Virus ineffacable

Question

salut a tous j'ai découvert récemment que mon ordinateur etait infecté par le virus msdirectx fu2/rootkit !!! je n'arrive pas à m'en débarasser si quelqu 'un pourrait m aider ca serait sympa !!

bernie61 · Answer

saluttu sais où il est placé, alors effaces letu as quel antivirus? firewall? système?les virus s'effaces plus facilement si tu lances ton scan antivirus en mode sans échec ou mode VGAa+

Anthox · Answer

le probleme c'est qu'il bloque carrément tout ... je ne peux pas ouvrir le ctrl + alt + suppr , je ne peu pa telecharger d antivirus sur internet , mon ordinateur est ralentit je ne trouve pas de solution d eradication !!!!

Anthox · Answer

a choak foi ke je le supprime dans regedit puis dans system 32 il reapparait !!! msdirectx fu2/rootkit ....

moe · Answer

salut anthox

telecharge hijackthis:
http://www.merijn.org/files/hijackthis.zip
Dezippe le dans un dossier prévu a cet effet.
Par exemple C:\hijack
et surtout pas dans un dossier temporaire (temp)
lance le puis:
clic sur "do a system scan and save logfile" et pas autre chose
Le bloc note va s'ouvrir, copie tout le contenu et colle le ici a la suite de ton message.

Furtif · Answer

Bonjour
Oui, il fut désactiver l'utilitaire de sauvegarde Windows, sinon il se réplique à l'infini
Démarrer / Programmes / Outils système / Restauration système / cliquer sur le lien à gauche, il ouvre sur un panneau permettant de désactiver la restauration.

Réactiver aprés l'extraction du virus

anthox · Answer

je vous remercie tous de l interet que vous portez a mon probleme je vien de faire un hikjack ( je croi ke ca s applle kom ca ) si vous pouviez y jeter un oeil ;)

Logfile of HijackThis v1.99.1
Scan saved at 01:09:10, on 01/01/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wftestb.exe
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\Program Files\AnVir Virus Destroyer\AnVir.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Amrouni\Mes documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.msn.fr/spbasic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [WFFT Test] wftestb.exe
O4 - HKLM\..\RunServices: [WFFT Test] wftestb.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fr/games7.cab?fgiocv=1
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{376C0EE3-2981-4329-A9A0-1775BDCF4083}: NameServer = 80.118.196.41 80.118.192.111
O18 - Filter: text/html - {CB00C6D7-521B-4544-ACEC-631B6F793099} - C:\Documents and Settings\Amrouni\Local Settings\Application Data\microsoft\internet explorer\V0.26.dat

anthox · Answer

personellement je n'y comprend rien mais je sais que mon ordi est un repaire de virus en tout genres !!!

anthox · Answer

ok jte remercie ;) apres ai-je d autres modifications à apporter ???

anthox · Answer

j'ai beaucoup de bugs dans mon ordinateur , le processeur ctrl + alt + suppr ne s'ouvre pas ainsi que regedit , un programme doit les bloquer de plus pour allumer mon ordinateur il me faut au moins 15 minutes car l'ecran ne s'allume pas directement puis lorsque il se met a fonctionner c'est au tour du clavier de ne pas fonctionner et quand celui ci remarche c'est au tour de la souris de rester figer !!!! je ne sais pas si un programme a pu destabiliser tout ceci ou un probleme de reglages qui me semblent pourtant bon ( scuzez moi toute cette lecture ;) )

j'ai remarquer un virus msdirectx.sys que je n'arrive pas a affacer ainsi que userinit32.exe ;(

mistral · Answer

aprés avoir fixé les lignes quelle a été la réaction du pc

anthox · Answer

j'ai pas remarquer beaucoup de différences a vrai dire et il y a encore de nombreux bugs ;(

mistral · Answer

refaite un scan hijack et posté le

adnane el hassouni · Answer

salut,
dabord essaie de le mettre dans la quarantaire afin de ne plus te deranger, penant que tu cherche une solution.
tu peux aussi(avec ton consentement bien sur) supprimer le fichier tout entier qui contient ce virus!!
merci de me repondre sur mon adresse msn si ca marche ou pas
bye

Anthox · Answer

j'ai essayer de formater l'ordinateur mais le virus ou les virus sont toujours présent .. en plus j'ai 2 disques durs mainenant j'arrive plus a en enlever un meme si j'ai tout supprimer ce qu'il contenaait ..
il me semble que le virus est msdirectx j'ai aussi un fichier suspect sbhostcs32 et winmcd.exe !!!

voila

regis59 · Answer

slt,
Ad-Aware :
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/11643.html

Le patch en Français pour Ad-Aware :
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/25543.html

Spybot :
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/26157.html

essai ceci,met les a jour, scan et supprime tous ce qu il trouve...
--------------------------------------------------------------------------
lance un scan chez RAV :
http://www.ravantivirus.com/scan/

Clique sur "To continue without subscribing click here" et attends quelques minutes.
Lorsque "Ready" est affiché dans "status", coche la case "Autoclean" puis clique sur "Scan my PC"
A la fin de l'analyse, copie/colle le rapport ici

+recolle un log hijack this

Anthox · Answer

j'aimerais bien mais ce virus ou vers bloque les telechargements je ne peux rien telecharger !!!

regis59 · Answer

remet un log hijack this !a+

Anthox · Answer

le problème c'est que les telechargements via internet sont completement bloqués !!!

il m'est impossible de telecharger sur le net ... ce doit etre un programme qui bloque les telechargements sur internet , le processus de taches ( ctrl + alt ++ suppr ) mais aussi regedit et de nombreux autres blocages et petits bugs en tout genre sous windows XP

Anthox · Answer

je sai plu tro koi faire et le formatage ne semble pas l effacer !!!

balltrap34 · Answer

tente ceci
Avec le bloc-notes, ouvre le fichier : C: \WINDOWS\system32\drivers\etc\hosts
Dans la fenêtre, fais "Edition" > "Sélectionner tout" puis appuie sur la touche “retrait”.
Ensuite tapes ceci sur la première ligne : "127.0.0.1 localhost" (sans les guillemets)
Puis fais "Fichier" > "Enregistrer" et enfin redémarre.

Le fichier hosts ne doit plus contenir que :
127.0.0.1 localhost

xp c'est C:\WINDOWS\system32\drivers\etc\hosts
Sous 2000 C: \WINNT\system32\drivers\etc\hosts
Sous les win 9x c'est C: \WINDOWS\hosts

redemarre et tente de te connecter pour telecharger ceci
fait ceci
HijackThis (ici) http://www.florensac-chasse-trap.com/
section virus

telecharge le et met le dans son propre dossier ex/c :hj

clik sur do a systeme scan et save a logfile
et copier coller le rapport

Anthox · Answer

jte remercie bokoud e ton aide j ai executer cette tache j ai reussi a telecahrger hijack this :) mai le seul bémol ce qu'il s ouvre pas :$ y a un message d erreur ...

Anthox · Answer

jte remercie beaucoup de ton aide , j ai reussi a telecharger hijack this mais il ne s ouvre pas , a la place un message d erreur apparait me laissant pas le tps de le lire et disparait aussi vite automatikmen !!!

balltrap34 · Answer

oki renomme le en dd.comla tu devrait pouvoir le lancer

Anthox · Answer

trop fort ca marche !!!alors voici le resultat du log :Logfile of HijackThis v1.99.1Scan saved at 02:12:34, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\wincmd.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Documents and Settings\Tony\Bureau\dd.com.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLLO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKLM\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKLM\..\Run: [FireFox Service Drivers] ssmss.exeO4 - HKLM\..\RunServices: [Compaq Service Drivers] wincmd.exeO4 - HKLM\..\RunServices: [FireFox Service Drivers] ssmss.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\RunServices: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\RunServices: [FireFox Service Drivers] ssmss.exeO4 - HKCU\..\RunServices: [Compaq32 Service Drivers] ms32.exeO4 - HKCU\..\RunServices: [Windows Dynamic Loading Header] winDLL32.exeO8 - Extra context menu item: &Search - http://kx.bar.need2find.com/KX/menusearch.html?p=KXO15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet ZoneO16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.196.42 80.118.192.112

balltrap34 · Answer

le log est pas complet il me manque les lignes 023recommence stp

Anthox · Answer

ah non il est complet enfin je croi je l ai recommencer plusieurs fois et il y a que ca : Logfile of HijackThis v1.99.1Scan saved at 02:23:07, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\wincmd.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Windows Media Player\wmplayer.exeC:\Documents and Settings\Tony\Bureau\dd.com.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLLO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKLM\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKLM\..\Run: [FireFox Service Drivers] ssmss.exeO4 - HKLM\..\RunServices: [Compaq Service Drivers] wincmd.exeO4 - HKLM\..\RunServices: [FireFox Service Drivers] ssmss.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\RunServices: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\RunServices: [FireFox Service Drivers] ssmss.exeO4 - HKCU\..\RunServices: [Compaq32 Service Drivers] ms32.exeO4 - HKCU\..\RunServices: [Windows Dynamic Loading Header] winDLL32.exeO8 - Extra context menu item: &Search - http://kx.bar.need2find.com/KX/menusearch.html?p=KXO15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet ZoneO16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.196.42 80.118.192.112

balltrap34 · Answer

salutcommence si tu peut a desinstaler ceci dans ajout suppression de programme Need2Find Bar imprime ceci pour ne rien oublier et tous fairetous faire dans l ordre imperativement-------------------------tous da bord telecharge ces programmes si tu ne les a pas et met les a jour mais ne les utilise pas encoreadaware (1)spyboot (2)       (ici)               http://www.florensac-chasse-trap.com/   section viruset aussi ceciCleanUp312.exe (3)----------------desactive ta restauration systeme pour ça tu fais clic droit sur poste de travail propriété tu clique sur onglet restauration système tu coche la case désactiver la restauration et applique ------------ demarre en mode sans echecmode sans echec pour cela tu tapote la touche f8 des le debut de l allumage du pc sans t arreter une fenetre vas souvrir tute deplace avec les fleches du clavier sur demarreren mode sans echec une fois sur le bureau il ni auras pas toutes les couleurs et autres c est normal.si f8 ne marche pas utilise la touche f5------------------------- assure toi de ceci Affiche tous les fichiers et dossiers : cliquer sur démarrer/panneau de configuration/option des dossiers/affichage Cocher afficher les dossiers cacher Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décocher masquer les extensions dont le type est connu Puis fais «Ok» pour valider les changements. Et appliquer ----------------------vide tes fichiers temps et tempory internet file sur tous les utilisateur utilise ceci pour le faire http://pageperso.aol.fr/Balltrap34/CleanUp312.exe   --------------------relance hijack coche ces lignes et  ensuite clik sur fixO2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL O4 - HKLM\..\Run: [Compaq Service Drivers] wincmd.exe O4 - HKLM\..\Run: [FireFox Service Drivers] ssmss.exe O4 - HKLM\..\RunServices: [Compaq Service Drivers] wincmd.exe O4 - HKLM\..\RunServices: [FireFox Service Drivers] ssmss.exe O4 - HKCU\..\Run: [Compaq Service Drivers] wincmd.exe O4 - HKCU\..\RunServices: [Compaq Service Drivers] wincmd.exe O4 - HKCU\..\RunServices: [FireFox Service Drivers] ssmss.exe O4 - HKCU\..\RunServices: [Compaq32 Service Drivers] ms32.exe O4 - HKCU\..\RunServices: [Windows Dynamic Loading Header] winDLL32.exe O8 - Extra context menu item: &Search - http://kx.bar.need2find.com/KX/menusearch.html?p=KX O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab ----------------------recherche et suppr ceciattention seulement les fichiers C:\WINDOWS\System32\wincmd.exe ssmss.exems32.exe  winDLL32.exe ---------------passe  adaware et vire tous se qu il trouve    ---------- passe spy boot et vire tous se qu il trouvent-------------tu vide ta poubelle et tu redemarre en mode normal et refait un hijack et precise ou en sont tes soucis--

Anthox · Answer

Jte remercie beaucoup car bcp de problemes sont regles mais il reste neanmoins scardclnt smart card client qui revient toujours et qui prvoque de nombreux bloquages !!!ca finira jamais !!!! :(

aNTHOX · Answer

un dernier log au cas ou Logfile of HijackThis v1.99.1Scan saved at 03:05:35, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32	askmgr.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings\Tony\Bureau\dd.com.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.196.40 80.118.192.110

Anthox · Answer

il reste de nombreux blocages ...

balltrap34 · Answer

okirenomme a nouveau dd.com en hijackthis.exeet la essai de le lancer et refait moi un nouvel hijack si il se lance ont aurat les 023

Anthox · Answer

ca a donne ca : Logfile of HijackThis v1.99.1Scan saved at 05:17:55, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\ssmss.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings\Tony\Bureau\hijackthis.exe.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKLM\..\Run: [FireFox Service Drivers] ssmss.exeO4 - HKLM\..\RunServices: [FireFox Service Drivers] ssmss.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.196.40 80.118.192.110

balltrap34 · Answer

dur ont a pas les 023redemarre en mode sans echecrelance hijack coche et fixO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [FireFox Service Drivers] ssmss.exe O4 - HKLM\..\RunServices: [FireFox Service Drivers] ssmss.exe recherche et supprC:\WINDOWS\System32\ssmss.exe la suppr hijackthis et redemarre retelecharge le et met moi le rapportla tu fait un hijack en mode normalfait ceci HijackThis                         (ici)               http://www.florensac-chasse-trap.com/   section virus telecharge le et met le dans son propre dossier ex/c :hjclik sur do a systeme scan et save a logfileet copier coller le rapport

Anthox · Answer

ssmss.exe est insupprimable

Anthox · Answer

il semble appartenir au systeme et se propage dans les logs hijack this !!! le gestionnaire des taches n aide pas non plus a le supprimer !!! :(

balltrap34 · Answer

tu la tente en mode sans echec

Anthox · Answer

oui il est planté dans le gestionnaire des taches ! et ne se supprime pas

balltrap34 · Answer

si tu le fait en mode sans echec il ne doit pas se lancer et tu doit pouvoir le suppr

Anthox · Answer

J'ai essayé en mode sans échec par tout les moyens il ne se supprime pas c'est sur ...

Anthox · Answer

J'ai essayé en mode sans échec par tout les moyens il ne se supprime pas c'est sur ...

Anthox · Answer

a moins que ... lekel dois je supprimer :smss.exeou ssmss.exe ???

moe31 · Answer

salut anthoxtu dois supprimer:C:\WINDOWS\System32\ssmss.exe et C:\WINDOWS\System32\msdirectxa+

Anthox · Answer

ok j'ai réussi a les supprimer mais toujours pas lignes 023 dans les logs hijack this :Logfile of HijackThis v1.99.1Scan saved at 01:11:26, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\windows\System32\smss.exeC:\windows\system32\winlogon.exeC:\windows\system32\services.exeC:\windows\system32\lsass.exeC:\windows\system32\svchost.exeC:\windows\Explorer.EXEC:\Documents and Settings\Tony\Bureau\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -trayO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestartO16 - DPF: Interface Chat Voila - http://chat7.x-echo.com/version5/Applet/vchatsign.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.192.111 80.118.196.41

regis59 · Answer

salut,au fait tu n as pas d antivirus??ha le telechargement, quel merde !a+

balltrap34 · Answer

salut bizzardrelance hijacthis clik sur open the misc toolspuis coche les deux cases a cote de  generate startup list puis clik sur  generate startup list cela vas te donner un rapport donne nous le

Anthox · Answer

mci a tous je vai essayer malgre les nomrbeux blokages !

Anthox · Answer

voila le rapport j'ai réussi :StartupList report, 22/05/2005, 03:26:22StartupList version: 1.52.2Started from : C:\Documents and Settings\Tony\Bureau\HijackThis.EXEDetected: Windows XP SP1 (WinNT 5.01.2600)Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)* Using default options* Including empty and uninteresting sections* Showing rarely important sections==================================================Running processes:C:\windows\System32\smss.exeC:\windows\system32\winlogon.exeC:\windows\system32\services.exeC:\windows\system32\lsass.exeC:\windows\system32\svchost.exeC:\windows\System32\svchost.exeC:\windows\Explorer.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\windows\System32\SCardClnt.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Documents and Settings\Tony\Bureau\vlc-0.8.1-win32.exeC:\windows\System32	askmgr.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\Tony\Bureau\HijackThis.exe--------------------------------------------------Listing of startup folders:Shell folders Startup:[C:\Documents and Settings\Tony\Menu Démarrer\Programmes\Démarrage]*No files*Shell folders AltStartup:*Folder not found*User shell folders Startup:*Folder not found*User shell folders AltStartup:*Folder not found*Shell folders Common Startup:[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]*No files*Shell folders Common AltStartup:*Folder not found*User shell folders Common Startup:*Folder not found*User shell folders Alternate Common Startup:*Folder not found*--------------------------------------------------Checking Windows NT UserInit:[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINDOWS\system32\userinit.exe,[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]*Registry value not found*[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunBDMCon = C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exeBDNewsAgent = C:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exe--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunShareaza = "C:\Program Files\Shareaza\Shareaza.exe" -traymsnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No values found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*No values found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\Run*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\Run*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------File association entry for .EXE:HKEY_CLASSES_ROOT\exefile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .COM:HKEY_CLASSES_ROOT\comfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .BAT:HKEY_CLASSES_ROOT\batfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .PIF:HKEY_CLASSES_ROOT\piffile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .SCR:HKEY_CLASSES_ROOT\scrfile\shell\open\command(Default) = "%1" /S--------------------------------------------------File association entry for .HTA:HKEY_CLASSES_ROOT\htafile\shell\open\command(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*--------------------------------------------------File association entry for .TXT:HKEY_CLASSES_ROOT	xtfile\shell\open\command(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1--------------------------------------------------Enumerating Active Setup stub paths:HKLM\Software\Microsoft\Active Setup\Installed Components(* = disabled by HKCU twin)[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP[>{26923b43-4d38-484f-9b9e-de460746276c}] *StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *StubPath = %SystemRoot%\system32egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32	hemeui.dll[{306D6C21-C1B6-4629-986C-E59E1875B8AF}]StubPath = "C:\WINDOWS\System32undll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub[{7790769C-0471-11d2-AF11-00C04FA35D02}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install[{89820200-ECBD-11cf-8B85-00AA005B4340}] *StubPath = regsvr32.exe /s /n /i:U shell32.dll[{89820200-ECBD-11cf-8B85-00AA005B4383}] *StubPath = %SystemRoot%\system32\ie4uinit.exe--------------------------------------------------Enumerating ICQ Agent Autostart apps:HKCU\Software\Mirabilis\ICQ\Agent\Apps*Registry key not found*--------------------------------------------------Load/Run keys from C:\windows\WIN.INI:load=*INI section not found*run=*INI section not found*Load/Run keys from Registry:HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\Windows: load=HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=--------------------------------------------------Shell & screensaver key from C:\windows\SYSTEM.INI:Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found*Shell & screensaver key from Registry:Shell=Explorer.exeSCRNSAVE.EXE=C:\WINDOWS\System32\logon.scrdrivers=*Registry value not found*Policies Shell key:HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found*--------------------------------------------------Checking for EXPLORER.EXE instances:C:\windows\Explorer.exe: PRESENT!C:\Explorer.exe: not presentC:\windows\Explorer\Explorer.exe: not presentC:\windows\System\Explorer.exe: not presentC:\windows\System32\Explorer.exe: not presentC:\windows\Command\Explorer.exe: not presentC:\windows\Fonts\Explorer.exe: not present--------------------------------------------------Checking for superhidden extensions:.lnk: HIDDEN! (arrow overlay: yes).pif: HIDDEN! (arrow overlay: yes).exe: not hidden.com: not hidden.bat: not hidden.hta: not hidden.scr: not hidden.shs: HIDDEN!.shb: HIDDEN!.vbs: not hidden.vbe: not hidden.wsh: not hidden.scf: HIDDEN! (arrow overlay: NO!).url: HIDDEN! (arrow overlay: yes).js: not hidden.jse: not hidden--------------------------------------------------Verifying REGEDIT.EXE integrity:- Regedit.exe found in C:\windows- .reg open command is normal (regedit.exe %1)- Regedit.exe has no CompanyName property! It is either missing or named something else.- Regedit.exe has no OriginalFilename property! It is either missing or named something else.- Regedit.exe has no FileDescription property! It is either missing or named something else.Registry check failed!--------------------------------------------------Enumerating Browser Helper Objects:*No BHO's found*--------------------------------------------------Enumerating Task Scheduler jobs:*No jobs found*--------------------------------------------------Enumerating Download Program Files:[DirectAnimation Java Classes]CODEBASE = file://C:\WINDOWS\Java\classes\dajava.cabOSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd[Interface Chat Voila]CODEBASE = http://chat7.x-echo.com/version5/Applet/vchatsign.cabOSD = C:\WINDOWS\Downloaded Program Files\Interface Chat Voila.osd[Microsoft XML Parser for Java]CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cabOSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd[Shockwave Flash Object]InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocxCODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab--------------------------------------------------Enumerating Winsock LSP files:NameSpace #1: C:\windows\System32\mswsock.dllNameSpace #2: C:\windows\System32\winrnr.dllNameSpace #3: C:\windows\System32\mswsock.dllProtocol #1: C:\windows\system32\mswsock.dllProtocol #2: C:\windows\system32\mswsock.dllProtocol #3: C:\windows\system32\mswsock.dllProtocol #4: C:\windows\system32svpsp.dllProtocol #5: C:\windows\system32svpsp.dllProtocol #6: C:\windows\system32\mswsock.dllProtocol #7: C:\windows\system32\mswsock.dllProtocol #8: C:\windows\system32\mswsock.dllProtocol #9: C:\windows\system32\mswsock.dllProtocol #10: C:\windows\system32\mswsock.dllProtocol #11: C:\windows\system32\mswsock.dllProtocol #12: C:\windows\system32\mswsock.dllProtocol #13: C:\windows\system32\mswsock.dllProtocol #14: C:\windows\system32\mswsock.dllProtocol #15: C:\windows\system32\mswsock.dllProtocol #16: C:\windows\system32\mswsock.dllProtocol #17: C:\windows\system32\mswsock.dllProtocol #18: C:\windows\system32\mswsock.dllProtocol #19: C:\windows\system32\mswsock.dll--------------------------------------------------Enumerating Windows NT/2000/XP servicesPilote ACPI Microsoft: System32\DRIVERS\ACPI.sys (system)Suppresseur d'écho acoustique (Noyau Microsoft): system32\drivers\aec.sys (manual start)Environnement de prise en charge de réseau AFD: \SystemRoot\System32\drivers\afd.sys (autostart)Avertissement: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Service de la passerelle de la couche Application: %SystemRoot%\System32\alg.exe (manual start)Gestion d'applications: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)Protocole client ARP 1394: System32\DRIVERS\arp1394.sys (manual start)Pilote de média asynchrone RAS: System32\DRIVERS\asyncmac.sys (manual start)Contrôleur de disque dur IDE/ESDI standard: System32\DRIVERS\atapi.sys (system)Protocole client ATM ARP: System32\DRIVERS\atmarpc.sys (manual start)Audio Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Pilote audio Stub: System32\DRIVERS\audstub.sys (manual start)BitDefender Scan Server: C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe /service (autostart)Service de transfert intelligent en arrière-plan: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Explorateur d'ordinateur: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote de CD-ROM: System32\DRIVERS\cdrom.sys (system)Service d'indexation: %SystemRoot%\system32\cisvc.exe (manual start)Gestionnaire de l'Album: %SystemRoot%\system32\clipsrv.exe (manual start)Application système COM+: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)Services de cryptographie: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)Client DHCP: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote de disque: System32\DRIVERS\disk.sys (system)Service d'administration du Gestionnaire de disque logique: %SystemRoot%\System32\dmadmin.exe /com (manual start)dmboot: System32\drivers\dmboot.sys (disabled)dmio: System32\drivers\dmio.sys (disabled)dmload: System32\drivers\dmload.sys (disabled)Gestionnaire de disque logique: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Synthétiseur DLS du noyau Microsoft: system32\drivers\DMusic.sys (manual start)Client DNS: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start)Filtre de décodeur DRM (Noyau Microsoft): system32\drivers\drmkaud.sys (manual start)Service de rapport d'erreurs: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Journal des événements: %SystemRoot%\system32\services.exe (disabled)Système d'événements de COM+: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)Compatibilité avec le Changement rapide d'utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote de contrôleur de lecteur de disquettes: System32\DRIVERS\fdc.sys (manual start)Pilote de lecteur de disquettes: System32\DRIVERS\flpydisk.sys (manual start)Pilote du Gestionnaire de volume: System32\DRIVERS\ftdisk.sys (system)Énumérateur de port jeu: System32\DRIVERS\gameenum.sys (manual start)Classificateur de paquets générique: System32\DRIVERS\msgpc.sys (manual start)Aide et support: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Accès du périphérique d'interface utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Hardware Clock Driver: C:\WINDOWS\System32\hwclock.exe (disabled)Pilote pour clavier i8042 et souris sur port PS/2: System32\DRIVERS\i8042prt.sys (system)Pilote de filtre de gravure CD: System32\DRIVERS\imapi.sys (system)Service COM de gravage de CD IMAPI: C:\WINDOWS\System32\imapi.exe (manual start)Pilote de filtre de trafic IP: System32\DRIVERS\ipfltdrv.sys (manual start)Pilote de tunnelage IP dans IP: System32\DRIVERS\ipinip.sys (manual start)Traducteur d'adresses réseau IP: System32\DRIVERS\ipnat.sys (manual start)Pilote IPSEC: System32\DRIVERS\ipsec.sys (system)Service énumérateur IR: System32\DRIVERS\irenum.sys (manual start)Pilote de bus Plug-and-Play ISA/EISA: System32\DRIVERS\isapnp.sys (system)Pilote de la classe Clavier: System32\DRIVERS\kbdclass.sys (system)Klif: \??\C:\windows\System32\Drivers\klif.sys (disabled)Klmc: System32\Drivers\klmc.sys (disabled)Mélangeur audio Wave de noyau Microsoft: system32\drivers\kmixer.sys (manual start)Serveur: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Station de travail: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Assistance TCP/IP NetBIOS: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Affichage des messages: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Partage de Bureau à distance NetMeeting: C:\WINDOWS\System32\mnmsrvc.exe (manual start)Pilote de la classe Souris: System32\DRIVERS\mouclass.sys (system)Redirecteur client WebDav: System32\DRIVERS\mrxdav.sys (manual start)MRXSMB: System32\DRIVERS\mrxsmb.sys (system)msdirectx: \??\C:\Documents and Settings\Tony\msdirectx.sys (manual start)Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)Windows Installer: C:\WINDOWS\System32\msiexec.exe /V (manual start)Proxy de service de répartition Microsoft: system32\drivers\MSKSSRV.sys (manual start)Proxy d'horloge de répartition Microsoft: system32\drivers\MSPCLOCK.sys (manual start)Proxy de gestion de qualité de répartition Microsoft: system32\drivers\MSPQM.sys (manual start)Pilote UART MIDI MPU-401 Microsoft: system32\drivers\msmpu401.sys (manual start)Pilote TAPI NDIS d'accès distant: System32\DRIVERS
distapi.sys (manual start)NDIS mode utilisateur E/S Protocole: System32\DRIVERS
disuio.sys (manual start)Pilote réseau étendu NDIS d'accès distant: System32\DRIVERS
diswan.sys (manual start)Interface NetBIOS: System32\DRIVERS
etbios.sys (system)NetBIOS sur TCP/IP: System32\DRIVERS
etbt.sys (system)DDE réseau: %SystemRoot%\system32
etdde.exe (manual start)DSDM DDE réseau: %SystemRoot%\system32
etdde.exe (manual start)Ouverture de session réseau: %SystemRoot%\System32\lsass.exe (manual start)Connexions réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote réseau 1394: System32\DRIVERS
ic1394.sys (manual start)NLA (Network Location Awareness): %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Fournisseur de la prise en charge de sécurité LM NT: %SystemRoot%\System32\lsass.exe (manual start)Stockage amovible: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)Pilote de filtre de trafic IPX: System32\DRIVERS
wlnkflt.sys (manual start)Pilote de transfert de trafic IPX: System32\DRIVERS
wlnkfwd.sys (manual start)Contrôleur hôte compatible IEE 1394 VIA OHCI: System32\DRIVERS\ohci1394.sys (system)Palladia 300/400 Usb Adsl Modem: System32\DRIVERS\usbiad.sys (manual start)Pilote de port parallèle: System32\DRIVERS\parport.sys (manual start)Pilote de bus PCI: System32\DRIVERS\pci.sys (system)Plug-and-Play: %SystemRoot%\system32\services.exe (manual start)Services IPSEC: %SystemRoot%\System32\lsass.exe (manual start)Miniport réseau étendu (PPTP): System32\DRIVERSaspptp.sys (manual start)Pilote processeur: System32\DRIVERS\processr.sys (system)Emplacement protégé: %SystemRoot%\system32\lsass.exe (manual start)Planificateur de paquets QoS: System32\DRIVERS\psched.sys (manual start)Pilote de liaison parallèle directe: System32\DRIVERS\ptilink.sys (manual start)Pilote de connexion automatique d'accès distant: System32\DRIVERSasacd.sys (system)Gestionnaire de connexion automatique d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Miniport réseau étendu (L2TP): System32\DRIVERSasl2tp.sys (manual start)Gestionnaire de connexions d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Pilote PPPOE d'accès à distance: System32\DRIVERSaspppoe.sys (manual start)Parallèle direct: System32\DRIVERSaspti.sys (manual start)Rdbss: System32\DRIVERSdbss.sys (system)RDPCDD: System32\DRIVERS\RDPCDD.sys (system)Gestionnaire de session d'aide sur le Bureau à distance: C:\WINDOWS\system32\sessmgr.exe (manual start)Pilote de filtre de lecture digitale de CD audio: System32\DRIVERSedbook.sys (system)Routage et accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Localisateur d'appels de procédure distante (RPC): %SystemRoot%\System32\locator.exe (autostart)Appel de procédure distante (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)QoS RSVP: %SystemRoot%\System32svp.exe (manual start)Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C): System32\DRIVERS\RTL8139.SYS (manual start)Gestionnaire de comptes de sécurité: %SystemRoot%\system32\lsass.exe (disabled)Smart Card Client: C:\windows\System32\SCardClnt.exe (autostart)Prise en charge des cartes à puces: %SystemRoot%\System32\SCardSvr.exe (manual start)Carte à puce: %SystemRoot%\System32\SCardSvr.exe (manual start)Planificateur de tâches: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Secdrv: System32\DRIVERS\secdrv.sys (manual start)Connexion secondaire: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Notification d'événement système: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)Pilote de filtre Serenum: System32\DRIVERS\serenum.sys (manual start)Pilote de port série: System32\DRIVERS\serial.sys (system)Pare-feu de connexion Internet (ICF) / Partage de connexion Internet (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Détection matériel noyau: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Splitter audio du noyau Microsoft: system32\drivers\splitter.sys (manual start)Spouleur d'impression: %SystemRoot%\system32\spoolsv.exe (disabled)Pilote de filtre de restauration système: \SystemRoot\System32\DRIVERS\sr.sys (disabled)Service de restauration système: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Srv: System32\DRIVERS\srv.sys (manual start)Service de découvertes SSDP: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Acquisition d'image Windows (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (manual start)Pilote de bus logiciel: System32\DRIVERS\swenum.sys (manual start)Synthétiseur de table de sons GC noyau Microsoft: system32\drivers\swmidi.sys (manual start)MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{C60D9EEA-451F-4DB5-8BEC-7167BA5CF195} (manual start)Périphérique audio système du noyau Microsoft: system32\drivers\sysaudio.sys (manual start)Journaux et alertes de performance: %SystemRoot%\system32\smlogsvc.exe (manual start)Téléphonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote du protocole TCP/IP: System32\DRIVERS	cpip.sys (system)Pilote de périphérique terminal: System32\DRIVERS	ermdd.sys (system)Services Terminal Server: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Thèmes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Client de suivi de lien distribué: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)Pilote de mise à jour microcode: System32\DRIVERS\update.sys (manual start)Gestionnaire de téléchargement: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Hôte de périphérique universel Plug-and-Play: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Onduleur: %SystemRoot%\System32\ups.exe (manual start)Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft: System32\DRIVERS\usbehci.sys (manual start)Concentrateur USB2: System32\DRIVERS\usbhub.sys (manual start)Pilote de stockage de masse USB: System32\DRIVERS\USBSTOR.SYS (manual start)Pilote miniport de contrôleur hôte universel USB Microsoft: System32\DRIVERS\usbuhci.sys (manual start)VgaSave: \SystemRoot\System32\drivers\vga.sys (system)ViaIde: System32\DRIVERS\viaide.sys (system)VIA AC'97 Audio Controller (WDM): system32\drivers\viaudio.sys (manual start)Cliché instantané de volume: %SystemRoot%\System32\vssvc.exe (manual start)Horloge Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Pilote ARP IP d'accès distant: System32\DRIVERS\wanarp.sys (manual start)Pilote WINMM de compatibilité audio WDM Microsoft: system32\drivers\wdmaud.sys (manual start)WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)Infrastructure de gestion Windows: %systemroot%\system32\svchost.exe -k netsvcs (disabled)Service de numéro de série du lecteur multimédia portable: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Carte de performance WMI: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)Mises à jour automatiques: %systemroot%\system32\svchost.exe -k netsvcs (disabled)Configuration automatique sans fil: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)BitDefender Communicator: C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe /service (autostart)--------------------------------------------------Enumerating Windows NT logon/logoff scripts:*No scripts set to run*Windows NT checkdisk command:BootExecute = autocheck autochk *Windows NT 'Wininit.ini':PendingFileRenameOperations: C:\Config.Msi\1adc4.rbf||C:\windows\Installer\1accd.msi||C:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exe.avxpnd => C:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exe||r--------------------------------------------------Enumerating ShellServiceObjectDelayLoad items:PostBootReminder: C:\windows\system32\SHELL32.dllCDBurn: C:\windows\system32\SHELL32.dllWebCheck: C:\windows\System32\webcheck.dllSysTray: C:\WINDOWS\System32\stobject.dll--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*Registry key not found*--------------------------------------------------End of report, 30 291 bytesReport generated in 0,140 secondsCommand line options:   /verbose  - to add additional info on each section   /complete - to include empty sections and unsuspicious data   /full     - to include several rarely-important sections   /force9x  - to include Win9x-only startups even if running on WinNT   /forcent  - to include WinNT-only startups even if running on Win9x   /forceall - to include all Win9x and WinNT startups, regardless of platform   /history  - to list version history only

balltrap34 · Answer

oki

Anthox · Answer

il est juste au dessus de ton post au cas ou tu ne l aurai pa vu ;)

balltrap34 · Answer

recherche et suppr ceciC:\windows\System32\Drivers\klif.sys C:\Documents and Settings\Tony\msdirectx.sys clik sur Démarrer->exécuter->tape: services.mscDouble-clique: KlifRègle-le sur "Arrêté" et "Désactivé".idem pour msdirectx

Anthox · Answer

salut dsl a tous de vs apprendre que mon ordinateur recommence serieusement a buger mais j'ai tout de même reussi a faire une anlyse hijack ou l on voit les lignes 023 enfin je pense :Logfile of HijackThis v1.99.1Scan saved at 00:11:35, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\windows\System32\smss.exeC:\windows\system32\winlogon.exeC:\windows\system32\services.exeC:\windows\system32\lsass.exeC:\windows\system32\svchost.exeC:\windows\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeC:\windows\Explorer.EXEC:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINDOWS\system32undll32.exeC:\Documents and Settings\Tony\Bureau\dd.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exeO4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exeO4 - HKLM\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKLM\..\RunServices: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -trayO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\RunServices: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestartO16 - DPF: Interface Chat Voila - http://chat7.x-echo.com/version5/Applet/vchatsign.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.192.112 80.118.196.42O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Anthox · Answer

j ai effacer les wincmd ja n arrive pas a effacer smart card client scardclnt il revient tout le temps meme en arretant le service smart card client

moe31 · Answer

salut anthoxtelecharge Silentrunners ici:http://www.silentrunners.org/Silent%20Runners.vbs(autorise ton av à executer ce script en cas d'alerte)lance le et colle ici le resultat + un log hijackthisa+

Anthox · Answer

ok voila 'Silent Runners.vbs -- find out what programs start up with Windows! ' 'DO NOT REMOVE THIS HEADER! ' 'Copyright Andrew ARONOFF 23 May 2005, http://www.silentrunners.org/ 'This script is provided without any warranty, either expressed or implied 'It may not be copied or distributed without permission ' '** YOU RUN THIS SCRIPT AT YOUR OWN RISK! ** 'HEADER ENDS HERE Option Explicit Dim strRevNo : strRevNo = "37" Public flagTest : flagTest = False 'True if testing 'flagTest = True 'Uncomment to test 'This script is divided into 24 sections. 'malware launch points: ' registry keys (I-XII, XIV) ' INI/INF-files (XV-XVI) ' folders (XVII) ' enabled scheduled tasks (XVIII) ' Winsock2 service provider DLLs (XIX) ' IE toolbars, explorer bars, extensions (XX) ' started services (XXIII) ' keyboard driver filters (XXIV) 'hijack points: ' System/Group Policies (XIII) ' prefixes for IE URLs (XXI) ' HOSTS file (XXII) 'Output is suppressed if deemed normal unless the -all parameter is used ' I. HKCU/HKLM... Run/RunOnce/RunOnce\Setup ' HKLM... RunOnceEx/RunServices/RunServicesOnce ' HKCU/HKLM... Policies\Explorer\Run ' II. HKLM... Active Setup\Installed Components\ ' HKCU... Active Setup\Installed Components\ ' (StubPath <> "" And HKLM version # > HKCU version #) ' III. HKLM... Explorer\Browser Helper Objects\ ' IV. HKLM... Shell Extensions\Approved\ ' V. HKLM... Explorer\SharedTaskScheduler/ShellExecuteHooks ' VI. HKCU/HKLM... ShellServiceObjectDelayLoad\ ' VII. HKCU... Command Processor\AutoRun ((default) <> "") ' HKCU... Policies\System\Shell (W2K & WXP only) ' HKCU... Windows\load & run ((default) <> "") ' HKCU... Command Processor\AutoRun ((default) <> "") ' HKLM... Windows\AppInit_DLLs ((default) <> "") ' HKLM... Winlogon\Shell/Userinit/System/Ginadll/Taskman ' ((default) <> explorer.exe, userinit.exe, "", "", "") ' VIII. HKLM... Winlogon\Notify\ (subkey names/DLLName values <> O/S-specific dictionary data) ' IX. HKLM... Image File Execution Options\ (subkeys with name = "Debugger") ' X. HKCU/HKLM... Policies... Startup/Shutdown, Logon/Logoff ' XI. HKCR Protocols\Filter ' XII. HKCR executable file type (bat/cmd/com/exe/hta/pif/scr) ' (shell\open\command data <> "%1" %*; hta <> mshta.exe "%1" %*; scr <> "%1" /S) ' XIII. System/Group Policies ' XIV. Enabled Wallpaper & Screen Saver ' XV. WIN.INI (load/run <> ""), SYSTEM.INI (shell <> explorer.exe, scrnsave.exe), WINSTART.BAT ' XVI. AUTORUN.INF in root of fixed drive (open/shellexecute <> "") ' XVII. %WINDIR%... Startup & All Users... Startup (W98/WME) or ' %USERNAME%... Startup & All Users... Startup folder contents 'XVIII. Scheduled Tasks ' XIX. Winsock2 Service Provider DLLs ' XX. Internet Explorer Toolbars, Explorer Bars, Extensions ' XXI. Internet Explorer URL Prefixes ' XXII. HOSTS file 'XXIII. Started Services ' XXIV. Keyboard Driver Filters Dim Wshso : Set Wshso = WScript.CreateObject("WScript.Shell") Dim WshoArgs : Set WshoArgs = WScript.Arguments Dim intErrNum Dim strflagTest : strflagTest = "" If flagTest Then strflagTest = "TEST " Wshso.Popup "Silent Runners is in testing mode.",1, _ "Testing, testing, 1-2-3...", vbOKOnly + vbExclamation End If On Error Resume Next Dim Fso : Set Fso = CreateObject("Scripting.FileSystemObject") intErrNum = Err.Number : Err.Clear On Error Goto 0 If intErrNum <> 0 Then strURL = "http://tinyurl.com/7nn6" intMB = MsgBox (Chr(34) & "Silent Runners" & Chr(34) &_ " cannot access file services critical to" & vbCRLF &_ "proper script operation." & vbCRLF & vbCRLF &_ "If you are running Windows XP, make sure that the" &_ vbCRLF & Chr(34) & "Cryptographic Services" & Chr(34) &_ " service is started." & vbCRLF & vbCRLF &_ "You can also try reinstalling the latest version of the MS" &_ vbCRLF & "Windows Script Host." & vbCRLF & vbCRLF &_ "Press " & Chr(34) & "OK" & Chr(34) & " to direct your browser to " &_ "the download site or" & vbCRLF & Space(10) & Chr(34) & "Cancel" &_ Chr(34) & " to quit.", vbOKCancel + vbCritical, _ "Can't access the FileSystemObject!") 'if dl wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL WScript.Quit End If Dim oNetwk : Set oNetwk = WScript.CreateObject("WScript.Network") Const HKLM = &H80000002 : Const HKCU = &H80000001 Const REG_SZ = 1 : Const REG_EXPAND_SZ = 2 : Const REG_BINARY = 3 Const REG_DWORD = 4 : Const REG_MULTI_SZ = 7 Const MS = " [MS]" 'determine whether output is via MsgBox/PopUp or Echo Dim flagOut If InStr(LCase(WScript.FullName),"wscript.exe") > 0 Then flagOut = "W" 'WScript ElseIf InStr(LCase(WScript.FullName),"cscript.exe") > 0 Then flagOut = "C" 'CScript Else 'echo and continue if it works flagOut = "C" 'assume CScript-compatible WScript.Echo "Neither " & Chr(34) & "WSCRIPT.EXE" & Chr(34) & " nor " &_ Chr(34) & "CSCRIPT.EXE" & Chr(34) & " was detected as " &_ "the script host." & vbCRLF & Chr(34) & "Silent Runners" & Chr(34) &_ " will assume that the script host is CSCRIPT-compatible and will" & vbCRLF &_ "use WScript.Echo for all messages." End If 'script host Const SysFolder = 1 : Const WinFolder = 0 Dim strOS : strOS = "Unknown" Dim strOSLong : strOSLong = "Unknown" Dim strOSXP : strOSXP = "Windows XP Home" 'XP Home or Pro Dim intMB 'MsgBox return value Public strFPSF : strFPSF = Fso.GetSpecialFolder(SysFolder).Path 'FullPathSystemFolder Public strFPWF : strFPWF = Fso.GetSpecialFolder(WinFolder).Path 'FullPathWindowsFolder Public strExeBareName 'bare file name w/o windows or system folder prefixes Dim strSysVer 'Winver.exe version number Dim intErrNum1, intErrNum2, intErrNum3, intErrNum4, intErrNum5, intErrNum6 'error number Dim intLenValue 'value length Dim strURL 'download URL Dim flagGP : flagGP = False 'assume Group Policies cannot be set in the O/S 'Winver.exe is in \Windows under W98, but in \System32 for other O/S's 'trap GetFileVersion error for VBScript version < 5.1 On Error Resume Next If Fso.FileExists (strFPSF & "\Winver.exe") Then strSysVer = Fso.GetFileVersion(strFPSF & "\Winver.exe") Else strSysVer = Fso.GetFileVersion(strFPWF & "\Winver.exe") End If intErrNum = Err.Number : Err.Clear On Error Goto 0 'if old VBScript version If intErrNum <> 0 Then 'store dl URL strURL = "http://tinyurl.com/7zh0" 'if using WScript If flagOut = "W" Then 'explain the problem intMB = MsgBox ("This script requires VBScript 5.1 or higher " &_ "to run." & vbCRLF & vbCRLF & "The latest version of VBScript can " &_ "be downloaded at: " & strURL & vbCRLF & vbCRLF &_ "Press " & Chr(34) & "OK" & Chr(34) & " to direct your browser to " &_ "the download site or " & Chr(34) & "Cancel" & Chr(34) &_ " to quit." & vbCRLF & vbCRLF & "(WMI is also required. If it's " &_ "missing, download instructions will appear later.)", _ vbOKCancel + vbExclamation,"Unsupported VBScript Version!") 'if dl wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL 'if using CScript Else 'flagOut = "C" 'explain the problem WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ "VBScript 5.1 or higher to run." & vbCRLF & vbCRLF &_ "It can be downloaded at: " & strURL End If 'WScript or CScript? 'quit the script WScript.Quit End If 'error encountered? 'use WINVER.EXE file version to determine O/S If Instr(Left(strSysVer,3),"4.1") > 0 Then strOS = "W98" : strOSLong = "Windows 98" ElseIf Instr(Left(strSysVer,5),"4.0.1") > 0 Then strOS = "NT4" : strOSLong = "Windows NT 4.0" ElseIf Instr(Left(strSysVer,8),"4.0.0.95") > 0 Then strOS = "W98" : strOSLong = "Windows 95" ElseIf Instr(Left(strSysVer,3),"5.0") > 0 Then strOS = "W2K" : strOSLong = "Windows 2000" : flagGP = True ElseIf Instr(Left(strSysVer,3),"5.1") > 0 Then 'SP0 & SP1 = 5.1.2600.0, SP2 = 5.1.2600.2180 strOS = "WXP" : strOSLong = "Windows XP" If Instr(strSysVer,".2180") > 0 Then strOSLong = "Windows XP SP2" ElseIf Instr(Left(strSysVer,3),"4.9") > 0 Then strOS = "WME" : strOSLong = "Windows Me (Millennium Edition)" ElseIf Instr(Left(strSysVer,3),"5.2") > 0 Then strOS = "WXP" : strOSLong = "Windows Server 2003 (interpreted as Windows XP)" flagGP = True Else If flagOut = "W" Then intMB = MsgBox ("The " & Chr(34) & "Silent Runners" & Chr(34) &_ " script cannot determine the operating system." & vbCRLF & vbCRLF &_ "Click " & Chr(34) & "OK" & Chr(34) & " to send an e-mail to the " &_ "author, providing the following information:" & vbCRLF & vbCRLF &_ "WINVER.EXE file version = " & strSysVer & vbCRLF & vbCRLF &_ "or click " & Chr(34) & "Cancel" & Chr(34) & " to quit.", _ 49,"O/S Unknown!") If intMB = 1 Then Wshso.Run "mailto:Andrew%20Aronoff%20" &_ "<%73%72.%6F%73.%76%65%72.%65%72%72%6F%72@%61%61%72%6F%6E%6F%66%66.%63%6F%6D>?" &_ "subject=Silent%20Runners%20OS%20Version%20Error&body=WINVER.EXE" &_ "%20file%20version%20=%20" & strSysVer Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " cannot " &_ "determine the operating system." & vbCRLF & vbCRLF & "This script will exit." End If WScript.Quit End If 'array of Run keys, counter x 5, hive member, startup folder file, startup file shortcut Dim arRunKeys, i, ii, j, k, l, oHiveElmt, oSUFi, oSUSC 'dictionary, keys, items Dim arSK, arSKk, arSKi 'arrays: Run key names, keys, sub-keys, value type, Protocol filters Dim arNames(), arKeys(), arSubKeys(), arType, arFilter() 'name member, key member x 2, sub-key, O/S Dim oName, oKey, oKey2, strSubKey, oOS 'values x 6 Dim strValue, strValue1, strValue2, strValue3, strValue4, strValue5, strValue6 'name, single character, startup folder name, startup folder, array member, temp var Dim strName, strChr, arSUFN, oSUF, strArMember, strTmp 'output string x 3 Dim strOut, strOut1, strOut2 'output file msg x 2, warning string, title line Dim strLine, strLine1, strLine2, strWarn, strTitleLine Dim strKey, strKey1, strKey2, strKey3 'register key x 4 'output file name string, PIF path string, single binary character Dim strFN, strPIFTgt, bin1C Dim datLaunch, intCnt 'script launch time, counter 'TRUE if show all output (default values not filtered) Public flagShowAll : flagShowAll = False Dim strRptOutput : strRptOutput = "Output limited to non-default values, " &_ "except where indicated by " & Chr(34) & "{++}" & Chr(34) 'output file string Public flagTLW : flagTLW = False 'flag Title Line Written Public flagSTLW : flagSTLW = False 'flag Sub-Title Line Written Public flagSSTLW : flagSSTLW = False 'flag Sub-Sub-Title Line Written Dim flagInfect : flagInfect = False 'flag infected condition Dim flagMatch 'flag matching keys Dim flagAllow 'flag key on approved list Dim flagFound 'flag key that exists in Registry Dim flagDirArg : flagDirArg = False 'presence of output directory argument Dim flagAllArg : flagAllArg = False 'presence of all output argument Dim intLBSP 'Last BackSlash Position in path string Dim intSS 'lowest sort subscript Dim strDLL, strCN 'DLL name, company name 'string to signal all output by default Public strAllOutDefault : strAllOutDefault = "" Dim ScrPath : ScrPath = Fso.GetParentFolderName(WScript.ScriptFullName) If Right(ScrPath,1) <> "\" Then ScrPath = ScrPath & "\" 'initialize Path of Output File Folder to script path Dim strPathOFFo : strPathOFFo = ScrPath 'constant dictionary Dim arHives(1,1) arHives(0,0) = "HKCU" : arHives(1,0) = "HKLM" arHives(0,1) = &H80000001 : arHives(1,1) = &H80000002 'check if output directory or "-all" was supplied as argument If WshoArgs.length > 0 And WshoArgs.length <= 2 Then For i = 0 To WshoArgs.length-1 'if directory arg not already passed and arg directory exists If Not flagDirArg And Fso.FolderExists(WshoArgs(i)) Then 'get the path & toggle the directory arg flag Dim oOFFo : Set oOFFo = Fso.GetFolder(WshoArgs(i)) strPathOFFo = oOFFo.Path : flagDirArg = True If Right(strPathOFFo,1) <> "\" Then strPathOFFo = strPathOFFo & "\" Set oOFFo=Nothing 'if -all arg not already passed and is this arg ElseIf Not flagAllArg And LCase(WshoArgs(i)) = "-all" Then 'toggle ShowAll flag, toggle the all arg flag, fill report string flagShowAll = True : flagAllArg = True strRptOutput = "Output of all locations checked and all values found." 'argument can't be interpreted, so explain & quit Else If flagOut = "W" Then 'pop up a message window Wshso.Popup "The argument:" & vbCRLF &_ Chr(34) & UCase(WshoArgs(i)) & Chr(34) & vbCRLF &_ "... can't be interpreted." & vbCRLF & vbCRLF &_ "Only two arguments are permitted:" & vbCRLF & vbCRLF &_ "1. the name of an existing directory" & vbCRLF &_ Space(4) & "(embed in quotes if it contains spaces)" & vbCRLF & vbCRLF &_ "2. " & Chr(34) & "-all" & Chr(34) & " to output all non-empty values.",10, _ "Bad Script Argument", vbOKOnly + vbExclamation Else 'flagOut = "C" 'write the message to the console WScript.Echo "The argument: " &_ Chr(34) & UCase(WshoArgs(i)) & Chr(34) &_ " can't be interpreted." & vbCRLF & vbCRLF &_ "Only two arguments are permitted:" & vbCRLF & vbCRLF &_ "1. the name of an existing directory (embed in quotes if it " &_ "contains spaces)" & vbCRLF &_ "2. " & Chr(34) & "-all" & Chr(34) & " to output all non-empty " &_ "values." & vbCRLF End If 'WScript host? WScript.Quit End If 'argument can be interpreted? Next 'argument 'too many args passed ElseIf WshoArgs.length > 2 Then 'explain & quit If flagOut = "W" Then 'pop up a message window Wshso.Popup "Too many arguments (" & WshoArgs.length & ") were passed." &_ vbCRLF & vbCRLF & "Only two arguments are permitted:" & vbCRLF & vbCRLF &_ "1. the name of an existing directory" & vbCRLF &_ Space(4) & "(embed in quotes if it contains spaces)" & vbCRLF & vbCRLF &_ "2. " & Chr(34) & "-all" & Chr(34) & " to output all non-empty values.",_ 10,"Too Many Arguments", vbOKOnly + vbCritical Else 'flagOut = "C" 'write the message to the console WScript.Echo "Too many arguments (" & WshoArgs.length & ") were passed." &_ vbCRLF & vbCRLF & "Only two arguments are permitted:" & vbCRLF &_ "1. the name of an existing directory (embed in quotes if it contains spaces)" & vbCRLF &_ "2. " & Chr(34) & "-all" & Chr(34) & " to output all non-empty values." & vbCRLF End If 'WScript host? WScript.Quit End If 'directory arguments passed? 'create output file name with computer name & today's date 'Startup Programs (pc_name_here) yyyy-mm-dd.txt datLaunch = Now strFN = strPathOFFo & strflagTest & "Startup Programs (" &_ oNetwk.ComputerName & ") " & FmtDate(datLaunch) & " " &_ FmtHMS(datLaunch) & ".txt" On Error Resume Next If Fso.FileExists(strFN) Then Fso.DeleteFile(strFN) Err.Clear Public oFN : Set oFN = Fso.CreateTextFile(strFN,True) intErrNum = Err.Number : Err.Clear On Error Goto 0 'if can't create report file If intErrNum > 0 Then strURL = "http://www.silentrunners.org/Silent%20Runners%20RED.vbs" 'invite user to e-mail me & quit If flagOut = "W" Then intMB = MsgBox ("The script cannot create its report file. This is a known, intermittent" &_ vbCRLF & "problem under " & strOSLong & "." & vbCRLF & vbCRLF &_ "An alternative script version is available for download. After it runs, " &_ vbCRLF & "the script you're using now will run correctly." & vbCRLF & vbCRLF &_ "Press " & Chr(34) & "OK" & Chr(34) & " to direct your browser to the alternate" &_ " script location, or" & vbCRLF & Space(10) & Chr(34) &_ "Cancel" & Chr(34) & " to quit.",49,"CreateTextFile Error!") 'if alternative script wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL 'explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " cannot " &_ "create the report file." & vbCRLF & vbCRLF &_ "An alternative script is available. Run it, then rerun this version." &_ vbCRLF & "The alternative script can be downloaded at: " & vbCRLF &_ vbCRLF & strURL End If WScript.Quit End If 'report file creation error? 'add report header Set oNetwk=Nothing oFN.WriteLine Chr(34) & "Silent Runners.vbs" & Chr(34) &_ ", revision " & strRevNo & ", http://www.silentrunners.org/" &_ vbCRLF & "Operating System: " & strOSLong & vbCRLF & strRptOutput &_ vbCRLF & vbCRLF 'use WMI to connect to the registry On Error Resume Next Dim oReg : Set oReg = GetObject("winmgmts:root\default:StdRegProv") intErrNum = Err.Number : Err.Clear On Error Goto 0 'WMI connection error If intErrNum <> 0 Then strURL = "" 'for W98/NT4, assume WMI not installed and direct to d/l URL If strOS = "W98" Or strOS = "NT4" Then If strOS = "W98" Then strURL = "http://tinyurl.com/jbxe" If strOS = "NT4" Then strURL = "http://tinyurl.com/7wd7" 'add d/l site to report file oFN.WriteLine "This script requires WMI, which can be downloaded " &_ "at: " & strURL oFN.Close 'invite user to download WMI & quit If flagOut = "W" Then intMB = MsgBox ("This script requires " & Chr(34) & "WMI" &_ Chr(34) & ", Windows Management Instrumentation, to run." &_ vbCRLF & vbCRLF & "It can be downloaded at: " & strURL &_ vbCRLF & vbCRLF & "Press " & Chr(34) & "OK" & Chr(34) &_ " to direct your browser to the download site or " &_ Chr(34) & "Cancel" & Chr(34) & " to quit.",_ vbOKCancel + vbCritical,"WMI Not Installed!") If intMB = 1 Then Wshso.Run strURL 'at command line, explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ Chr(34) & "WMI" & Chr(34) & ", Windows Management Instrumentation, " &_ "to run." & vbCRLF & vbCRLF & "It can be downloaded at: " & strURL End If 'for W2K Or WXP, explain how to start the WMI service ElseIf strOS = "W2K" Or strOS = "WXP" Then 'add instructions to report file oFN.WriteLine "This script requires WMI." & vbCRLF &_ "Go into Control Panel, Administrative Tools, Services," & vbCRLF &_ "and start the " & Chr(34) & "Windows Management Instrumentation" &_ Chr(34) & " service." oFN.Close strLine = "" If strOS = "W2K" Then strLine = "Settings, " 'explain how to turn on WMI service If flagOut = "W" Then MsgBox "This script requires Windows Management Instrumentation" &_ " to run." & vbCRLF & vbCRLF & "Click on Start, " & strLine &_ "Control Panel, Administrative Tools, Services," & vbCRLF &_ "and start the " & Chr(34) & "Windows Management Instrumentation" &_ Chr(34) & " service.",vbOKOnly + vbCritical,"WMI Service not running!" 'at command line, explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ "Windows Management Instrumentation to run." & vbCRLF & vbCRLF &_ "Click on Start, " & strLine & "Control Panel, Administrative " &_ " Tools, Services," & vbCRLF & "and start the " & Chr(34) &_ "Windows Management Instrumentation" & Chr(34) & " service." End If 'flagOut? Else 'WME 'add instructions to report file oFN.WriteLine "This script requires WMI, but WMI is not running " &_ "correctly." oFN.Close 'explain how to turn on WMI service If flagOut = "W" Then MsgBox "This script requires WMI (Windows Management Instrumentation)" &_ " to run," & vbCRLF & "but WMI is not running correctly.", _ vbOKOnly + vbCritical,"WMI problem!" 'at command line, explain & quit Else 'flagOut = "C" WScript.Echo Chr(34) & "Silent Runners" & Chr(34) & " requires " &_ "WMI (Windows Management Instrumentation) to run," & vbCRLF &_ "but WMI is not running correctly." End If 'flagOut? End If 'which O/S? WScript.Quit End If 'WMI execution error 'use WMI to differentiate between WXP Home & WXP Pro If strOS = "WXP" Then 'get the O/S collection Dim colOS : Set colOS = GetObject("winmgmts:\root\cimv2").ExecQuery _ ("Select * from Win32_OperatingSystem") For Each oOS in colOS 'modify strOSXP if O/S = Pro If InStr(1,LCase(oOS.Name),"professional",1) > 0 Then strOSXP = "Windows XP Professional" flagGP = True End If 'modify strOSXP if SP2 If Right(strOSLong,3) = "SP2" Then strOSXP = strOSXP & " SP2" Next End If 'WXP? 'I. Examine HKCU/HKLM... Run/RunOnce/RunOnceEx/RunServices/RunServicesOnce ' and HKCU/HKLM... Policies\Explorer\Run If Not flagTest Then 'skip if testing 'put keys in array (Key Index 0 - 6) arRunKeys = Array ("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run", _ "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", _ "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", _ "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup", _ "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx", _ "SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices", _ "SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce") 'Key Execution Flag/Subkey Recursion Flag array ' 'first number in the ordered pair in the array immediately below ' pertains to execution of the key: '0: not executed (ignore) '1: may be executed so display with EXECUTION UNLIKELY warning '2: executable ' 'second number in the ordered pair pertains to subkey recursion '0: subkeys not used '1: subkey recursion necessary 'Hive HKCU - 0 HKLM - 1 ' 'Key 0 1 2 3 4 5 6 0 1 2 3 4 5 6 'Index ' 'O/S: 'W98 0,0 2,0 2,0 0,0 0,0 0,0 0,0 0,0 2,0 2,0 2,0 2,1 2,0 2,0 'WME 0,0 2,0 2,0 0,0 0,0 0,0 0,0 0,0 2,0 2,0 2,0 2,1 2,0 2,0 'NT4 1,0 2,0 2,0 0,0 0,0 0,0 0,0 1,0 2,0 2,0 1,0 2,1 0,0 0,0 'W2K 2,1 2,1 2,1 0,0 0,0 0,0 0,0 2,1 2,1 2,1 0,0 2,1 0,0 0,0 'WXP 2,0 2,0 2,0 0,0 0,0 0,0 0,0 2,0 2,0 2,0 1,0 2,1 0,0 0,0 'WS2K3 ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? ??? 'arRegFlag(i,j,k): put flags in array by O/S: 'hive = i (0 or 1), key_# = j (0-6), ' flags (key execution/subkey recursion) = k (0 or 1) ' k = 0 holds key execution value = 0/1/2 ' 1 holds subkey recursion value = 0/1 Dim arRegFlag() ReDim arRegFlag(1,6,1) 'initialize entire array to zero For i = 0 To 1 : For j = 0 To 6 : For k = 0 To 1 arRegFlag(i,j,k) = 0 Next : Next : Next 'add data to array for O/S that's running 'W98 0,0 2,0 2,0 0,0 0,0 0,0 0,0 0,0 2,0 2,0 2,0 2,1 2,0 2,0 If strOS = "W98" Or strOS = "WME" Then arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,3,0) = 2 'HKLM,RunOnce\Setup = no-warn arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys arRegFlag(1,5,0) = 2 'HKLM,RunServices = no-warn arRegFlag(1,6,0) = 2 'HKLM,RunServicesOnce = no-warn End If 'NT4 1,0 2,0 2,0 0,0 0,0 0,0 0,0 1,0 2,0 2,0 1,0 2,1 0,0 0,0 If strOS = "NT4" Then arRegFlag(0,0,0) = 1 'HKCU,Explorer\Run = warning arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(1,0,0) = 1 'HKLM,Explorer\Run = warning arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,3,0) = 1 'HKLM,RunOnce\Setup = warning arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys End If 'W2K 2,1 2,1 2,1 0,0 0,0 0,0 0,0 2,1 2,1 2,1 0,0 2,1 0,0 0,0 If strOs = "W2K" Then arRegFlag(0,0,0) = 2 'HKCU,Explorer\Run = no-warn arRegFlag(0,0,1) = 1 'HKCU,Explorer\Run = sub-keys arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,1,1) = 1 'HKCU,Run = sub-keys arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(0,2,1) = 1 'HKCU,RunOnce = sub-keys arRegFlag(1,0,0) = 2 'HKLM,Explorer\Run = no-warn arRegFlag(1,0,1) = 1 'HKLM,Explorer\Run = sub-keys arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,1,1) = 1 'HKLM,Run = sub-keys arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,2,1) = 1 'HKLM,RunOnce = sub-keys arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys End If 'WXP 2,0 2,0 2,0 0,0 0,0 0,0 0,0 2,0 2,0 2,0 1,0 2,1 0,0 0,0 If strOs = "WXP" Then arRegFlag(0,0,0) = 2 'HKCU,Explorer\Run = no-warn arRegFlag(0,1,0) = 2 'HKCU,Run = no-warn arRegFlag(0,2,0) = 2 'HKCU,RunOnce = no-warn arRegFlag(1,0,0) = 2 'HKLM,Explorer\Run = no-warn arRegFlag(1,1,0) = 2 'HKLM,Run = no-warn arRegFlag(1,2,0) = 2 'HKLM,RunOnce = no-warn arRegFlag(1,3,0) = 1 'HKLM,RunOnce\Setup = warning arRegFlag(1,4,0) = 2 'HKLM,RunOnceEx = no-warn arRegFlag(1,4,1) = 1 'HKLM,RunOnceEx = sub-keys End If 'write registry header lines to file strLine = "Startup items buried in registry:" oFN.WriteLine strLine oFN.WriteLine String(Len(strLine),"-") oFN.WriteBlankLines (1) 'for each hive For i = 0 To 1 'for each key For j = 0 To 6 'if not ShowAll, show all output for Run keys If j = 1 And Not flagShowAll Then strAllOutDefault = " {++}" 'if key is not ignored If arRegFlag(i,j,0) > 0 Then 'intialize string with warning if necessary strWarn = "" If arRegFlag(i,j,0) = 1 Then strWarn = "EXECUTION UNLIKELY: " 'find key's entries EnumKeyData arHives(i,1), arHives(i,0), arRunKeys(j), strWarn 'recurse subkeys if necessary If arRegFlag(i,j,1) = 1 Then 'put all subkeys into array oReg.EnumKey arHives(i,1),arRunKeys(j),arKeys 'with no sub-keys: ' IsArray TypeName UBound 'W98 True "Variant()" -1 'WME True "Variant()" -1 'NT4 True "Variant()" -1 'W2K False "Null" -- 'WXP False "Null" -- 'WS2K3 True "Variant()" -- 'if sub-keys exist (W2K/WXP) If IsArray(arKeys) Then 'for each subkey (W98/WME/NT4/WS2K3 will not iterate) For Each oKey in arKeys 'find key's entries EnumKeyData arHives(i,1), arHives(i,0), arRunKeys(j) & "\" & oKey, strWarn Next End If 'sub-keys exist? W2K/WXP/WS2K3 End If 'enum sub-keys? End If 'arRegFlag(i,j,0) > 0 Next 'Run key Next 'Hive strAllOutDefault = "" 'recover array memory ReDim arRunKeys(0) ReDim arKeys(0) ReDim arRegFlag(0,0,0) End If 'flagTest? 'II. Examine HKLM... Active Setup\Installed Components If Not flagTest Then 'skip if testing 'flags True if only numeric & comma chrs in Version values Dim flagHKLMVer, flagHKCUVer 'StubPath Value string, HKLM Version value, HKCU Version value, HKLM program name Dim strSPV, strHKLMVer, strHKCUVer, strPgmName Dim arHKLMKeys, arHKCUKeys, strHKLMKey, strHKCUKey strKey = "Software\Microsoft\Active Setup\Installed Components" 'find all the subkeys oReg.EnumKey HKLM, strKey, arHKLMKeys 'HKLM oReg.EnumKey HKCU, strKey, arHKCUKeys 'HKCU 'enumerate HKLM keys if present If IsArray(arHKLMKeys) Then 'for each HKLM key For Each strHKLMKey In arHKLMKeys 'Default Value not set: 'W98/WME: returns 0, strValue = "" 'NT4/W2K/WXP: returns non-zero, strValue = Null 'Non-Default name inexistent: 'W98/WME/NT4/W2K/WXP: returns non-zero, strValue = Null 'Non-Default Value not set: 'W2K: returns 0, strValue = unwritable string 'W98/WME/NT4/WXP: returns 0, strValue = "" 'get the StubPath value intErrNum = oReg.GetStringValue (HKLM,strKey & "\" & strHKLMKey,"StubPath",strSPV) 'if the StubPath name exists And value set (exc for W2K!) If intErrNum = 0 And strSPV <> "" Then flagMatch = False 'if HKCU keys present If IsArray(arHKCUKeys) Then 'for each HKCU key For Each strHKCUKey in arHKCUKeys 'if identical HKLM key exists If LCase(strHKLMKey) = LCase(strHKCUKey) Then 'assume Version fmts are OK flagHKLMVer = True : flagHKCUVer = True 'get HKLM & HKCU Version values intErrNum1 = oReg.GetStringValue (HKLM,strKey & "\" & strHKLMKey,"Version",strHKLMVer) 'HKLM Version # intErrNum2 = oReg.GetStringValue (HKCU,strKey & "\" & strHKCUKey,"Version",strHKCUVer) 'HKCU Version # 'if HKLM Version name exists And value set (exc for W2K!) If intErrNum1 = 0 And strHKLMVer <> "" Then 'the next two loops check for allowed chars (numeric & comma) ' in returned Version values For i = 1 To Len(strHKLMVer) strChr = Mid(strHKLMVer,i,1) If Not IsNumeric(strChr) And strChr <> "," Then flagHKLMVer = False Next 'if HKCU Version name exists And value set (exc for W2K!) If intErrNum2 = 0 And strHKCUVer <> "" Then 'check that value consists only of numeric & comma chrs For i = 1 To Len(strHKCUVer) strChr = Mid(strHKCUVer,i,1) If Not IsNumeric(strChr) And strChr <> "," Then flagHKCUVer = False Next End If 'HKCU Version null or MT? 'if HKLM Ver # has illegal fmt (i.e., is not assigned) or doesn't exist (is Null) ' or is empty, match = True 'if HKCU/HKLM Ver # fmts OK And HKCU Ver # >= HKLM Ver #, match = True 'if HKLM Ver # = "0,0" and HKCU Ver # = "", key will output ' but StubPath will not launch If Not flagHKLMVer Then flagMatch = True If flagHKLMVer And flagHKCUVer And strHKCUVer >= strHKLMVer Then flagMatch = True Else 'HKLM Version name doesn't exist Or value not set (exc for W2K!) flagMatch = True End If 'HKLM Version name exists And value set (exc for W2K!)? End If 'HKCU key=HKLM key? Next 'HKCU Installed Components key End If 'HKCU Installed Components subkeys exist? 'if the StubPath will launch If Not flagMatch Then flagAllow = False 'assume StubPath DLL not on approved list strCN = CoName(IDExe(strSPV)) 'test for approved StubPath DLL If LCase(strHKLMKey) = ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}" And _ (InStr(LCase(strSPV),"wmpocm.exe") > 0 Or _ InStr(LCase(strSPV),"unregmp2.exe") > 0) And _ strCN = MS And Not flagShowAll Then flagAllow = True 'StubPath DLL not approved If Not flagAllow Then 'get the default value (program name) intErrNum3 = oReg.GetStringValue (HKLM,strKey & "\" & strHKLMKey,"",strPgmName) 'enclose pgm name in quotes if name exists and default value isn't empty If intErrNum3 = 0 And strPgmName <> "" Then strPgmName = Chr(34) & strPgmName & Chr(34) Else strPgmName = "(no title provided)" End If 'output the title line if not already done If Not flagTLW Then oFN.WriteLine "HKLM" & "\" & strKey & "\" flagTLW = True End If 'output the CLSID & pgm name oFN.WriteLine strHKLMKey & "\(Default) = " & StringFilter(strPgmName,False) On Error Resume Next 'output the StubPath value oFN.WriteLine Space(Len(strHKLMKey)+1) & "\StubPath = " &_ Chr(34) & strSPV & Chr(34) & strCN 'error check for W2K if StubPath value not set If Err.Number <> 0 Then oFN.WriteLine Space(Len(strHKLMKey)+1) & "\StubPath = " &_ "(value not set)" Err.Clear On Error GoTo 0 End If 'flagAllow false? End If 'flagMatch false? End If 'StubPath value exists? Next 'HKLM Installed Components subkey End If 'HKLM Installed Components subkeys exist? 'if output occurred in this section, add a blank line If flagTLW Then oFN.WriteBlankLines (1) 'if no output occurred, but ShowAll, output the key name ElseIf flagShowAll Then oFN.WriteLine "HKLM" & "\" & strKey & "\" & vbCRLF End If flagTLW = False 'recover array memory ReDim arHKLMKeys(0) ReDim arHKCUKeys(0) End If 'flagTest? 'III. Examine HKLM... Explorer\Browser Helper Objects If Not flagTest Then 'skip if testing strKey = "Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" 'find all the subkeys oReg.EnumKey HKLM, strKey, arSubKeys 'enumerate data if present If IsArray(arSubKeys) Then 'for each key For Each strSubKey In arSubKeys If Not flagTLW Then oFN.WriteLine "HKLM" & "\" & strKey & "\" flagTLW = True End If If Len(strSubKey) = 38 Then 'strSubKey is CLSID 'get the default value intErrNum1 = oReg.GetStringValue (HKLM,strKey & "\" & strSubKey,"",strValue) 'if the BHO title exists, embed it in quotes If intErrNum1 = 0 And strValue <> "" Then strValue = StringFilter(strValue,True) Else 'check the CLSID default value strKey2 = "Software\Classes\CLSID\" & strSubKey intErrNum2 = oReg.GetStringValue (HKLM,strKey2,"",strValue2) 'if the CLSID default value exists, embed it in quotes and say where it came from If intErrNum2 = 0 And strValue2 <> "" Then strValue = StringFilter(strValue2,True) & " [from CLSID]" Else 'use a standard string strValue = "(no title provided)" End If 'CLSID title exists? End If 'BHO title exists? 'resolve the data via HKLM\Software\Classes\CLSID\{data}\InProcServer32 strKey3 = "Software\Classes\CLSID\" & strSubKey & "\InProcServer32" intErrNum3 = oReg.GetExpandedStringValue (HKLM,strKey3,"",strValue3) 'if InProcServer32 key exists and default value set If intErrNum3 = 0 And strValue3 <> "" Then strValue3 = StringFilter(strValue3,True) & CoName(IDExe(strValue3)) 'output the quote-delimited names and values oFN.WriteLine strSubKey & "\(Default) = " & strValue oFN.WriteLine " -> {CLSID}\InProcServer32\(Default) = " & strValue3 End If 'InProcServer32 key exists And default value set? End If 'strSubKey CSID? Next 'BHO subkey End If 'BHO subkeys exist? 'if ShowAll, output the key name if not already done If Not flagTLW And flagShowAll Then oFN.WriteLine "HKLM" & "\" & strKey & "\" : flagTLW = True End if If flagTLW Then oFN.WriteBlankLines (1) flagTLW = False 'recover array memory ReDim arSubKeys(0) End If 'flagTest? 'IV. Examine HKLM... Shell Extensions\Approved\ If Not flagTest Then 'skip if testing 'CLSID value, InProcessServer32 DLL name & output file version Dim strCLSID, strIPSDLL, strIPSDLLOut 'Shell Extension Approved array Dim arSEA() ReDim arSEA(243,1) 'WXP arSEA(0,0) = "{00022613-0000-0000-C000-000000000046}" : arSEA(0,1) = "mmsys.cpl" arSEA(1,0) = "{176d6597-26d3-11d1-b350-080036a75b03}" : arSEA(1,1) = "icmui.dll" arSEA(2,0) = "{1F2E5C40-9550-11CE-99D2-00AA006E086C}" : arSEA(2,1) = "rshx32.dll" arSEA(3,0) = "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}" : arSEA(3,1) = "docprop.dll" arSEA(4,0) = "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}" : arSEA(4,1) = "ntshrui.dll" arSEA(5,0) = "{41E300E0-78B6-11ce-849B-444553540000}" : arSEA(5,1) = "themeui.dll" arSEA(6,0) = "{42071712-76d4-11d1-8b24-00a0c9068ff3}" : arSEA(6,1) = "deskadp.dll" arSEA(7,0) = "{42071713-76d4-11d1-8b24-00a0c9068ff3}" : arSEA(7,1) = "deskmon.dll" arSEA(8,0) = "{42071714-76d4-11d1-8b24-00a0c9068ff3}" : arSEA(8,1) = "deskpan.dll" arSEA(9,0) = "{4E40F770-369C-11d0-8922-00A024AB2DBB}" : arSEA(9,1) = "dssec.dll" arSEA(10,0) = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" : arSEA(10,1) = "SlayerXP.dll" arSEA(11,0) = "{56117100-C0CD-101B-81E2-00AA004AE837}" : arSEA(11,1) = "shscrap.dll" arSEA(12,0) = "{59099400-57FF-11CE-BD94-0020AF85B590}" : arSEA(12,1) = "diskcopy.dll" arSEA(13,0) = "{59be4990-f85c-11ce-aff7-00aa003ca9f6}" : arSEA(13,1) = "ntlanui2.dll" arSEA(14,0) = "{5DB2625A-54DF-11D0-B6C4-0800091AA605}" : arSEA(14,1) = "icmui.dll" arSEA(15,0) = "{675F097E-4C4D-11D0-B6C1-0800091AA605}" : arSEA(15,1) = "icmui.dll" arSEA(16,0) = "{764BF0E1-F219-11ce-972D-00AA00A14F56}" : arSEA(16,1) = "" arSEA(17,0) = "{77597368-7b15-11d0-a0c2-080036af3f03}" : arSEA(17,1) = "printui.dll" arSEA(18,0) = "{7988B573-EC89-11cf-9C00-00AA00A14F56}" : arSEA(18,1) = "dskquoui.dll" arSEA(19,0) = "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}" : arSEA(19,1) = "" arSEA(20,0) = "{85BBD920-42A0-1069-A2E4-08002B30309D}" : arSEA(20,1) = "syncui.dll" arSEA(21,0) = "{88895560-9AA2-1069-930E-00AA0030EBC8}" : arSEA(21,1) = "hticons.dll" arSEA(22,0) = "{BD84B380-8CA2-1069-AB1D-08000948F534}" : arSEA(22,1) = "fontext.dll" arSEA(23,0) = "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}" : arSEA(23,1) = "icmui.dll" arSEA(24,0) = "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}" : arSEA(24,1) = "rshx32.dll" arSEA(25,0) = "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}" : arSEA(25,1) = "ntshrui.dll" arSEA(26,0) = "{f92e8c40-3d33-11d2-b1aa-080036a75b03}" : arSEA(26,1) = "deskperf.dll" arSEA(27,0) = "{7444C717-39BF-11D1-8CD9-00C04FC29D45}" : arSEA(27,1) = "cryptext.dll" arSEA(28,0) = "{7444C719-39BF-11D1-8CD9-00C04FC29D45}" : arSEA(28,1) = "cryptext.dll" arSEA(29,0) = "{7007ACC7-3202-11D1-AAD2-00805FC1270E}" : arSEA(29,1) = "NETSHELL.dll" arSEA(30,0) = "{992CFFA0-F557-101A-88EC-00DD010CCC48}" : arSEA(30,1) = "NETSHELL.dll" arSEA(31,0) = "{E211B736-43FD-11D1-9EFB-0000F8757FCD}" : arSEA(31,1) = "wiashext.dll" arSEA(32,0) = "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}" : arSEA(32,1) = "wiashext.dll" arSEA(33,0) = "{905667aa-acd6-11d2-8080-00805f6596d2}" : arSEA(33,1) = "wiashext.dll" arSEA(34,0) = "{3F953603-1008-4f6e-A73A-04AAC7A992F1}" : arSEA(34,1) = "wiashext.dll" arSEA(35,0) = "{83bbcbf3-b28a-4919-a5aa-73027445d672}" : arSEA(35,1) = "wiashext.dll" arSEA(36,0) = "{F0152790-D56E-4445-850E-4F3117DB740C}" : arSEA(36,1) = "remotepg.dll" arSEA(37,0) = "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}" : arSEA(37,1) = "wuaucpl.cpl" arSEA(38,0) = "{60254CA5-953B-11CF-8C96-00AA00B8708C}" : arSEA(38,1) = "wshext.dll" arSEA(39,0) = "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}" : arSEA(39,1) = "oledb32.dll" arSEA(40,0) = "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}" : arSEA(40,1) = "mstask.dll" arSEA(41,0) = "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}" : arSEA(41,1) = "mstask.dll" arSEA(42,0) = "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}" : arSEA(42,1) = "mstask.dll" arSEA(43,0) = "{0DF44EAA-FF21-4412-828E-260A8728E7F1}" : arSEA(43,1) = "" arSEA(44,0) = "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(44,1) = "shdocvw.dll" arSEA(45,0) = "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(45,1) = "shdocvw.dll" arSEA(46,0) = "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(46,1) = "shdocvw.dll" arSEA(47,0) = "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(47,1) = "shdocvw.dll" arSEA(48,0) = "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(48,1) = "shdocvw.dll" arSEA(49,0) = "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(49,1) = "shdocvw.dll" arSEA(50,0) = "{D20EA4E1-3957-11d2-A40B-0C5020524152}" : arSEA(50,1) = "shdocvw.dll" arSEA(51,0) = "{D20EA4E1-3957-11d2-A40B-0C5020524153}" : arSEA(51,1) = "shdocvw.dll" arSEA(52,0) = "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}" : arSEA(52,1) = "shmedia.dll" arSEA(53,0) = "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}" : arSEA(53,1) = "shmedia.dll" arSEA(54,0) = "{E4B29F9D-D390-480b-92FD-7DDB47101D71}" : arSEA(54,1) = "shmedia.dll" arSEA(55,0) = "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}" : arSEA(55,1) = "shmedia.dll" arSEA(56,0) = "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}" : arSEA(56,1) = "shmedia.dll" arSEA(57,0) = "{c5a40261-cd64-4ccf-84cb-c394da41d590}" : arSEA(57,1) = "shmedia.dll" arSEA(58,0) = "{5E6AB780-7743-11CF-A12B-00AA004AE837}" : arSEA(58,1) = "browseui.dll" arSEA(59,0) = "{22BF0C20-6DA7-11D0-B373-00A0C9034938}" : arSEA(59,1) = "browseui.dll" arSEA(60,0) = "{91EA3F8B-C99B-11d0-9815-00C04FD91972}" : arSEA(60,1) = "browseui.dll" arSEA(61,0) = "{6413BA2C-B461-11d1-A18A-080036B11A03}" : arSEA(61,1) = "browseui.dll" arSEA(62,0) = "{F61FFEC1-754F-11d0-80CA-00AA005B4383}" : arSEA(62,1) = "browseui.dll" arSEA(63,0) = "{7BA4C742-9E81-11CF-99D3-00AA004AE837}" : arSEA(63,1) = "browseui.dll" arSEA(64,0) = "{30D02401-6A81-11d0-8274-00C04FD5AE38}" : arSEA(64,1) = "browseui.dll" arSEA(65,0) = "{32683183-48a0-441b-a342-7c2a440a9478}" : arSEA(65,1) = "browseui.dll" arSEA(66,0) = "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}" : arSEA(66,1) = "browseui.dll" arSEA(67,0) = "{07798131-AF23-11d1-9111-00A0C98BA67D}" : arSEA(67,1) = "browseui.dll" arSEA(68,0) = "{AF4F6510-F982-11d0-8595-00AA004CD6D8}" : arSEA(68,1) = "browseui.dll" arSEA(69,0) = "{01E04581-4EEE-11d0-BFE9-00AA005B4383}" : arSEA(69,1) = "browseui.dll" arSEA(70,0) = "{A08C11D2-A228-11d0-825B-00AA005B4383}" : arSEA(70,1) = "browseui.dll" arSEA(71,0) = "{00BB2763-6A77-11D0-A535-00C04FD7D062}" : arSEA(71,1) = "browseui.dll" arSEA(72,0) = "{7376D660-C583-11d0-A3A5-00C04FD706EC}" : arSEA(72,1) = "browseui.dll" arSEA(73,0) = "{6756A641-DE71-11d0-831B-00AA005B4383}" : arSEA(73,1) = "browseui.dll" arSEA(74,0) = "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}" : arSEA(74,1) = "browseui.dll" arSEA(75,0) = "{7e653215-fa25-46bd-a339-34a2790f3cb7}" : arSEA(75,1) = "browseui.dll" arSEA(76,0) = "{acf35015-526e-4230-9596-becbe19f0ac9}" : arSEA(76,1) = "browseui.dll" arSEA(77,0) = "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}" : arSEA(77,1) = "browseui.dll" arSEA(78,0) = "{00BB2764-6A77-11D0-A535-00C04FD7D062}" : arSEA(78,1) = "browseui.dll" arSEA(79,0) = "{03C036F1-A186-11D0-824A-00AA005B4383}" : arSEA(79,1) = "browseui.dll" arSEA(80,0) = "{00BB2765-6A77-11D0-A535-00C04FD7D062}" : arSEA(80,1) = "browseui.dll" arSEA(81,0) = "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}" : arSEA(81,1) = "browseui.dll" arSEA(82,0) = "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}" : arSEA(82,1) = "browseui.dll" arSEA(83,0) = "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}" : arSEA(83,1) = "browseui.dll" arSEA(84,0) = "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}" : arSEA(84,1) = "browseui.dll" arSEA(85,0) = "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}" : arSEA(85,1) = "browseui.dll" arSEA(86,0) = "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}" : arSEA(86,1) = "browseui.dll" arSEA(87,0) = "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}" : arSEA(87,1) = "shdocvw.dll" arSEA(88,0) = "{0A89A860-D7B1-11CE-8350-444553540000}" : arSEA(88,1) = "shdocvw.dll" arSEA(89,0) = "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}" : arSEA(89,1) = "shdocvw.dll" arSEA(90,0) = "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}" : arSEA(90,1) = "shdocvw.dll" arSEA(91,0) = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" : arSEA(91,1) = "shdocvw.dll" arSEA(92,0) = "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}" : arSEA(92,1) = "shdocvw.dll" arSEA(93,0) = "{FF393560-C2A7-11CF-BFF4-444553540000}" : arSEA(93,1) = "shdocvw.dll" arSEA(94,0) = "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}" : arSEA(94,1) = "shdocvw.dll" arSEA(95,0) = "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}" : arSEA(95,1) = "shdocvw.dll" arSEA(96,0) = "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" : arSEA(96,1) = "shdocvw.dll" arSEA(97,0) = "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}" : arSEA(97,1) = "shdocvw.dll" arSEA(98,0) = "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}" : arSEA(98,1) = "shdocvw.dll" arSEA(99,0) = "{131A6951-7F78-11D0-A979-00C04FD705A2}" : arSEA(99,1) = "shdocvw.dll" arSEA(100,0) = "{9461b922-3c5a-11d2-bf8b-00c04fb93661}" : arSEA(100,1) = "shdocvw.dll" arSEA(101,0) = "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}" : arSEA(101,1) = "shdocvw.dll" arSEA(102,0) = "{871C5380-42A0-1069-A2EA-08002B30309D}" : arSEA(102,1) = "shdocvw.dll" arSEA(103,0) = "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}" : arSEA(103,1) = "shdocvw.dll" arSEA(104,0) = "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}" : arSEA(104,1) = "sendmail.dll" arSEA(105,0) = "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}" : arSEA(105,1) = "sendmail.dll" arSEA(106,0) = "{88C6C381-2E85-11D0-94DE-444553540000}" : arSEA(106,1) = "occache.dll" arSEA(107,0) = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" : arSEA(107,1) = "webcheck.dll" arSEA(108,0) = "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}" : arSEA(108,1) = "webcheck.dll" arSEA(109,0) = "{F5175861-2688-11d0-9C5E-00AA00A45957}" : arSEA(109,1) = "webcheck.dll" arSEA(110,0) = "{08165EA0-E946-11CF-9C87-00AA005127ED}" : arSEA(110,1) = "webcheck.dll" arSEA(111,0) = "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}" : arSEA(111,1) = "webcheck.dll" arSEA(112,0) = "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}" : arSEA(112,1) = "webcheck.dll" arSEA(113,0) = "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}" : arSEA(113,1) = "webcheck.dll" arSEA(114,0) = "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}" : arSEA(114,1) = "webcheck.dll" arSEA(115,0) = "{D8BD2030-6FC9-11D0-864F-00AA006809D9}" : arSEA(115,1) = "webcheck.dll" arSEA(116,0) = "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}" : arSEA(116,1) = "webcheck.dll" arSEA(117,0) = "{352EC2B7-8B9A-11D1-B8AE-006008059382}" : arSEA(117,1) = "appwiz.cpl" arSEA(118,0) = "{0B124F8F-91F0-11D1-B8B5-006008059382}" : arSEA(118,1) = "appwiz.cpl" arSEA(119,0) = "{CFCCC7A0-A282-11D1-9082-006008059382}" : arSEA(119,1) = "appwiz.cpl" arSEA(120,0) = "{e84fda7c-1d6a-45f6-b725-cb260c236066}" : arSEA(120,1) = "shimgvw.dll" arSEA(121,0) = "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}" : arSEA(121,1) = "shimgvw.dll" arSEA(122,0) = "{3F30C968-480A-4C6C-862D-EFC0897BB84B}" : arSEA(122,1) = "shimgvw.dll" arSEA(123,0) = "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}" : arSEA(123,1) = "shimgvw.dll" arSEA(124,0) = "{EAB841A0-9550-11cf-8C16-00805F1408F3}" : arSEA(124,1) = "shimgvw.dll" arSEA(125,0) = "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}" : arSEA(125,1) = "shimgvw.dll" arSEA(126,0) = "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}" : arSEA(126,1) = "netplwiz.dll" arSEA(127,0) = "{add36aa8-751a-4579-a266-d66f5202ccbb}" : arSEA(127,1) = "netplwiz.dll" arSEA(128,0) = "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}" : arSEA(128,1) = "netplwiz.dll" arSEA(129,0) = "{58f1f272-9240-4f51-b6d4-fd63d1618591}" : arSEA(129,1) = "netplwiz.dll" arSEA(130,0) = "{7A9D77BD-5403-11d2-8785-2E0420524153}" : arSEA(130,1) = "" arSEA(131,0) = "{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}" : arSEA(131,1) = "zipfldr.dll" arSEA(132,0) = "{BD472F60-27FA-11cf-B8B4-444553540000}" : arSEA(132,1) = "zipfldr.dll" arSEA(133,0) = "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}" : arSEA(133,1) = "zipfldr.dll" arSEA(134,0) = "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}" : arSEA(134,1) = "cdfview.dll" arSEA(135,0) = "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}" : arSEA(135,1) = "cdfview.dll" arSEA(136,0) = "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}" : arSEA(136,1) = "cdfview.dll" arSEA(137,0) = "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}" : arSEA(137,1) = "cdfview.dll" arSEA(138,0) = "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}" : arSEA(138,1) = "cdfview.dll" arSEA(139,0) = "{63da6ec0-2e98-11cf-8d82-444553540000}" : arSEA(139,1) = "msieftp.dll" arSEA(140,0) = "{883373C3-BF89-11D1-BE35-080036B11A03}" : arSEA(140,1) = "docprop2.dll" arSEA(141,0) = "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}" : arSEA(141,1) = "docprop2.dll" arSEA(142,0) = "{8EE97210-FD1F-4B19-91DA-67914005F020}" : arSEA(142,1) = "docprop2.dll" arSEA(143,0) = "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}" : arSEA(143,1) = "docprop2.dll" arSEA(144,0) = "{6A205B57-2567-4A2C-B881-F787FAB579A3}" : arSEA(144,1) = "docprop2.dll" arSEA(145,0) = "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}" : arSEA(145,1) = "docprop2.dll" arSEA(146,0) = "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}" : arSEA(146,1) = "dsquery.dll" arSEA(147,0) = "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}" : arSEA(147,1) = "dsquery.dll" arSEA(148,0) = "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}" : arSEA(148,1) = "dsquery.dll" arSEA(149,0) = "{F020E586-5264-11d1-A532-0000F8757D7E}" : arSEA(149,1) = "dsquery.dll" arSEA(150,0) = "{0D45D530-764B-11d0-A1CA-00AA00C16E65}" : arSEA(150,1) = "dsuiext.dll" arSEA(151,0) = "{62AE1F9A-126A-11D0-A14B-0800361B1103}" : arSEA(151,1) = "dsuiext.dll" arSEA(152,0) = "{ECF03A33-103D-11d2-854D-006008059367}" : arSEA(152,1) = "mydocs.dll" arSEA(153,0) = "{ECF03A32-103D-11d2-854D-006008059367}" : arSEA(153,1) = "mydocs.dll" arSEA(154,0) = "{4a7ded0a-ad25-11d0-98a8-0800361b1103}" : arSEA(154,1) = "mydocs.dll" arSEA(155,0) = "{750fdf0e-2a26-11d1-a3ea-080036587f03}" : arSEA(155,1) = "cscui.dll" arSEA(156,0) = "{10CFC467-4392-11d2-8DB4-00C04FA31A66}" : arSEA(156,1) = "cscui.dll" arSEA(157,0) = "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}" : arSEA(157,1) = "cscui.dll" arSEA(158,0) = "{143A62C8-C33B-11D1-84FE-00C04FA34A14}" : arSEA(158,1) = "agentpsh.dll" arSEA(159,0) = "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}" : arSEA(159,1) = "dfsshlex.dll" arSEA(160,0) = "{60fd46de-f830-4894-a628-6fa81bc0190d}" : arSEA(160,1) = "photowiz.dll" arSEA(161,0) = "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}" : arSEA(161,1) = "mmcshext.dll" arSEA(162,0) = "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}" : arSEA(162,1) = "cabview.dll" arSEA(163,0) = "{32714800-2E5F-11d0-8B85-00AA0044F941}" : arSEA(163,1) = "wabfind.dll" arSEA(164,0) = "{8DD448E6-C188-4aed-AF92-44956194EB1F}" : arSEA(164,1) = "wmpshell.dll" arSEA(165,0) = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}" : arSEA(165,1) = "wmpshell.dll" arSEA(166,0) = "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}" : arSEA(166,1) = "wmpshell.dll" 'W2K arSEA(167,0) = "{41E300E0-78B6-11ce-849B-444553540000}" : arSEA(167,1) = "plustab.dll" arSEA(168,0) = "{1A9BA3A0-143A-11CF-8350-444553540000}" : arSEA(168,1) = "shell32.dll" arSEA(169,0) = "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" : arSEA(169,1) = "shell32.dll" arSEA(170,0) = "{86747AC0-42A0-1069-A2E6-08002B30309D}" : arSEA(170,1) = "shell32.dll" arSEA(171,0) = "{0AFACED1-E828-11D1-9187-B532F1E9575D}" : arSEA(171,1) = "shell32.dll" arSEA(172,0) = "{12518493-00B2-11d2-9FA5-9E3420524153}" : arSEA(172,1) = "shell32.dll" arSEA(173,0) = "{21B22460-3AEA-1069-A2DC-08002B30309D}" : arSEA(173,1) = "shell32.dll" arSEA(174,0) = "{B091E540-83E3-11CF-A713-0020AFD79762}" : arSEA(174,1) = "shell32.dll" arSEA(175,0) = "{FBF23B41-E3F0-101B-8488-00AA003E56F8}" : arSEA(175,1) = "shell32.dll" arSEA(176,0) = "{C2FBB630-2971-11d1-A18C-00C04FD75D13}" : arSEA(176,1) = "shell32.dll" arSEA(177,0) = "{C2FBB631-2971-11d1-A18C-00C04FD75D13}" : arSEA(177,1) = "shell32.dll" arSEA(178,0) = "{13709620-C279-11CE-A49E-444553540000}" : arSEA(178,1) = "shell32.dll" arSEA(179,0) = "{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}" : arSEA(179,1) = "shell32.dll" arSEA(180,0) = "{4622AD11-FF23-11d0-8D34-00A0C90F2719}" : arSEA(180,1) = "shell32.dll" arSEA(181,0) = "{7BA4C740-9E81-11CF-99D3-00AA004AE837}" : arSEA(181,1) = "shell32.dll" arSEA(182,0) = "{D969A300-E7FF-11d0-A93B-00A0C90F2719}" : arSEA(182,1) = "shell32.dll" arSEA(183,0) = "{09799AFB-AD67-11d1-ABCD-00C04FC30936}" : arSEA(183,1) = "shell32.dll" arSEA(184,0) = "{3FC0B520-68A9-11D0-8D77-00C04FD70822}" : arSEA(184,1) = "shell32.dll" arSEA(185,0) = "{75048700-EF1F-11D0-9888-006097DEACF9}" : arSEA(185,1) = "shell32.dll" arSEA(186,0) = "{6D5313C0-8C62-11D1-B2CD-006097DF8C11}" : arSEA(186,1) = "shell32.dll" arSEA(187,0) = "{57651662-CE3E-11D0-8D77-00C04FC99D61}" : arSEA(187,1) = "shell32.dll" arSEA(188,0) = "{4657278A-411B-11d2-839A-00C04FD918D0}" : arSEA(188,1) = "shell32.dll" arSEA(189,0) = "{A470F8CF-A1E8-4f65-8335-227475AA5C46}" : arSEA(189,1) = "shell32.dll" arSEA(190,0) = "{568804CA-CBD7-11d0-9816-00C04FD91972}" : arSEA(190,1) = "browseui.dll" arSEA(191,0) = "{5b4dae26-b807-11d0-9815-00c04fd91972}" : arSEA(191,1) = "browseui.dll" arSEA(192,0) = "{8278F931-2A3E-11d2-838F-00C04FD918D0}" : arSEA(192,1) = "browseui.dll" arSEA(193,0) = "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}" : arSEA(193,1) = "browseui.dll" arSEA(194,0) = "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}" : arSEA(194,1) = "browseui.dll" arSEA(195,0) = "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}" : arSEA(195,1) = "browseui.dll" arSEA(196,0) = "{0E5CBF21-D15F-11d0-8301-00AA005B4383}" : arSEA(196,1) = "browseui.dll" arSEA(197,0) = "{7487cd30-f71a-11d0-9ea7-00805f714772}" : arSEA(197,1) = "browseui.dll" arSEA(198,0) = "{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}" : arSEA(198,1) = "thumbvw.dll" arSEA(199,0) = "{EAB841A0-9550-11CF-8C16-00805F1408F3}" : arSEA(199,1) = "thumbvw.dll" arSEA(200,0) = "{1AEB1360-5AFC-11D0-B806-00C04FD706EC}" : arSEA(200,1) = "thumbvw.dll" arSEA(201,0) = "{9DBD2C50-62AD-11D0-B806-00C04FD706EC}" : arSEA(201,1) = "thumbvw.dll" arSEA(202,0) = "{500202A0-731E-11D0-B829-00C04FD706EC}" : arSEA(202,1) = "thumbvw.dll" arSEA(203,0) = "{0B124F8C-91F0-11D1-B8B5-006008059382}" : arSEA(203,1) = "appwiz.cpl" arSEA(204,0) = "{fe1290f0-cfbd-11cf-a330-00aa00c16e65}" : arSEA(204,1) = "dsfolder.dll" arSEA(205,0) = "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}" : arSEA(205,1) = "dsfolder.dll" arSEA(206,0) = "{450D8FBA-AD25-11D0-98A8-0800361B1103}" : arSEA(206,1) = "mydocs.dll" 'WXP SP2 arSEA(207,0) = "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}" : arSEA(207,1) = "shdocvw.dll" arSEA(208,0) = "{596AB0

Anthox · Answer

et voici le log :Logfile of HijackThis v1.99.1Scan saved at 22:42:51, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\windows\System32\smss.exeC:\windows\system32\winlogon.exeC:\windows\system32\services.exeC:\windows\system32\lsass.exeC:\windows\system32\svchost.exeC:\windows\System32\svchost.exeC:\windows\System32\SCardClnt.exeC:\windows\Explorer.EXEC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Shareaza\Shareaza.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Documents and Settings\Tony\Bureau\dd.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKLM\..\RunServices: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [Compaq Service Drivers] wincmd.exeO4 - HKCU\..\RunServices: [Compaq Service Drivers] wincmd.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: Interface Chat Voila - http://chat7.x-echo.com/version5/Applet/vchatsign.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.192.112 80.118.196.42O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\windows\System32\SCardClnt.exeO23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe (file missing)

moe31 · Answer

salut anthoxpour silent runner, il faut que tu double clic sur le fichier silent runners.vbs, tu attend quelques secondes et une fenetre va s'ouvrir en t'indiquant que le scan est fini.au meme endroit ou tu as enregistré silentrunners, tu trouvera un fichier txt (startup program.......).c'est le contenu de ce fichier qu'il faut que tu colle ici.a+

Anthox · Answer

nan mais laisse tomber c'est trop compliquer pour moi je croi que je vai me resigner a vouloir le reparer tout seul !!!ca sert a rien ca revien tout le tempsLogfile of HijackThis v1.99.1Scan saved at 06:32:05, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\windows\System32\smss.exeC:\windows\system32\winlogon.exeC:\windows\system32\services.exeC:\windows\system32\lsass.exeC:\windows\system32\svchost.exeC:\windows\System32\svchost.exeC:\windows\Explorer.EXEC:\windows\system32\cmd.exeC:\windows\System32	askmgr.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Shareaza\Shareaza.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\Tony\Bureau\dd.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestartO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: Interface Chat Voila - http://chat7.x-echo.com/version5/Applet/vchatsign.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{34A19060-09A9-4FE0-A8AC-DDEA6F1F24EA}: NameServer = 80.118.196.42 80.118.192.112

moe31 · Answer

bon, on va essayer autre chosetelecharge  Registry Search Tool ici:http://www.billsway.com/vbspage/vbsfiles/RegSrch.zipdezippe le et lance letape msdirectxcopie et colle le resutat icitelecharge sartdreck icihttp://www.niksoft.at/php/dl.php?f=startdreck.zip dezippe le et lance startdreck.exe Clic sur config clic sur unmarck all dans la colonne registry coche: - run keys - browsers helpers object - internet explorer - shellServicesObjectDelayLoad dans la colonne Files coche: - autostart folders dans la colonne System/drivers coche: - running processes Valide ok et clic sur refresh Maintenant, clique sur save pour enregistrer le log. poste le resultat du log.a+

Alexandre · Answer

Bonjour,Mon ordinateur semble avoir un ou plusieurs virus. En effet, à chaque connexion, plusieurs petites fenêtres de pub  s'affichent au moins une dizaine de fois sans que je lance un navigateur. De plus, un logiciel nommé "Click Me" s'installe sans autorisation et reviens même aprés sa désinstallation (ca m'étonne pas). Norton a analysé mon pc, a supprimé en vain les virus. J ai alors utiliser hijack comme c'est dit plus au dans la discussion. Je vous donne mon log et vous remercie d'avance de votre aide.Logfile of HijackThis v1.99.1Scan saved at 18:15:32, on 25/05/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Apps\ActivBoard
hksrv.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeC:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\system32\slserv.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\Patrick\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O6 "USB001" /M "Stylus C44"O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exeO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitexas32.exeO4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\france.exe  -NO4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\FICHIE~1\TEKNUM~1\update.exe /startupO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO9 - Extra button: Suggestions - {2223664C-1942-4276-9A2D-E8D8F547C5D2} - res://EffiPeled (file missing)O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missingO16 - DPF: Interface Chat Wanadoo - http://chat14.x-echo.com/version6/Applet/wchatsign.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{5028DA3D-D7A6-4F38-844F-B21F2705F594}: NameServer = 217.19.192.132 217.19.192.131O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeO23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard
hksrv.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

moe31 · Answer

Salut Télécharge Lqfix ici: http://users.pandora.be/bluepatchy/LQfix.zip Déconnecte toi d'internet: Vide le cache d'Internet Explorer et supprime les cookies: * Panneau de configuration >> Options internet >> Onglet "Général" - Clic sur [supprimer les cookies] - Clic sur [Supprimer les fichiers] et coche la case "Supprimer tout le contenu hors connexion" Valide avec ok Pour ne pas se retrouver avec des points de restauration systeme infectés il vaut mieux la désactiver: Désactive la restauration systéme. Clic droit sur poste de travail > propriétés > onglet restauration système puis cocher "désactiver la restauration système". clic sur ok pour valider (accepte le redemarrage). Redémarre en mode sans échec Laisse passer l'écran du bios, puis tapote sur la touche F8 avant qu'apparaisse l'écran de chargement de windows. Choisis le mode sans échec dans les options et valide avec entrée. Rend visible les fichiers cachés et systeme panneau de configuration > options des dossiers > onglet affichage Cocher " afficher les fichiers et dossiers cachés " Décocher " masquer les extentions des fichiers dont le type est connu Décocher " masquer les fichiers protégés du système" clic sur ok pour valider -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ Lance hijackthis et clic sur "do a system scan only" cocher la case au début des lignes suivantes: O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitexas32.exe O4 - HKLM\..\Run: [HELPER] C:\WINDOWS\System32\france.exe -N valider avec [fix checked] -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ Rechercher et supprimer: Dans le cas ou tu utiliserais la fonction Rechercher: Assure toi que dans: Tous les fichiers et tous les dossiers >> Options avancées • Rechercher dans les dossiers systemes <- DOIT ETRE COCHE ! • Rechercher dans les fichiers et les dossiers cachés <- DOIT ETRE COCHE ! • Rechercher dans les sous-dossiers <- DOIT ETRE COCHE ! Supprime en suivant le chemin des fichiers infectés si présent: C:\Windows\System32\france.exe C:\Documents and Settings\\bureau\Click Me.lnk C:\Documents and Settings\\menu demarrer\Click Me.lnk C:\Documents and Settings\\menu demarrer\Uninstall Click Me.lnk -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ Ensuite, tres important: :: Supprimer les fichiers temporaires :: * C:\Documents and Settings on compte\Local Settings\Temp * C:\Documents and Settings ous les autres comptes\Local Settings\Temp * C:\Temp * C:\Windows\Temp vider tout le contenu des dossiers en gras. * Ne pas oublier de vider la corbeille ! -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ Lance lqfix en double cliquant sur lqfix.bat -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ Redemarre normalement et reposte un log hijack pour vérifier l'évolution et dis moi ou en sont tes problemes Pour les pubs, vérifie que le service affichage des messages soit bien désactivé: demarrer > ts les programmes > accessoires > outils d'administration > services double clic sur affichage des messages clic sur arreter et dans demarrage, selectionne désactivé valide

Anthox · Answer

ok alor voici le resultat REGEDIT4; RegSrch.vbs © Bill James; Registry search results for string "msdirectx" 02/01/2003 04:03:36; NOTE: This file will be deleted when you close WordPad.; You must manually save this file to a new location if you want to refer to it again later.; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDIRECTX][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MSDIRECTX][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDIRECTX]j'ai remarquer aussi que wincmd.exe est revenu et semble infecter mon ordinateur comment l 'eradiquer ??

Anthox · Answer

et voici le resultat de startdreck : StartDreck (build 2.1.7 public stable) - 2003-01-02 @ 00:06:36 (GMT +01:00) Platform: Windows XP (Win NT 5.1.2600 Service Pack 1) Internet Explorer: 6.0.2800.1106 Logged in as at ANTHO »Registry »Run Keys »Current User »Run *msnmsgr="C:\Program Files\MSN Messenger\msnmsgr.exe" /background »RunOnce »Default User »Run *Compaq Service Drivers=wincmd.exe »RunOnce »Local Machine »Run *MSConfig=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto »RunOnce »RunServices »RunServicesOnce »RunOnceEx »RunServicesOnceEx »Browser Helper Objects (LM) »Internet Explorer »Current User *Default_Page_URL=http://www.neuf.fr *Local Page=C:\WINDOWS\System32\blank.htm *Search Page=http://home.microsoft.com/access/allinone.asp *Start Page=http://www.neuf.fr +SearchUrl *provider= *=http://home.microsoft.com/access/autosearch.asp?p=%s »Default User »Local Machine *Default_Page_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome *Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Local Page=%SystemRoot%\system32\blank.htm *Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Start Page=http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home *CustomizeSearch=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm *SearchAssistant=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm »ShellServiceObjectDelayLoad (LM) *PostBootReminder={7849596a-48ea-486e-8937-a2a3009f31a9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *CDBurn={fbeb8a05-beee-4442-804e-409d6c4515e9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *WebCheck={E6FB5E20-DE35-11CF-9C87-00AA005127ED} `InprocServer32=%SystemRoot%\System32\webcheck.dll *SysTray={35CEC8A3-2BE6-11D2-8773-92E220524153} `InprocServer32=C:\WINDOWS\System32\stobject.dll »Files »Autostart Folders »Current User *C:\Documents and Settings\Tony\Menu Démarrer\Programmes\Démarrage\desktop.ini »Default User *C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\desktop.ini »Local Machine *C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini »System/Drivers »Running Processes +0= +4= +440=\SystemRoot\System32\smss.exe +656= +680=\??\C:\windows\system32\winlogon.exe +728=C:\windows\system32\services.exe +888=C:\windows\system32\svchost.exe +1028=C:\windows\System32\svchost.exe +1244= +1316= +1652=C:\windows\Explorer.EXE +1736=C:\windows\System32 askmgr.exe +1976=C:\Program Files\MSN Messenger\msnmsgr.exe +1004=C:\Program Files\Mozilla Firefox\firefox.exe +1100=C:\Documents and Settings\Tony\Bureau\dd.exe +120=C:\Documents and Settings\Tony\Bureau\startdreck217\StartDreck.exe »Application specific

moe31 · Answer

salut anthoxreposte un hijacka+

Anthox · Answer

bon j'ai reformaté mon ordii il y a encore des gros bugs j abandonne dans le log hijack il n'y plus rien tout est effacer ...

nonokao · Answer

sur une machine d'un de mes clients j'ai donc u ce vilain virus qui empêche d'ouvrir msconfig, taskmgr et regedit ... et qui posait bien d'autres soucis, pour l'enlever voici ce que j'ai fais :redémarrer en mode sans echec,avec hijickthis : fixer les "[FireFox Service Drivers] ... ssmss.exe" (j'en avais 4)rebooté cé reparti !si ça vous za aidé, dites merci au client ka payé la facture pour le temps ke g passé à lui trouvé son problem :)et merci à tous les forums (et forumeurs) pour le partage de vos experiences, par recoupement on fini toujours pas trouvé une piste :D

balltrap34 · Answer

lolont vas te demander un pourcentage

regis59 · Answer

Je prends 30%lol

balltrap34 · Answer

lol t est gormand et moi il vas rien me rester

regis59 · Answer

lol 1er servi = plus grosse part lolJe te payerais  le resto ou un nouveau camion lol

antho · Answer

salut a tous ;) dsl de ne pas avoir pu revenir avant sur le forum : j'ai formaté mon ordinateur a plusieurs reprises mais de nombreux bugs subsistent !!! voici un log hijack :Logfile of HijackThis v1.99.1Scan saved at 18:09:40, on 21/06/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\WinRAR\WinRAR.exeC:\Program Files\Emjysoft\Easy Clean\esayclean.exeC:\Program Files\Emjysoft\Easy Clean\esayclean.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\Amrouni\Bureau\hijack this.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -trayO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{D5441B8A-5CD6-46E6-88E4-7EE5F4B8CB0A}: NameServer = 80.118.196.40 80.118.192.110O23 - Service: Network DDE Client (NetDDEclnt) - Unknown owner - C:\WINDOWS\System32\winDLL32.exe (file missing)il bug sérieusement et utilise parfois 100% de l' I.C  ( je m y connai pa tro )  il rame a mort et parfois la souris ne répond plus alors que le clavier repond parfaitement !!! l'ordianteur ramen aussi et je suis obligé de le redémarrer souvent !!! merci de m'aider svp !!!

anthox · Answer

de plus je dois redémarrer de nombreuses fois mon ordinateur car à  la premiere tentative l'écran ne s'allume pas puis c'est au tour du clavier de se bloquer jusqu'à celui de la souris qui gèle complètement , il me faut donc environ 15 minutes avant de pouvoir utiliser mon ordinateur ... de plus celui ci bug je me demande si il n'y a pas non plus de problèmes de drivers ou sueement un virus capable de bloquer les programmes ( gestionnaires des taches ..etc ) et les drivers !!!

regis59 · Answer

salut anthox;ton hijack this, tu as supprimer quelque chose toi meme?je dis ca car: pas de R1, 02, 04 (2seulements !);09;016, rassure moi tu en as virer par toi meme et t as pas fait cette betise?--->L utilisation de Shareaza ne facilite pas les choses non plusa+

anthox · Answer

je pense que c'est possible :$ de nouveaux prog se sont ajoutes dans le log hijack dorénavant je n'enleverai rien avant de demander :$ !!! nouvo log :Logfile of HijackThis v1.99.1Scan saved at 00:07:34, on 01/01/2003Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\System32\keyboard.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\Amrouni\Bureau\hijack this.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [MS Auto-IPSec Protection] MSASP32.exeO4 - HKLM\..\RunServices: [MS Auto-IPSec Protection] MSASP32.exeO4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -trayO4 - HKCU\..\Run: [MS Auto-IPSec Protection] MSASP32.exeO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet ZoneO17 - HKLM\System\CCS\Services\Tcpip\..\{D5441B8A-5CD6-46E6-88E4-7EE5F4B8CB0A}: NameServer = 80.118.196.40 80.118.192.110O23 - Service: Keyboard Service System Files (Keyboard Service) - Unknown owner - C:\WINDOWS\System32\keyboard.exeO23 - Service: Network DDE Client (NetDDEclnt) - Unknown owner - C:\WINDOWS\System32\winDLL32.exe (file missing)dois-je reformater mon ordinateur ??

regis59 · Answer

re,tu as du faire marcher shareazza car tu es infecté par un ver !! aieNon formate pas !--->relance hijack thispuis clik sur view a list of back upsrestore tout ce qu il y a dedans--->installe un antiviruset reposte un scan ensuitea+

anthox · Answer

il n'y a plus de backup :$ j'ai du les supprimer en bidouillant un peu partout je dois avouer , y a-t-il une autre façon !!! dsl pour mon incompétence ...

regis59 · Answer

euh a ma connaissance, si pas back up  = perdudsl ! Pourtant on ne cesse de prevenir les utilisateurs de ce programmea+

balltrap34 · Answer

salut relance hijack pour voir cecitu clik sur open misck tools section en suite clik sur backup en haut a droite selectionne ensuite les lignes et clik sur restore

moe31 · Answer

salut balltrapquelques problemes sur ton site, dolly les a eus aussi hier, sur la page d'acceuil et au milieu il y a une lettre " a " avec un lien vers " essai de page virus.htm".Et dans la section virus, quand on veut revenir sur les autres sections, les sous menus sont tous décalés sur la gauche.a+

balltrap34 · Answer

salut moelol les vacances  cest pour juillet deuxiemme quinzainepour mon site le a  c est moi qui l est mis je fait des essai c est pour celaquand au lien j ai pas cela tu parle des sous menu vers recettes et autres

moe31 · Answer

salut balltrapoui, une fois dans la section logiciels de secu, quand on veut revenir sur chasse, gastronomie etc, les sous menus n'apparaissent pas en dessous mais decalé à gauche.en fait, pas de probleme avec mozilla mais seulement avec ie.a+

balltrap34 · Answer

lol cela le fait pas chez moi je vois pas c est pas trop grave je suis entrain de la remanier je finirais plus tard

moe31 · Answer

bah, je chipote lol..tu remanie la section virus ou tout ton site ?

balltrap34 · Answer

page par pageje fait juste quelque modif de codele site est fait avec dreamwiver et le code est un peu b******ej apprend a le faire manuellement mais cela arrive a se melanger dans ma tete je fais trop de choses a la fois lol

Cyberfire · Answer

franchement je vois pa comment un virus peu reaparaitre apres un formatage du disk maitre ! tu a deja essayer de formater l'autre ?sinon ba je sai pas !car il a l'air coriace l'afaire ! bon en tout cas bon courage pour ton problem !j'espert que tu arivera a t fin !tchao !

Anthox · Answer

resalut a tous et merci encore pour votre précieuse aide mais j'ai fini par reformater completement mon ordinateur a l aide d un professionel mais mon lig hijack me semble tt de meme assez bizarre si vous pouviez y jeter un coup d'oeil merci ;) Logfile of HijackThis v1.99.1Scan saved at 23:47:41, on 19/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Shareaza\Shareaza.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\1.tmpC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\Documents and Settings\AMROUNI\Bureau\HijackThis.exeC:\Program Files\Internet Explorer\iexplore.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO1 - Hosts: (null) onlineaccounts2.abbeynational.co.ukO1 - Hosts: 216.138.184.21 www3.aibgbonline.co.ukO1 - Hosts: 216.138.184.21 www.bank.alliance-leicester.co.ukO1 - Hosts: 216.138.184.21 login.iblogin.comO1 - Hosts: 216.138.184.21 ww2.bankofscotlandhalifax-online.co.ukO1 - Hosts: 216.138.184.21 inet.barclays.co.ukO1 - Hosts: 216.138.184.21 iibank.barclays.co.ukO1 - Hosts: 216.138.184.21 iibank.cahoot.comO1 - Hosts: 216.138.184.21 www3.coventrybuildingsociety.co.ukO1 - Hosts: 216.138.184.21 ww.hsbc.co.ukO1 - Hosts: 216.138.184.21 login.ebank.offshore.hsbc.co.jeO1 - Hosts: 216.138.184.21 ww3.online-offshore.lloydstsb.comO1 - Hosts: 216.138.184.21 ww3.online-business.lloydstsb.co.ukO1 - Hosts: 216.138.184.21 ww3.online.lloydstsb.co.ukO1 - Hosts: 216.138.184.21 ww3.online.lloydstsb.co.ukO1 - Hosts: 216.138.184.21 ww3.online-business.lloydstsb.co.ukO1 - Hosts: 216.138.184.21 ob2.nationet.comO1 - Hosts: 216.138.184.21 ww3.onlinebanking.natwestoffshore.comO1 - Hosts: 216.138.184.21 ww1.nwolb.comO1 - Hosts: 216.138.184.21 ww1.onlinebanking.iombank.comO1 - Hosts: 216.138.184.21 ww1.www.rbsdigital.comO1 - Hosts: 216.138.184.21 welcome.smile.co.ukO1 - Hosts: 216.138.184.21 login.365online.comO1 - Hosts: 216.138.184.21 wvw.citizensbankonline.comO1 - Hosts: 216.138.184.21 esecure.regionsnet.comO1 - Hosts: 216.138.184.21 rollb.associatedbank.comO1 - Hosts: 216.138.184.21 upb.unionplanters.comO1 - Hosts: 216.138.184.21 www.onlinebanking.huntington.comO1 - Hosts: 216.138.184.21 inet.southtrustonlinebanking.comO1 - Hosts: 216.138.184.21 logon.personal.wamu.comO1 - Hosts: 216.138.184.21 login.compassweb.comO1 - Hosts: 216.138.184.21 logon.firstmeritib.comO1 - Hosts: 216.138.184.21 login.ccfcuonline.orgO1 - Hosts: 216.138.184.21 ww3.etimebanker.bankofthewest.comO1 - Hosts: 216.138.184.21 ww2.onlinebanking.lasallebank.comO1 - Hosts: 216.138.184.21 wvw.totallyfreebanking.comO1 - Hosts: 216.138.184.21 www.online.wellsfargo.comO1 - Hosts: 216.138.184.21 www.onlinebanking.bankofoklahoma.comO1 - Hosts: 216.138.184.21 accounts4.keybank.comO1 - Hosts: 216.138.184.21 logon.bankone.comO1 - Hosts: 216.138.184.21 www.secure.tdbanknorth.comO1 - Hosts: 216.138.184.21 www.secure.mvnt4.comO1 - Hosts: 216.138.184.21 ww.mynfbonline.comO1 - Hosts: 216.138.184.21 login.forumcuonline.comO1 - Hosts: 216.138.184.21 www.eds.usersonlnet.comO1 - Hosts: 216.138.184.21 www.onlineid.bankofamerica.comO1 - Hosts: 216.138.184.21 wvw.e-gold.comO1 - Hosts: 216.138.184.21 pcbs.peoples.comO1 - Hosts: 216.138.184.21 www.global1.onlinebank.comO1 - Hosts: 216.138.184.21 ww2.mybranch.lafcu.comO1 - Hosts: 216.138.184.21 login.webbanking.comerica.comO1 - Hosts: 216.138.184.21 web.banking.firsttennessee.comO1 - Hosts: 216.138.184.21 logon.members1st.orgO1 - Hosts: 216.138.184.21 www.cib.ibanking-services.comO1 - Hosts: 216.138.184.21 www.miwebbusbank.ebanking-services.comO1 - Hosts: 216.138.184.21 wvw.paypal.comO1 - Hosts: 216.138.184.21 www.signin.ebay.comO1 - Hosts: 216.138.184.21 wvw.etrade.comO1 - Hosts: 216.138.184.21 ww4.fleethomelink.fleet.comO1 - Hosts: 216.138.184.21 ww3.connect.skyfi.comO1 - Hosts: 216.138.184.21 www6.usbank.comO1 - Hosts: 216.138.184.21 www.bvi.bancodevalencia.esO1 - Hosts: 216.138.184.21 extrant.banesto.esO1 - Hosts: 216.138.184.21 banesnt.banesto.esO1 - Hosts: 216.138.184.21 activia.caixagalicia.esO1 - Hosts: 216.138.184.21 www.bancae.caixapenedes.comO1 - Hosts: 216.138.184.21 login.caixasabadell.netO1 - Hosts: 216.138.184.21 oii.cajamadrid.esO1 - Hosts: 216.138.184.21 login.cajamar.esO1 - Hosts: 216.138.184.21 login.ccm.esO1 - Hosts: 216.138.184.21 ww.unicaja.esO1 - Hosts: 216.138.184.21 www5.bancopopular.esO1 - Hosts: 216.138.184.21 ww3.bbvanet.comO1 - Hosts: 216.138.184.21 ww.bayernlb.deO1 - Hosts: 216.138.184.21 ww2.berliner-volksbank.deO1 - Hosts: 216.138.184.21 ww7.homebanking-berlin.deO1 - Hosts: 216.138.184.21 portal09.commerzbanking.deO1 - Hosts: 216.138.184.21 www.meine.deutsche-bank.deO1 - Hosts: 216.138.184.21 ww2.dresdner-privat.deO1 - Hosts: 216.138.184.21 ww.e-banking.helaba.deO1 - Hosts: 216.138.184.21 ww.hsh-nordbank.deO1 - Hosts: 216.138.184.21 www.my.hypovereinsbank.deO1 - Hosts: 216.138.184.21 ww3.homebanking-berlin.deO1 - Hosts: 216.138.184.21 ww3.homebanking-berlin.deO1 - Hosts: 216.138.184.21 www.banking.lbbw.deO1 - Hosts: 216.138.184.21 lrp.sparkasse-banking.deO1 - Hosts: 216.138.184.21 ww3.homebanking-niedersachsen.deO1 - Hosts: 216.138.184.21 www.onlinebanking.norisbank.deO1 - Hosts: 216.138.184.21 www.banking.postbank.deO1 - Hosts: 216.138.184.21 wvw.internetbanking.gad.deO1 - Hosts: 216.138.184.21 ww1.portal.izb.deO1 - Hosts: 216.138.184.21 wvw.kunden-service.lbs.deO1 - Hosts: 216.138.184.21 ibanking.seb.deO1 - Hosts: 216.138.184.21 bw7.sparkasse-banking.deO1 - Hosts: 216.138.184.21 ww2.homebanking-sparkasse.deO1 - Hosts: 216.138.184.21 ww2.vr-networld-ebanking.deO1 - Hosts: 216.138.184.21 ww.bics.frO1 - Hosts: 216.138.184.21 www.co.caixabank.frO1 - Hosts: 216.138.184.21 ww.creditmutuel.frO1 - Hosts: 216.138.184.21 internetbank.intesabci.itO1 - Hosts: 216.138.184.21 ww.extensive.bancalombarda.itO2 - BHO: imGiantObj Class - {00000062-2E5F-4AF7-986E-5B64E0951A96} - C:\WINDOWS\imGiant.dllO2 - BHO: Msxml32DOMDocument Class - {6E28339B-7A2A-47B6-AEB2-46BA53782379} - C:\WINDOWS\System32\dllcache\msxml32.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\1.tmpO4 - HKLM\..\RunServices: [MSN PLUS XP] wspad.exeO4 - HKLM\..\RunServices: [Popup Blocker System8 Monitoring] PopUpBlocker8.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -trayO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: Interface Chat Voila - http://chat10.x-echo.com/version5/Applet/vchatsign.cabO16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/Bridge-c139.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121809215171O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{839C77D9-D33C-456D-9807-D969246A363D}: NameServer = 80.118.196.41 80.118.192.111O23 - Service: Externtelecom - Unknown owner - C:\WINDOWS\extel.exeO23 - Service: Mouse Click Monitor (mousecm) - Unknown owner - C:\WINDOWS\System32\mousecm.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe

balltrap34 · Answer

salutpour etre bizzard tu la ditdesinstal ceci  PopUpBlocker8 imprime ceci pour ne rien oublier et tous fairetous faire dans l ordre imperativement-------------------------tous da bord telecharge ces programmes si tu ne les a pas et met les a jour mais ne les utilise pas encore et verifie que tu as les bonnes version c est imperatif  ad-aware (1)version 1.06 (ici)               http://www.florensac-chasse-trap.com/   section virusvoir demo http://pageperso.aol.fr/balltrap34/adwseflash.zip

Anthox · Answer

re alors mon ordi a de plus en plus de soucis ... il bug énormément voici un nouvo log hijack :Logfile of HijackThis v1.99.1Scan saved at 13:21:59, on 25/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Documents and Settings\Antho\Bureau\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [winnt DNS ident] windowsp.exeO4 - HKLM\..\RunServices: [winnt DNS ident] windowsp.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htmO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO23 - Service: AOL Instant Messanger (AIM) - Unknown owner - C:\WINDOWS\aim.exe

balltrap34 · Answer

tu la fait en sans echec se log refait le en mode normal

Anthox · Answer

re ! alors j'ai installer norton antivirus 2005 qui a trouvé et supprimé 7 " virus " j'ai refait une analyse il ne trouve plus aucun antivirus malgré tout , il reste de nombreux bugs dans l'ordinateur ou bout d'un certain temps l'ordinateur se gele ocmpletement ( gestionnaire des taches bloqué , msn , internet ) nécessité de redémarrer ......

Anthox · Answer

suite : voici le log :Logfile of HijackThis v1.99.1Scan saved at 23:38:29, on 26/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Documents and Settings\Antho\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO16 - DPF: Interface Chat Voila - http://chat9.x-echo.com/version5/Applet/vchatsign.cabO17 - HKLM\System\CS2\Services\Tcpip\..\{00D31049-D1A8-4AF1-83DB-58A9ADD55661}: NameServer = 80.118.192.100 80.118.196.36O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

balltrap34 · Answer

rien dans ton log il est okfait un scan iciScan bit defenderhttp://www.bitdefender.frclik sur scan on line a gauche et suis la procedure

Anthox · Answer

il n'y a aucun virus pourtant c'est incompréhensible !!!!!!!!l'ordinateur gele au bout de 2 minutes je dois le redemarrer tout le tps c'est agaçant ... ;( log bon , pas de virus je voi pa ec ke ca peut etre :(

Anthox · Answer

aidez moi j en peu plu !!! :s

balltrap34 · Answer

je pense a un probleme de' chauffeessai d ouvrir ton pc et met un ventilo de maison devant les composant laisse le refroidir et redemarre et vois si il reste en marche laisse le ventilo en route

Virus ineffacable

94 réponses

Discussions similaires

Newsletters