avec hijackthis les deux lignes dans la zone 015 :
- Trusted Zone :*.frame.crazywinnings.com
- Trusted Zone : *.frame.crazywinnings.com (HKLM)

hijackthis indique qu'il a supprimé les deux entrées, mais lors de la réalisation d'un nouveau scan elles sont toujours là

quelqu'un a-t-il la solution à ce problème ?

Merci

Afficher la suite

romuald_m · Answer

tu as aussi fait ces opérations en mode sans echec (F8 au démarrage de windows car je suppose que c'est ce que tu as)

bunel · Answer

Bonjour merci pour ta réponse
Je suis bien sous Windows et j'ai fait l'opération en mode sans échec, mais aussi sans succès !
Je m'étais absenté ce qui explique ma réaction à retardement...
cordialement

balltrap34 · Answer

salut
telecharge ceci
http://www.downloads.subratam.org/l2mfix.exe
decompresse le double clik dessus appuie sur n importe quelle touche et ensuite choisi l option 1
attend il vas faire un rapport fait un copier coller de celui ci
ne fait surtout rien d autres

balltrap34 · Answer

re
relance l2mfix et clik sur l2mfix.bat et cette foix clik sur l option2 et laisse le faire et met moi le rapport et un
nouveau rapport hijack

la chasse et le balltrap ma vrai passion
voir site perso dans profil

bunel · Answer

Voici ce que tu m'as demandé, merci de ton aide :L2Mfix 1.02a Running From:C:\Documents and Settings\Jean-Michel BUNEL\Bureau\l2mfix  RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Denying C access for really "Everyone" - adding new ACCESS DENY entry Registry Permissions set too:RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(CI)    DENY   --C-------   	Tout le monde(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting up for Reboot  Starting Reboot! C:\Documents and Settings\Jean-Michel BUNEL\Bureau\l2mfix System Rebooted!  Running From:C:\Documents and Settings\Jean-Michel BUNEL\Bureau\l2mfix killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 748 'explorer.exe'Killing PID 748 'explorer.exe'Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgError, Cannot find a process with an image name of rundll32.exe Scanning First Pass. Please Wait! First Pass Completed  Second Pass Scanning  Second pass Completed! Zipping up files for submission:  adding: clear.reg (164 bytes security) (deflated 2%)  adding: echo.reg (164 bytes security) (deflated 10%)  adding: direct.txt (164 bytes security) (stored 0%)  adding: lo2.txt (164 bytes security) (deflated 70%)  adding: readme.txt (164 bytes security) (deflated 49%)  adding: report.txt (164 bytes security) (deflated 63%)  adding: test.txt (164 bytes security) (stored 0%)  adding: test2.txt (164 bytes security) (stored 0%)  adding: test3.txt (164 bytes security) (stored 0%)  adding: test5.txt (164 bytes security) (stored 0%)  adding: backregs/shell.reg (164 bytes security) (deflated 73%) Restoring Registry Permissions:  RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Revoking access for really "Everyone" Registry permissions set too:RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRERestoring Sedebugprivilege:  Granting SeDebugPrivilege to Administrators   ... failed (GetAccountSid(Administrators)=1332   The following Is the Current Export of the Winlogon notify key:****************************************************************************Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]"DLLName"="Ati2evxx.dll""Asynchronous"=dword:00000000"Impersonate"=dword:00000001"Lock"="AtiLockEvent""Logoff"="AtiLogoffEvent""Logon"="AtiLogonEvent""Disconnect"="AtiDisConnectEvent""Reconnect"="AtiReConnectEvent""Safe"=dword:00000000"Shutdown"="AtiShutdownEvent""StartScreenSaver"="AtiStartScreenSaverEvent""StartShell"="AtiStartShellEvent""Startup"="AtiStartupEvent""StopScreenSaver"="AtiStopScreenSaverEvent""Unlock"="AtiUnLockEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\  6c,00,00,00"Logoff"="ChainWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\  6c,00,6c,00,00,00"Logoff"="CryptnetWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]"DLLName"="cscdll.dll""Logon"="WinlogonLogonEvent""Logoff"="WinlogonLogoffEvent""ScreenSaver"="WinlogonScreenSaverEvent""Startup"="WinlogonStartupEvent""Shutdown"="WinlogonShutdownEvent""StartShell"="WinlogonStartShellEvent""Impersonate"=dword:00000000"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]"DLLName"="wlnotify.dll""Logon"="SCardStartCertProp""Logoff"="SCardStopCertProp""Lock"="SCardSuspendCertProp""Unlock"="SCardResumeCertProp""Enabled"=dword:00000001"Impersonate"=dword:00000001"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]"Asynchronous"=dword:00000000"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00"Impersonate"=dword:00000000"StartShell"="SchedStartShell""Logoff"="SchedEventLogOff"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]"Logoff"="WLEventLogoff""Impersonate"=dword:00000000"Asynchronous"=dword:00000001"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]"DLLName"="WlNotify.dll""Lock"="SensLockEvent""Logon"="SensLogonEvent""Logoff"="SensLogoffEvent""Safe"=dword:00000001"MaxWait"=dword:00000258"StartScreenSaver"="SensStartScreenSaverEvent""StopScreenSaver"="SensStopScreenSaverEvent""Startup"="SensStartupEvent""Shutdown"="SensShutdownEvent""StartShell"="SensStartShellEvent""PostShell"="SensPostShellEvent""Disconnect"="SensDisconnectEvent""Reconnect"="SensReconnectEvent""Unlock"="SensUnlockEvent""Impersonate"=dword:00000001"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ermsrv]"Asynchronous"=dword:00000000"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00"Impersonate"=dword:00000000"Logoff"="TSEventLogoff""Logon"="TSEventLogon""PostShell"="TSEventPostShell""Shutdown"="TSEventShutdown""StartShell"="TSEventStartShell""Startup"="TSEventStartup""MaxWait"=dword:00000258"Reconnect"="TSEventReconnect""Disconnect"="TSEventDisconnect"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]"DLLName"="wlnotify.dll""Logon"="RegisterTicketExpiredNotificationEvent""Logoff"="UnregisterTicketExpiredNotificationEvent""Impersonate"=dword:00000001"Asynchronous"=dword:00000001 The following are the files found: **************************************************************************** Registry Entries that were Deleted: Please verify that the listing looks ok.  If there was something deleted wrongly there are backups in the backreg folder. ****************************************************************************REGEDIT4[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]"SV1"=""****************************************************************************Desktop.ini Contents: ********************************************************************************************************************************************************Logfile of HijackThis v1.99.0Scan saved at 21:03:52, on 06/02/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\System32\ezSP_Px.exeC:\WINDOWS\System32\wfxsnt40.exeD:\PROGRA~1\NORTON~1\DelFax\WFXSWTCH.exeD:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeC:\Program Files\QuickTime\qttask.exeD:\PROGRA~1\NORTON~1\NORTON~1
avapw32.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXEC:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\AGRSMMSG.exeD:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeD:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\wdfmgr.exeC:\Program Files\sony\vaio media music server\SSSvr.exeC:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exeC:\Program Files\Fichiers communs\sony shared\vaio media platform\SV_Httpd.exeC:\Program Files\Fichiers communs\Sony Shared\vaio media platform\sv_httpd.exeC:\Program Files\Fichiers communs\sony shared\vaio media platform\UPnPFramework.exeC:\Program Files\Fichiers communs\Sony Shared\vaio media platform\UPnPFramework.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\WINDOWS\System32\wuauclt.exeC:\Documents and Settings\Jean-Michel BUNEL\Bureau\hijackthis_199\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exeO4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exeO4 - HKLM\..\Run: [WFXSwtch] D:\PROGRA~1\NORTON~1\DelFax\WFXSWTCH.exeO4 - HKLM\..\Run: [Watch] C:\PROGRA~1\Minitel\Watch.exeO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckRegO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\drag'n drop cd+dvd\BinFiles\DragDrop.exe /StartUpO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exeO4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startupO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startupO4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0O4 - Global Startup: Adobe Gamma Loader.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NaturalColorLoad.lnk = ?O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exeO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htmO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htmO9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin4.dllO12 - Plugin for .ssc: C:\WINDOWS\Downloaded Program Files\Ubizen\SmartStart\NPSmartStart32.dllO14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/O15 - Trusted Zone: *.frame.crazywinnings.comO15 - Trusted Zone: *.sony-europe.comO15 - Trusted Zone: *.sonystyle-europe.comO15 - Trusted Zone: *.vaio-link.comO15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {40576C8E-093B-11D6-A73D-004005A6F551} - http://download.oreka.com/httpload_cab/020220/httpload.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {94B964F0-45CC-11D4-9F1D-0060085C7782} (Version Class) - https://www.dexiaplus.fr/multisecure/smartstart/Win32/SmartStartSetup.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{E3CF6F12-FEA4-49E6-9703-05B23E2E87FF}: NameServer = 212.27.32.176,212.27.32.177O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exeO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exeO23 - Service: Service Norton AntiVirus Auto-Protect - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeO23 - Service: DDE réseau - Unknown - C:\WINDOWS\system32
etdde.exeO23 - Service: DSDM DDE réseau - Unknown - C:\WINDOWS\system32
etdde.exeO23 - Service: Norton Unerase Protection - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEO23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Prise en charge des cartes à puces - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - D:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeO23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exeO23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: VAIO Media Music Server - Sony Corporation - C:\Program Files\sony\vaio media music server\SSSvr.exeO23 - Service: VAIO Media Music Server (HTTP) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\vaio media platform\sv_httpd.exeO23 - Service: VAIO Media Music Server (UPnP) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\vaio media platform\UPnPFramework.exeO23 - Service: VAIO Media Photo Server - Sony Corporation - C:\Program Files\sony\photo server\appsrv\PhotoAppSrv.exeO23 - Service: VAIO Media Photo Server (HTTP) - Sony Corporation - C:\Program Files\Fichiers communs\sony shared\vaio media platform\SV_Httpd.exeO23 - Service: VAIO Media Photo Server (UPnP) - Sony Corporation - C:\Program Files\Fichiers communs\sony shared\vaio media platform\UPnPFramework.exeO23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exeO23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.execordialementjmb

balltrap34 · Answer

demarre en mode sans echecrelance hijack et coche les 015 et fixredemarrage en mode normal et refait hijack pour voir si ils y sont encore

bipbip · Answer

Désisntaller SpyKiller faux utilitaire:
http://assiste.free.fr/p/faux_utilitaires/spykiller.php

1)Télécharger:
[url="http://www.mvps.org/winhelp2002/restricted.htm"][b]Del_HKCU_Domains.inf[/b][/url]
Clic droit-->sélectionner :Installer.
2) poste un nouveau rapport HJT HijackThis.

balltrap34 · Answer

revazs dans option internet et regarde sur l onglet securite puis site de confiance et clik sue site vire tous se qu il y a a l interieur redemarre et refait hijack pour voir si toujours la

*.frame.crazywinning.com

8 réponses

Votre réponse

Newsletters