Hijackthis

Question

Voici mon hijack, mon problème est comme celui des autres, à savoir, fenetres publicitaires intempestives, ma page de demarage internet se modifie tout le temps et apparemment le pc n'enregistre pas les modifications, comme dans ma barre de tache, lorsque je coche sur "masquer les icones inactifs" après 1 ou 2 redémarage cette case n'est plus cochée.Pourriez-vous m'aider?Merci d'avance.Logfile of HijackThis v1.99.1Scan saved at 22:49:48, on 20/05/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\SLEE503.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\WINDOWS\System32\HPHipm11.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\htpatch.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\WINDOWS\System32\hphmon04.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\WINDOWS\system32\MMTray.exeC:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Steganos Secure FileSharing 6\sfs.exeC:\WINDOWS\system32undll32.exec:\progra~1\intern~1\iexplore.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\OPScan.exeC:\PROGRA~1\WinZip\winzip32.exeC:\hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.unpwzznoab.com/j/p6HgISMfpNmoijdpXzOXYumtFSAFgl6kiHMPEM6HTSTdckLEs/5/QCR4hI4LF/.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suxopuceiifycnzuesz.com/j/p6HgISMfqtUuzfdFt9IBVko7OPmEjDqelAGqbkmDg.aspR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO2 - BHO: (no name) - {05FFF3DB-4986-8F7F-63F0-658BB344B0A6} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: CJava Object - {43F7497C-7687-4DEA-A057-F21BD81BC896} - C:\WINDOWS\system32\msjava32.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dllO2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exeO4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exeO4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"O4 - HKLM\..\Run: [MMTray] MMTray.exeO4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startupO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SFS6] "C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /bootingO4 - HKCU\..\Run: [SpyderBar] C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exeO4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -HideO4 - HKCU\..\Run: [PileRule] C:\DOCUME~1\eric\APPLIC~1\FORDME~1\LOCKSVIEW.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1041.dll,InstantAccessO4 - Global Startup: Exif Launcher.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185XXUSO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cabO16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CABO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {54C75FB0-6B8B-4278-BF7B-77036F15A69E} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1041_FR_XP.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {77EF6DBF-3929-4081-AF2E-178D387E211C} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1037_FR_XP.cabO16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} - http://www.alloticket.com/MicroPaiement/kit/WebInstall.dllO16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.carnot-live.com/live/AxisCamControl.cabO16 - DPF: {A1A961DA-2BA6-4032-859E-01AC35357163} (One2One Viewer) - http://www.one2one.com/static/class/one2one.cabO16 - DPF: {ABB08127-7417-11D4-8566-00500448008D} (Chat Class) - http://downloads.winwise.fr/Common/npchatlax.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {CDD8BADE-B4C8-4E97-84B4-1DC9ABAD3EF3} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1038_FR_XP.cabO16 - DPF: {F4653484-F38C-455F-BB15-1175E527754E} (VideoProducer Class) - http://www.jointheorgy.com/static/class/webcam_ie6/webcam2.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEO23 - Service: Miscrosoft Updates Service 4 (MsUpdate4) - Unknown owner - C:\WINDOWS\system32\msupd4.exe (file missing)O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

balltrap34 · Answer

a tu utiliser l uninstal que je t ai mis

sab77 · Answer

j'ai utilisé les 2, avant de vérifier sur site sensible.Au cas où je remet un log, peut-etre que...Logfile of HijackThis v1.99.1Scan saved at 23:46:26, on 20/05/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\SLEE503.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\WINDOWS\System32\HPHipm11.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\htpatch.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\WINDOWS\System32\hphmon04.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\WINDOWS\system32\MMTray.exeC:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Steganos Secure FileSharing 6\sfs.exeC:\WINDOWS\system32undll32.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Internet Explorer\iexplore.exeC:\hijackthis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.free.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO2 - BHO: (no name) - {05FFF3DB-4986-8F7F-63F0-658BB344B0A6} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: CJava Object - {43F7497C-7687-4DEA-A057-F21BD81BC896} - C:\WINDOWS\system32\msjava32.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dllO2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exeO4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exeO4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"O4 - HKLM\..\Run: [MMTray] MMTray.exeO4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startupO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\RunOnce: [MessengerPlusUninstall] C:\WINDOWS\system32\cmd.exe /C "C:\DOCUME~1\eric\LOCALS~1\Temp\MsgPlusUninst.bat"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SFS6] "C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /bootingO4 - HKCU\..\Run: [SpyderBar] C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exeO4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -HideO4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1041.dll,InstantAccessO4 - Global Startup: Exif Launcher.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185XXUSO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cabO16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CABO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {54C75FB0-6B8B-4278-BF7B-77036F15A69E} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1041_FR_XP.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {77EF6DBF-3929-4081-AF2E-178D387E211C} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1037_FR_XP.cabO16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} - http://www.alloticket.com/MicroPaiement/kit/WebInstall.dllO16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.carnot-live.com/live/AxisCamControl.cabO16 - DPF: {A1A961DA-2BA6-4032-859E-01AC35357163} (One2One Viewer) - http://www.one2one.com/static/class/one2one.cabO16 - DPF: {ABB08127-7417-11D4-8566-00500448008D} (Chat Class) - http://downloads.winwise.fr/Common/npchatlax.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO16 - DPF: {CDD8BADE-B4C8-4E97-84B4-1DC9ABAD3EF3} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1038_FR_XP.cabO16 - DPF: {F4653484-F38C-455F-BB15-1175E527754E} (VideoProducer Class) - http://www.jointheorgy.com/static/class/webcam_ie6/webcam2.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEO23 - Service: Miscrosoft Updates Service 4 (MsUpdate4) - Unknown owner - C:\WINDOWS\system32\msupd4.exe (file missing)O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

balltrap34 · Answer

oki je regarde le reste et je revient te dire

sab77 · Answer

alors pour l'instant, ma page de demarrage reste la meme, c'est déjà ça, par contre les pubs, sont toujours là et je n'ai pas réinstallé msn plus 3.

balltrap34 · Answer

salut
imprime ceci pour ne rien oublier et tous faire
tous faire dans l ordre imperativement
-------------------------
tous da bord telecharge ces programmes si tu ne les a pas et met les a jour mais ne les utilise pas encore
adaware (1)
spyboot (2)
(ici) http://www.florensac-chasse-trap.com/ section virus
et aussi ceci
CleanUp312.exe (3)

----------------
desactive ta restauration systeme
pour ça tu fais clic droit sur poste de travail
propriété tu clique sur onglet restauration système
tu coche la case désactiver la restauration et applique
------------

demarre en mode sans echec
mode sans echec pour cela tu tapote la touche f8
des le debut de l allumage du pc sans t arreter
une fenetre vas souvrir tute deplace avec les fleches du clavier sur demarreren mode sans echec
une fois sur le bureau il ni auras pas toutes les couleurs et autres c est normal.si f8 ne marche pas utilise la touche f5
-------------------------

assure toi de ceci
Affiche tous les fichiers et dossiers :
cliquer sur démarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cacher

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décocher masquer les extensions dont le type est connu
Puis fais «Ok» pour valider les changements.

Et appliquer
----------------------
vide tes fichiers temps et tempory internet file sur tous les utilisateur
utilise ceci pour le faire
http://pageperso.aol.fr/Balltrap34/CleanUp312.exe

--------------------
relance hijack coche ces lignes et ensuite clik sur fix
O2 - BHO: (no name) - {05FFF3DB-4986-8F7F-63F0-658BB344B0A6} - (no file)
O2 - BHO: CJava Object - {43F7497C-7687-4DEA-A057-F21BD81BC896} - C:\WINDOWS\system32\msjava32.dll
O2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)
O3 - Toolbar: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)
O4 - HKLM\..\RunOnce: [MessengerPlusUninstall] C:\WINDOWS\system32\cmd.exe /C "C:\DOCUME~1\eric\LOCALS~1\Temp\MsgPlusUninst.bat"
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1041.dll,InstantAccess
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185XXUS
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cab
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cab
O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {54C75FB0-6B8B-4278-BF7B-77036F15A69E} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1041_FR_XP.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {77EF6DBF-3929-4081-AF2E-178D387E211C} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1037_FR_XP.cab
O16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} - http://www.alloticket.com/MicroPaiement/kit/WebInstall.dll
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.carnot-live.com/live/AxisCamControl.cab
O16 - DPF: {A1A961DA-2BA6-4032-859E-01AC35357163} (One2One Viewer) - http://www.one2one.com/static/class/one2one.cab
O16 - DPF: {ABB08127-7417-11D4-8566-00500448008D} (Chat Class) - http://downloads.winwise.fr/Common/npchatlax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {CDD8BADE-B4C8-4E97-84B4-1DC9ABAD3EF3} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1038_FR_XP.cab
O16 - DPF: {F4653484-F38C-455F-BB15-1175E527754E} (VideoProducer Class) - http://www.jointheorgy.com/static/class/webcam_ie6/webcam2.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: Miscrosoft Updates Service 4 (MsUpdate4) - Unknown owner - C:\WINDOWS\system32\msupd4.exe (file missing)

----------------------
recherche et suppr ceci
attention seulement les fichiers
C:\WINDOWS\system32\msjava32.dll
Instant Access
p2esocks_1041.dll
C:\WINDOWS\system32\msupd4.exe

---------------
clik sur Démarrer->exécuter->tape: services.msc

Double-clique: Miscrosoft Updates Service 4 (MsUpdate4)

Règle-le sur "Arrêté" et "Désactivé".
---------------------

passe adaware et vire tous se qu il trouve
----------
passe spy boot et vire tous se qu il trouvent
-------------

tu vide ta poubelle et tu redemarre en mode normal et refait un hijack

et precise ou en sont tes soucis

--

sab77 · Answer

Bonjour déjà,j'ai fait tout ce que tu m'a dit, la ligne 04 - HKLM\..\RunOnce: [MessengerPlusUninstall]n'existait paset je n'ai pas trouvé les fichiers :C:\WINDOWS\system32\msjava32.dllC:\WINDOWS\system32\msup4.exeles pubs sont toujours là en l'occurence : "nuker.com" un anti-spyware et télé 2et le masquage automatique des icones dans ma barre des taches s'enlève quand il le souhaite, par contre ma pade de demarrage internet reste la même.par contre au demarrage j'ai un message d'erreur : "generic host process win 32" a eu un problème et doit fermer, je ne connais pas ce programmeDonc voici mon hijack :Logfile of HijackThis v1.99.1Scan saved at 18:46:59, on 21/05/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\SLEE503.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\htpatch.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\WINDOWS\System32\hphmon04.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\WINDOWS\system32\MMTray.exeC:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Steganos Secure FileSharing 6\sfs.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\System32\HPHipm11.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\hijackthis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.free.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO2 - BHO: (no name) - {05FFF3DB-4986-8F7F-63F0-658BB344B0A6} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dllO2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dllO4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exeO4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exeO4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"O4 - HKLM\..\Run: [MMTray] MMTray.exeO4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startupO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SFS6] "C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /bootingO4 - HKCU\..\Run: [SpyderBar] C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exeO4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -HideO4 - Global Startup: Exif Launcher.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

balltrap34 · Answer

je vois rien dans ton logpour les fichiers c est bon ils sont partisfait une mise a jour windows et redemarre

sab77 · Answer

donc j'ai fait une mise a jour windows mais il n'y en avait pas, j'ai redemarer et j'ai toujours les pubs, le masquage automatique des icones s'enlève toujours et le message d'erreur "generic host process for win 32 services" doit fermer.

Que dois-je faire.

Merci.

sab77 · Answer

Pourriez-vous m'aider car je ne comprends toujours pas?Merci.

balltrap34 · Answer

si tu n est pas en resaun essai ceciclik sur Démarrer->exécuter->tape: services.mscDouble-clique: client dnsRègle-le sur "Arrêté" et "Désactivé".

sab77 · Answer

re,donc je viens de faire ce que tu m'as dit et c'est toujours pareil, 2 pages de pub : nuker et télé2.Est-ce que tu as d'autres idées??

balltrap34 · Answer

se que je t ai fait faire au dessus c etait pour cela
generic host process for win 32 services" doit fermer.
cela le fait il toujours
et fait ceci stp
Télécharge ceci SilentRunners.
http://www.silentrunners.org/
Lance-le
Copie/colle-le rapport ici

sab77 · Answer

Voici ce que tu viens de me demander :

"Silent Runners.vbs", revision 36, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"SFS6" = ""C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting" [null data]
"SpyderBar" = "C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]
"HPHmon04" = "C:\WINDOWS\System32\hphmon04.exe" ["Hewlett-Packard"]
"HPHUPD04" = ""C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"REGSHAVE" = "C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]
"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"URLLSTCK.exe" = "C:\Program Files\Norton Internet Security\UrlLstCk.exe" ["Symantec Corporation"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]
"MMTray" = "MMTray.exe" ["Morgan Multimedia"]
"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4efb-9B51-7695ECA05670}\(Default) = "Yahoo! Companion BHO" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll" ["Yahoo! Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll" [MS]
{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "CNisExtBho Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

balltrap34 · Answer

stp refait le et sans redemarrer refait aussi un hijack surtous ne redemarre pas

sab77 · Answer

D'accord alors voici d'abord Silent Runners:

"Silent Runners.vbs", revision 36, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"SFS6" = ""C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting" [null data]
"SpyderBar" = "C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]
"HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]
"HPHmon04" = "C:\WINDOWS\System32\hphmon04.exe" ["Hewlett-Packard"]
"HPHUPD04" = ""C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]
"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"REGSHAVE" = "C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]
"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"URLLSTCK.exe" = "C:\Program Files\Norton Internet Security\UrlLstCk.exe" ["Symantec Corporation"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]
"MMTray" = "MMTray.exe" ["Morgan Multimedia"]
"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4efb-9B51-7695ECA05670}\(Default) = "Yahoo! Companion BHO" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll" ["Yahoo! Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll" [MS]
{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "CNisExtBho Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Enabled Wallpaper and Active Desktop:
-------------------------------------

Active Desktop is disabled.

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\eric\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Startup items in "eric" & "All Users" startup folders:
------------------------------------------------------

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Exif Launcher" -> shortcut to: "C:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]
"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]

Enabled Scheduled Tasks:
------------------------

"Norton AntiVirus - Analyser mon ordinateur - eric" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXE /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE" ["Symantec Corporation"]
"Symantec Drmc" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\SymDrmc.exe /CUSTOM /SCHEDULE" [null data]
"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"
-> {CLSID}\(Default) = "Web assistant"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]

"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"
-> {CLSID}\(Default) = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]

"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"
-> {CLSID}\(Default) = "MSN"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
-> {CLSID}\(Default) = "Yahoo! Companion"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll" ["Yahoo! Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"
-> {CLSID}\(Default) = "Web assistant"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]

"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"
-> {CLSID}\(Default) = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]

"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"
-> {CLSID}\(Default) = "MSN"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
-> {CLSID}\(Default) = "Yahoo! Companion"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll" ["Yahoo! Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\
"ButtonText" = "AIM"
"Exec" = "C:\Program Files\AIM95\aim.exe" ["America Online, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

GhostStartService, GhostStartService, "C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE" ["Symantec Corporation"]
Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Norton Unerase Protection, NProtectService, "C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Pml Driver HPH11, Pml Driver HPH11, "C:\WINDOWS\System32\HPHipm11.exe" ["HP"]
SAVScan, SAVScan, "C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe" ["Symantec Corporation"]
Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"" ["Symantec Corporation"]
Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"]
Steganos Live Encryption Engine (Version 503) [Service], SLEE_503_SERVICE, "C:\WINDOWS\system32\SLEE503.exe" [null data]
Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]
Symantec Network Proxy, ccProxy, ""C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
SymWMI Service, SymWSC, "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe" ["Symantec Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]

----------
This report excludes default entries except where indicated.
To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
----------

Et maintenant hijack :

Logfile of HijackThis v1.99.1
Scan saved at 23:54:07, on 21/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\SLEE503.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\htpatch.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\MMTray.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Steganos Secure FileSharing 6\sfs.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O2 - BHO: (no name) - {05FFF3DB-4986-8F7F-63F0-658BB344B0A6} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SFS6] "C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting
O4 - HKCU\..\Run: [SpyderBar] C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

Et voilà, le tout sans redemarrer.

Merci d'avance pour tout.

balltrap34 · Answer

telecharge ceci
télécharge ceci et utilise-le

Pocket Kill Box :

(ici) http://www.florensac-chasse-trap.com/ section virus

-Ouvre-le
coche delete and reboot dans action
-Sélectionne le fichier à supprimer,
ou copie colle ceci
c:\windows\system32\qopvbiltfh.exe
clic sur la croix blanche
réponds "oui"

-Vide la corbeille.
redemarre et dit moi ou cela en est

sab77 · Answer

Alors, après avoir fais ce que tu m'as dit, j'ai redemarrer et le message "generic host process for win 32 services a eu un problème et doit fermer" est revenu, les pubs sont toujours là et le masquage des icones inactives dans la barre des taches est de nouveau reparti.

Je suis totalement perdue.

D'autres idées??

Merci.

sab77 · Answer

Bonjour,

Je suis toujours avec les memes problèmes, pubs, etc ...

Par contre les pubs ont diminuées par rapport au depart, il n'y en a plus que 2, nuker et tele2mobile, n'y aurait-il pas des dossiers dans mon pc qui aurait un lien avec ces 2 pubs??

J'ai fait dans rechercher mais rien, je ne sais pas comment autrement??

Merci pour votre aide.

balltrap34 · Answer

bon ont vas encore essayerrelance l2mfix et clik sur loption 2sans redemarrer met moi un rapport silenc runner et un hijack surtout ne redemarre pas et attend que je te dise quoi faire apres ces rapports

sab77 · Answer

J'ai pas tout compris, c'est quoi "l2mfix"?

balltrap34 · Answer

desoler telecharge cecitelecharge cecihttp://www.downloads.subratam.org/l2mfix.exedecompresse le double clik sur l2mfix.bat appuie sur n importe quelle touche et ensuite choisi l option 2sans redemarrer met moi un rapport silenc runner et un hijack surtout ne redemarre pas et attend que je te dise quoi faire apres ces rapports

sab77 · Answer

Bien après avoir fait l2mfix.bat option 2, le pc a redemarrer et ensuite est rester bloqué sur une fenetre avec marqué Rundll, impossible de redemarrer rien ne fonctionnait, alors j'ai redemarrer en mode sans echec, j'ai supprimer l2mfix (qui redemarrait automatiquement à chaque demarage) et je viens de recommencer l2mfix sans le redemarage et voici donc les 2 rapports.Merci."Silent Runners.vbs", revision 36, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"SFS6" = ""C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting" [null data]"SpyderBar" = "C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe" [file not found]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]"HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"HPHmon04" = "C:\WINDOWS\System32\hphmon04.exe" ["Hewlett-Packard"]"HPHUPD04" = ""C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]"REGSHAVE" = "C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"URLLSTCK.exe" = "C:\Program Files\Norton Internet Security\UrlLstCk.exe" ["Symantec Corporation"]"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]"MMTray" = "MMTray.exe" ["Morgan Multimedia"]"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe"  -lang 1033" ["DAEMON'S HOME"]"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start" [null data]"UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]"second" = "C:\WINDOWS\system32\second.bat" [file not found]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll" [MS]{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "CNisExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]Enabled Wallpaper and Active Desktop:-------------------------------------Active Desktop is disabled.HKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\eric\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "eric" & "All Users" startup folders:------------------------------------------------------C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Exif Launcher" -> shortcut to: "C:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur - eric" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXE /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe  /CUSTOM /SCHEDULE" ["Symantec Corporation"]"Symantec Drmc" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\SymDrmc.exe  /CUSTOM /SCHEDULE" [null data]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\"ButtonText" = "AIM""Exec" = "C:\Program Files\AIM95\aim.exe" ["America Online, Inc."]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messenger""MenuText" = "Windows Messenger""Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------GhostStartService, GhostStartService, "C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE" ["Symantec Corporation"]Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"" [MS]Norton Unerase Protection, NProtectService, "C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"]NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]Pml Driver HPH11, Pml Driver HPH11, "C:\WINDOWS\System32\HPHipm11.exe" ["HP"]SAVScan, SAVScan, "C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe" ["Symantec Corporation"]Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"" ["Symantec Corporation"]Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"]Steganos Live Encryption Engine (Version 503) [Service], SLEE_503_SERVICE, "C:\WINDOWS\system32\SLEE503.exe" [null data]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]Symantec Network Proxy, ccProxy, ""C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]SymWMI Service, SymWSC, "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]----------This report excludes default entries except where indicated.To see *everywhere* the script checks and *everything* it finds,launch it from a command prompt or a shortcut with the -all parameter.----------et le hijackthisLogfile of HijackThis v1.99.1Scan saved at 15:42:35, on 22/05/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\SLEE503.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\htpatch.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\WINDOWS\System32\hphmon04.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\WINDOWS\system32\MMTray.exeC:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Steganos Secure FileSharing 6\sfs.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\System32\HPHipm11.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\Program Files\Messenger\msmsgs.exeC:\hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.free.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {05FFF3DB-4986-8F7F-63F0-658BB344B0A6} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dllO2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exeO4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exeO4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"O4 - HKLM\..\Run: [MMTray] MMTray.exeO4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startupO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [second] C:\WINDOWS\system32\second.batO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SFS6] "C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /bootingO4 - HKCU\..\Run: [SpyderBar] C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exeO4 - Global Startup: Exif Launcher.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

balltrap34 · Answer

saluttelecharge ceci et suppr avec c:\windows\system32\qopvbiltfh.exeTélécharge ChaosShredder ici: http://www.safechaos.com/download/cs-fr.exe et supprime les fichiers infectés comme ceci: http://cjoint.com/?fwlF3z7BT0 redemarre et dit moi ou cela en est

sab77 · Answer

Je suis désolée, mais je ne trouve pas le fichier dans c:\windows\system32\qopvbiltfh.exe je ne comprends pas??

balltrap34 · Answer

a l aide du prog tu ne le trouve pas

sab77 · Answer

non pas du tout même avec le programme chaos.

balltrap34 · Answer

lol cela devient bizzard fait cecitélécharge ceci Registry Search Tool http://www.billsway.com/vbspage/ decompresse le et tape qopvbiltfhet copie colle le resultat dans le bloc note et donne le nous

sab77 · Answer

Voici le résultat :REGEDIT4; RegSrch.vbs © Bill James; Registry search results for string "qopvbiltfh" 22/05/2005 17:04:41; NOTE: This file will be deleted when you close WordPad.; You must manually save this file to a new location if you want to refer to it again later.; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\qopvbiltfh][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"qopvbiltfh"="c:\windows\system32\qopvbiltfh.exe -start"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qopvbiltfh][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qopvbiltfh]"UninstallString"="c:\windows\system32\qopvbiltfh.exe -uninstall"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qopvbiltfh]"DisplayName"="qopvbiltfh"[HKEY_USERS\S-1-5-21-1844237615-796845957-839522115-1003\Software\Microsoft\Search Assistant\ACMru\5603]"000"="qopvbiltfh"[HKEY_USERS\S-1-5-21-1844237615-796845957-839522115-1003\Software\Microsoft\Search Assistant\ACMru\5604]"000"="qopvbiltfh"[HKEY_USERS\S-1-5-21-1844237615-796845957-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache]"C:\windows\system32\qopvbiltfh.exe"="qopvbiltfh"

sab77 · Answer

Je viens de faire activescan avec panda en ligne et voici le rapport, qu'en pensez-vous ??En plus du reste.Incident                      Statut                        Analyse                                                                                                                                                                                                                                                         Adware:Adware/SaveNow         No Désinfecté                 Registre Windows                                                                                                                                                                                                                                                Adware:Adware/QuickSearch     No Désinfecté                 C:\Program Files\QuickSearch                                                                                                                                                                                                                                    Adware:Adware/NaviPromo       No Désinfecté                 Registre Windows                                                                                                                                                                                                                                                Virus:Trj/P2E.AG              Désinfecté                    C:\hijackthis\backups\backup-20050521-003127-954.dll                                                                                                                                                                                                            Adware:Adware/Lop             No Désinfecté                 C:\Program Files\Microsoft AntiSpyware\Quarantine\4EA5C831-31FD-4511-96F5-B6FC59\684FA218-9C68-4075-9C42-BE5361                                                                                                                                                 Adware:Adware/Lop             No Désinfecté                 C:\Program Files\Microsoft AntiSpyware\Quarantine\B5C50870-5ED1-4583-A01D-D94F9A\139BEF89-C45F-4C68-A486-A6C4A2                                                                                                                                                 Virus:Trj/Multidropper.PK     Désinfecté                    C:\WINDOWS\iComedyPlanet\setup-cp.2.200-7.exe                                                                                                                                                                                                                   Virus:Trj/P2E.AG              Désinfecté                    C:\WINDOWS\p2esocks_1037.dll                                                                                                                                                                                                                                    Adware:Adware/StickyPops      No Désinfecté                 C:\WINDOWS\p2esocks_1041.dll                                                                                                                                                                                                                                    Virus:Trj/P2e.AD              Désinfecté                    C:\WINDOWS\system32\authclient.exe                                                                                                                                                                                                                              Virus:Trj/P2E.AG              Désinfecté                    C:\WINDOWS\system32\eg_auth_srv_mut06.dll                                                                                                                                                                                                                       Adware:Adware/FunWeb          No Désinfecté                 C:\WINDOWS\system32\f3PSSavr.scr

Utilisateur anonyme · Answer

salut sab77supprime:C:\Program Files\QuickSearch C:\WINDOWS\iComedyPlanet\setup-cp.2.200-7.exe C:\WINDOWS\p2esocks_1037.dll C:\WINDOWS\system32\authclient.exe C:\WINDOWS\system32\eg_auth_srv_mut06.dll C:\WINDOWS\system32\f3PSSavr.scrvide la quarantaine de microsoft antispywareensuite tu supprime ces entrées (que ce qui est en gras) dans le registre:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\qopvbiltfh]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"qopvbiltfh"="c:\windows\system32\qopvbiltfh.exe -start" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qopvbiltfhHKEY_USERS\S-1-5-21-1844237615-796845957-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache "C:\windows\system32\qopvbiltfh.exe"="qopvbiltfh"redemarre le pc et reposte un log de silentrunnera+

balltrap34 · Answer

merci d avoir pris la suite moe j ai du mabsenter et demain boulot

Utilisateur anonyme · Answer

y a pas de quoi°_-

sab77 · Answer

Pour l'instant, je n'ai pas trouvé les fichiers suivants pour les supprimés :C:\WINDOWS\p2esocks_1037.dll C:\WINDOWS\system32\authclient.exe C:\WINDOWS\system32\eg_auth_srv_mut06.densuite je ne sais pas comment vider la quarantaine de microsoft antispyware, et je ne sais pas comment faire pour aller dans le registre enlever ce que tu as mis en gras.Peux-tu me dire, comment faire??

balltrap34 · Answer

pour les voirsAffiche tous les fichiers et dossiers : cliquer sur démarrer/panneau de configuration/option des dossiers/affichageCocher afficher les dossiers cacher Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décocher masquer les extensions dont le type est connuPuis fais «Ok» pour valider les changements.Et appliqueret passer par l explorateur et pas par la fonction rechercher

sab77 · Answer

meme en faisant ça je ne trouve pas ces fichiers.Pourquoi??

balltrap34 · Answer

tu le fait en mode sans echec tu est bien administrateursinon la je pige plusessai avec ceciTélécharge ChaosShredder ici: http://www.safechaos.com/download/cs-fr.exe et supprime les fichiers infectés comme ceci: http://cjoint.com/?fwlF3z7BT0

sab77 · Answer

Désolé, mais je ne les trouve pas en mode sans echec.Par contre lorsque je demarre normalement je n'ai pas de session alors que en mode sans echec j'ai 2 session dont celle administrateur et j'ai essayé sur les 2 mais je ne trouve pas les fichiers?Je ne comprends rien!!

balltrap34 · Answer

la il faut te faire aider par quelqu un qui si connait un peu lol car la ont vas pas y arriver

Utilisateur anonyme · Answer

Peut etre avec Pocket killboxhttp://www.downloads.subratam.org/KillBox.exenote le chemin exact des fichiers infectés dans le bloc noteC:\WINDOWS\p2esocks_1037.dll C:\WINDOWS\system32\authclient.exe C:\WINDOWS\system32\eg_auth_srv_mut06.dpuis lis cecihttp://cjoint.com/data/fwtnoBqAL2.htma+

balltrap34 · Answer

salut moe c est pas la dernieres version de killbox celle la

Utilisateur anonyme · Answer

tu as le lien pour la derniere ?

balltrap34 · Answer

tu la sur mon site je crois    (ici)               http://www.florensac-chasse-trap.com/   section virus

sab77 · Answer

ok, j'ai copier les fichiers et j'ai appuyer sur Killfiles.Maintenant je fais quoi??

balltrap34 · Answer

il ta mis un lien ou tous est expliquer en image!!!!le revoilahttp://cjoint.com/data/fwtnoBqAL2.htm

Utilisateur anonyme · Answer

mercimais je retrouve pas certaines options sur cette version, comme replace on reboot ou d'autres trucs.on dirait une version optimisée pour les vx2.C'est peut etre 2 outils legerements différents pocket killbox(passe partout) et killbox (plus spécialisé vx2) ?a+

sab77 · Answer

Je l'ai fait avec les 2 versions et j'ai redémarrer voici le log de silent runner demandé par Moe31 :"Silent Runners.vbs", revision 36, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"SFS6" = ""C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting" [null data]"SpyderBar" = "C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe" [file not found]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]"HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"HPHmon04" = "C:\WINDOWS\System32\hphmon04.exe" ["Hewlett-Packard"]"HPHUPD04" = ""C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]"REGSHAVE" = "C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"URLLSTCK.exe" = "C:\Program Files\Norton Internet Security\UrlLstCk.exe" ["Symantec Corporation"]"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]"MMTray" = "MMTray.exe" ["Morgan Multimedia"]"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe"  -lang 1033" ["DAEMON'S HOME"]"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start" [null data]"UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]"second" = "C:\WINDOWS\system32\second.bat" [file not found]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll" [MS]{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "CNisExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]Enabled Wallpaper and Active Desktop:-------------------------------------Active Desktop is disabled.HKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\eric\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "eric" & "All Users" startup folders:------------------------------------------------------C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Exif Launcher" -> shortcut to: "C:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur - eric" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXE /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe  /CUSTOM /SCHEDULE" ["Symantec Corporation"]"Symantec Drmc" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\SymDrmc.exe  /CUSTOM /SCHEDULE" [null data]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\"ButtonText" = "AIM""Exec" = "C:\Program Files\AIM95\aim.exe" ["America Online, Inc."]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messenger""MenuText" = "Windows Messenger""Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------GhostStartService, GhostStartService, "C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE" ["Symantec Corporation"]Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"" [MS]Norton Unerase Protection, NProtectService, "C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"]NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]Pml Driver HPH11, Pml Driver HPH11, "C:\WINDOWS\System32\HPHipm11.exe" ["HP"]SAVScan, SAVScan, "C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe" ["Symantec Corporation"]Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"" ["Symantec Corporation"]Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"]Steganos Live Encryption Engine (Version 503) [Service], SLEE_503_SERVICE, "C:\WINDOWS\system32\SLEE503.exe" [null data]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]Symantec Network Proxy, ccProxy, ""C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]SymWMI Service, SymWSC, "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]----------This report excludes default entries except where indicated.To see *everywhere* the script checks and *everything* it finds,launch it from a command prompt or a shortcut with the -all parameter.----------

Utilisateur anonyme · Answer

salutrefais un scan av pour vérifier qu'ils ont bien étés supprimés

sab77 · Answer

Et voici le scan , mais je ne sais pas comment effacer la quarantaine de microsoft anti-spyware.Incident                      Statut                        Analyse                                                                                                                                                                                                                                                         Adware:Adware/SaveNow         No Désinfecté                 Registre Windows                                                                                                                                                                                                                                                Adware:Adware/Lop             No Désinfecté                 C:\Program Files\Microsoft AntiSpyware\Quarantine\4EA5C831-31FD-4511-96F5-B6FC59\684FA218-9C68-4075-9C42-BE5361                                                                                                                                                 Adware:Adware/Lop             No Désinfecté                 C:\Program Files\Microsoft AntiSpyware\Quarantine\B5C50870-5ED1-4583-A01D-D94F9A\139BEF89-C45F-4C68-A486-A6C4A2                                                                                                                                                 Adware:Adware/StickyPops      No Désinfecté                 C:\WINDOWS\p2esocks_1041.dll

sab77 · Answer

Bonsoir Moe31,pourrais-tu voir si mon silent runner et mon scan sont correct.Sinon j'ai toujours 1 ou 2  pubs qui viennent et si tu ne trouves rien de spécial je crois que je vais arreter là et laisser tomber, a moins que tu es une idée de dernière minute.Merci d'avance.

Utilisateur anonyme · Answer

salut sab77remet un silent runner et pour C:\WINDOWS\p2esocks_1041.dll utilise killboxpour la quarantaine de microsoft antispywares dsl, mais je ne l'ai jamais utilisé, donc il va falloir que tu cherche dans les options.a+

Utilisateur anonyme · Answer

salut moepour la quarantaine, il a juste a suivre le chemin et il devrait le trouver non? C:\Program Files\Microsoft AntiSpyware\Quarantine\B5C50870-5ED1-4583-A01D-D94F9A\139BEF89-C45F-4C68-A486-A6C4A2 a+

Utilisateur anonyme · Answer

salut regisoui c'est vrai lolou sinon ouvre microsoft antispyware clic sur Tools > Spyware Scan > Manage Spyware Quarantine à partir de là tu devrais pouvoir supprimer les éléments en quarantainea+

sab77 · Answer

Merci à tous les deux,donc j'ai réussi a effacer le fichier C:\WINDOWS\p2esocks_1041.dll avec Killboxensuite je suis passer par program files et j'ai effacer la quarantaine de microsoft anti-spyware et j'ai ensuite redémarrer donc voici le log se silent runner :"Silent Runners.vbs", revision 36, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"SFS6" = ""C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting" [null data]"SpyderBar" = "C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe" [file not found]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]"HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"HPHmon04" = "C:\WINDOWS\System32\hphmon04.exe" ["Hewlett-Packard"]"HPHUPD04" = ""C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]"REGSHAVE" = "C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"URLLSTCK.exe" = "C:\Program Files\Norton Internet Security\UrlLstCk.exe" ["Symantec Corporation"]"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]"MMTray" = "MMTray.exe" ["Morgan Multimedia"]"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe"  -lang 1033" ["DAEMON'S HOME"]"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start" [null data]"UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll" [MS]{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "CNisExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]Enabled Wallpaper and Active Desktop:-------------------------------------Active Desktop is disabled.HKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\eric\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "eric" & "All Users" startup folders:------------------------------------------------------C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Exif Launcher" -> shortcut to: "C:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur - eric" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXE /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe  /CUSTOM /SCHEDULE" ["Symantec Corporation"]"Symantec Drmc" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\SymDrmc.exe  /CUSTOM /SCHEDULE" [null data]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\"ButtonText" = "AIM""Exec" = "C:\Program Files\AIM95\aim.exe" ["America Online, Inc."]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messenger""MenuText" = "Windows Messenger""Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------GhostStartService, GhostStartService, "C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE" ["Symantec Corporation"]Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"" [MS]Norton Unerase Protection, NProtectService, "C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"]NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]Pml Driver HPH11, Pml Driver HPH11, "C:\WINDOWS\System32\HPHipm11.exe" ["HP"]SAVScan, SAVScan, "C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe" ["Symantec Corporation"]Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"" ["Symantec Corporation"]Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"]Steganos Live Encryption Engine (Version 503) [Service], SLEE_503_SERVICE, "C:\WINDOWS\system32\SLEE503.exe" [null data]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]Symantec Network Proxy, ccProxy, ""C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]SymWMI Service, SymWSC, "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]----------This report excludes default entries except where indicated.To see *everywhere* the script checks and *everything* it finds,launch it from a command prompt or a shortcut with the -all parameter.----------

Utilisateur anonyme · Answer

ouvre le bloc note et fais un copier coller de ce qui est en gras ci-dessous:REGEDIT4[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\qopvbiltfh] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "qopvbiltfh"=-[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qopvbiltfh] Puis enregistrer sous et dans: Nom du fichier, met fix.reg Type de fichier: selectionne "tous les fichiers" clic sur enregistrer ensuite double clic sur fix.reg et accepte de fusionner1- Ferme tout les progs en cours2- Double-clic sur KillBox.exe3- Selectionne "Delete on Reboot"4- Copie  C:\windows\system32\qopvbiltfh.exe  et colle dans "Full Path of File to Delete"5- selectionne "End explorer shell while killing file"6- clic sur la croix rouge7- une fenetre va apparaitre pour confirmation clic sur YES8- une seconde fenetre te demande si tu veux redemarrer clic sur Yeslaisse le pc redemarrer et reposte un silentrunnersa+

sab77 · Answer

Re, Moe31la première partie que tu m'a demandé de faire c'est OKpar contre pour Killbox lorsque j'ai appuyé 2 fois sur yes et après quelques secondes une fenetre apparait avec une croix rouge et me dit "PendingFileRenameOperations Registry Data has been Removed by External Process"Qu'est ce que c'est ??

Utilisateur anonyme · Answer

pas grave, le pc à redemarré ?ou tu l'a redemarrer manuellement ?

Utilisateur anonyme · Answer

remet un silentrunners et dis moi ou en sont tes problemes

sab77 · Answer

non j'ai du le redémarrer en manueldonc si c'est pas grave voilà silent runner :"Silent Runners.vbs", revision 36, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"SFS6" = ""C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting" [null data]"SpyderBar" = "C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe" [file not found]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]"HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"HPHmon04" = "C:\WINDOWS\System32\hphmon04.exe" ["Hewlett-Packard"]"HPHUPD04" = ""C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]"REGSHAVE" = "C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"URLLSTCK.exe" = "C:\Program Files\Norton Internet Security\UrlLstCk.exe" ["Symantec Corporation"]"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]"MMTray" = "MMTray.exe" ["Morgan Multimedia"]"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe"  -lang 1033" ["DAEMON'S HOME"]"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]"UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start" [null data]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll" [MS]{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "CNisExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]Enabled Wallpaper and Active Desktop:-------------------------------------Active Desktop is disabled.HKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\eric\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "eric" & "All Users" startup folders:------------------------------------------------------C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Exif Launcher" -> shortcut to: "C:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur - eric" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXE /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe  /CUSTOM /SCHEDULE" ["Symantec Corporation"]"Symantec Drmc" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\SymDrmc.exe  /CUSTOM /SCHEDULE" [null data]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\"ButtonText" = "AIM""Exec" = "C:\Program Files\AIM95\aim.exe" ["America Online, Inc."]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messenger""MenuText" = "Windows Messenger""Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------GhostStartService, GhostStartService, "C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE" ["Symantec Corporation"]Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"" [MS]Norton Unerase Protection, NProtectService, "C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"]NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]Pml Driver HPH11, Pml Driver HPH11, "C:\WINDOWS\System32\HPHipm11.exe" ["HP"]SAVScan, SAVScan, "C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe" ["Symantec Corporation"]Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"" ["Symantec Corporation"]Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"]Steganos Live Encryption Engine (Version 503) [Service], SLEE_503_SERVICE, "C:\WINDOWS\system32\SLEE503.exe" [null data]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]Symantec Network Proxy, ccProxy, ""C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]SymWMI Service, SymWSC, "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]----------This report excludes default entries except where indicated.To see *everywhere* the script checks and *everything* it finds,launch it from a command prompt or a shortcut with the -all parameter.----------

Utilisateur anonyme · Answer

toujours là"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start"je crois que c'est ca le responsable, mais je dois arreter pour ce soir.essaye de faire un maximum de scans av en ligne en attendant (pas que chez panda)Quelques AV en lignes:http://www.ravantivirus.comhttp://housecall.trendmicro.comhttp://www.bitdefender.com/scan/licence.phpje repasse demain soir.à demain

sab77 · Answer

Ok merci, Moe31, a demain.

Utilisateur anonyme · Answer

salut sabTu as pu faire un scan av ?lance hijackthis et clic sur "open the misc tools section"clic sur open uninstall manager et clic sur save listfais un copier collé du résultatrelance hijackthis et clic sur "open the misc tools section"coche les 2 cases à coté du bouton "generate startuplist log"et clic sur "generate startuplist log"fais un copier collé du résultat a+

sab77 · Answer

Bonjour Moe,j'ai fait différent scan et rien de spécial a part 2 fichiers sous D: infecté par un trojan win 32, mais je ne pensais pas que des trojan pouvait se mettre sous D.Sinon, j'ai fait un editeur de registre et rechercher le fichier qopvbiltfh et il apparait plusieurs fois et dans les données il apparait les 2 pubs que j'ai sans arret, ainsi que msn plus (que j'ai déjà desinstaller et effacer), enfin vu que je ne peux pas faire de copier coller je ne sais pas trop comment te le montrer.Voici le premier doc de hijackthis :            AC3Filter (remove only)Ad-Aware SE PersonalAdobe Photoshop Album 2.0 Edition DécouverteAdobe Reader 7.0 - FrançaisAhead NeroVision ExpressAIMArchiveur WinRARArcSoft VideoImpression 1.6FPa-squared Free 1.6AVIcodec (remove only)Barre d'outils MSNCameraWareCC_ccProxyMSICC_ccStartccCommonCleanUp!C-Media 3D AudioCorrectif Windows XP - KB834707Correctif Windows XP - KB867282Correctif Windows XP - KB873333Correctif Windows XP - KB873339Correctif Windows XP - KB885250Correctif Windows XP - KB885835Correctif Windows XP - KB885836Correctif Windows XP - KB885884Correctif Windows XP - KB886185Correctif Windows XP - KB887472Correctif Windows XP - KB887742Correctif Windows XP - KB888113Correctif Windows XP - KB888302Correctif Windows XP - KB890047Correctif Windows XP - KB890175Correctif Windows XP - KB890859Correctif Windows XP - KB890923Correctif Windows XP - KB891781Correctif Windows XP - KB893066Correctif Windows XP - KB893086CueClubDiViDiX Génération Codecs Full V1.7 FinalDivX CodecDivX PlayerDJMixStation 2 feat. Virtual DJeMule Plus 1.1dffdshow (remove only)FinePixViewer Ver.3.0Free - Kit de connexionFUJIFILM USB DriverHijackThis 1.99.1HP Photo and Imaging 1.0 - HP Photosmart Printer SeriesImageMixerKazaa Lite K++ v2.4.2Kazoo PlayerKyodaiLanguage Pack for Ad-aware 6Language pack for Ad-Aware SELecteur Windows Media 10LiveReg (Symantec Corporation)LiveUpdate 2.5 (Symantec Corporation)Microsoft .NET Framework 1.1Microsoft .NET Framework 1.1Microsoft .NET Framework 1.1 Hotfix (KB886903)Microsoft AntiSpywareMicrosoft Data Access Components KB870669Microsoft Office XP Professional avec FrontPageMorgan M-JPEG codec V3MS Access 97 SP2MSN Messenger 7.0MSRedistNero 6 Ultra EditionNorton AntiSpamNorton AntiSpamNorton AntiVirusNorton AntiVirus Parent MSINorton CleanSweepNorton GhostNorton Internet SecurityNorton Internet SecurityNorton Internet SecurityNorton Internet SecurityNorton Internet SecurityNorton Internet SecurityNorton Internet SecurityNorton Internet SecurityNorton Internet Security (Symantec Corporation)Norton Password ManagerNorton SystemWorks 2004 ProfessionalNorton SystemWorks 2004 Professional (Symantec Corporation)Norton UtilitiesNorton WMI UpdateNVIDIA DriversPhotosmart 130,230,7150,7345,7350,7550 (Supprimer uniquement)PowerDVDQuickTimeQVGDM Seconde EditionScrabble® 2003 EditionSereneScreen Marine Aquarium TimeSimCity 3000 World EditionSiS 900 PCI Fast Ethernet Adapter DriverSpybot - Search & Destroy 1.3Steganos Secure FileSharing 6.0.2Symantec Script Blocking InstallerUltimate Messenger Lock 1.0Viewpoint Media PlayerWinamp (remove only)Windows Installer 3.1 (KB893803)Windows Installer 3.1 (KB893803)Windows Media Format RuntimeWindows XP Service Pack 2WinZipXviD MPEG-4 Codecet voici le deuxième :StartupList report, 24/05/2005, 22:03:02StartupList version: 1.52.2Started from : C:\hijackthis\HijackThis.EXEDetected: Windows XP SP2 (WinNT 5.01.2600)Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)* Using default options* Including empty and uninteresting sections* Showing rarely important sections==================================================Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXEC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\SLEE503.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\htpatch.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\WINDOWS\System32\hphmon04.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\WINDOWS\system32\MMTray.exeC:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Steganos Secure FileSharing 6\sfs.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\WINDOWS\System32\HPHipm11.exeC:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Messenger\msmsgs.exeC:\hijackthis\HijackThis.exe--------------------------------------------------Listing of startup folders:Shell folders Startup:[C:\Documents and Settings\eric\Menu Démarrer\Programmes\Démarrage]*No files*Shell folders AltStartup:*Folder not found*User shell folders Startup:*Folder not found*User shell folders AltStartup:*Folder not found*Shell folders Common Startup:[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]Exif Launcher.lnk = ?Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeMicrosoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEShell folders Common AltStartup:*Folder not found*User shell folders Common Startup:*Folder not found*User shell folders Alternate Common Startup:*Folder not found*--------------------------------------------------Checking Windows NT UserInit:[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINDOWS\system32\userinit.exe,[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]*Registry value not found*[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\Run*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No values found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\Runctfmon.exe = C:\WINDOWS\system32\ctfmon.exeSFS6 = "C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /bootingSpyderBar = C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No values found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows NT\CurrentVersion\RunMMTray = MMTray.exe--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\Run[OptionalComponents]*No values found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\Run*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce*Registry key not found*--------------------------------------------------Autorun entries in Registry subkeys of:HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run*No subkeys found*--------------------------------------------------Autorun entries in Registry subkeys of:HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run*Registry key not found*--------------------------------------------------File association entry for .EXE:HKEY_CLASSES_ROOT\exefile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .COM:HKEY_CLASSES_ROOT\comfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .BAT:HKEY_CLASSES_ROOT\batfile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .PIF:HKEY_CLASSES_ROOT\piffile\shell\open\command(Default) = "%1" %*--------------------------------------------------File association entry for .SCR:HKEY_CLASSES_ROOT\scrfile\shell\open\command(Default) = "%1" /S--------------------------------------------------File association entry for .HTA:HKEY_CLASSES_ROOT\htafile\shell\open\command(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*--------------------------------------------------File association entry for .TXT:HKEY_CLASSES_ROOT	xtfile\shell\open\command(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1--------------------------------------------------Enumerating Active Setup stub paths:HKLM\Software\Microsoft\Active Setup\Installed Components(* = disabled by HKCU twin)[>{161C1725-D892-484A-9F8E-41B7C73BAA5F}] *StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP[>{26923b43-4d38-484f-9b9e-de460746276c}] *StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *StubPath = %SystemRoot%\system32egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32	hemeui.dll[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub[{7790769C-0471-11d2-AF11-00C04FA35D02}] *StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install[{89820200-ECBD-11cf-8B85-00AA005B4340}] *StubPath = regsvr32.exe /s /n /i:U shell32.dll[{89820200-ECBD-11cf-8B85-00AA005B4383}] *StubPath = %SystemRoot%\System32\ie4uinit.exe[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *StubPath = %SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl--------------------------------------------------Enumerating ICQ Agent Autostart apps:HKCU\Software\Mirabilis\ICQ\Agent\Apps*Registry key not found*--------------------------------------------------Load/Run keys from C:\WINDOWS\WIN.INI:load=*INI section not found*run=*INI section not found*Load/Run keys from Registry:HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\Windows: load=HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=--------------------------------------------------Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found*Shell & screensaver key from Registry:Shell=Explorer.exeSCRNSAVE.EXE=C:\WINDOWS\System32\logon.scrdrivers=*Registry value not found*Policies Shell key:HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found*--------------------------------------------------Checking for EXPLORER.EXE instances:C:\WINDOWS\Explorer.exe: PRESENT!C:\Explorer.exe: not presentC:\WINDOWS\Explorer\Explorer.exe: not presentC:\WINDOWS\System\Explorer.exe: not presentC:\WINDOWS\System32\Explorer.exe: not presentC:\WINDOWS\Command\Explorer.exe: not presentC:\WINDOWS\Fonts\Explorer.exe: not present--------------------------------------------------Checking for superhidden extensions:.lnk: HIDDEN! (arrow overlay: yes).pif: HIDDEN! (arrow overlay: yes).exe: not hidden.com: not hidden.bat: not hidden.hta: not hidden.scr: not hidden.shs: HIDDEN!.shb: HIDDEN!.vbs: not hidden.vbe: not hidden.wsh: not hidden.scf: HIDDEN! (arrow overlay: NO!).url: HIDDEN! (arrow overlay: yes).js: not hidden.jse: not hidden--------------------------------------------------Verifying REGEDIT.EXE integrity:- Regedit.exe found in C:\WINDOWS- .reg open command is normal (regedit.exe %1)- Regedit.exe has no CompanyName property! It is either missing or named something else.- Regedit.exe has no OriginalFilename property! It is either missing or named something else.- Regedit.exe has no FileDescription property! It is either missing or named something else.Registry check failed!--------------------------------------------------Enumerating Browser Helper Objects:(no name) - (no file) - {05FFF3DB-4986-8F7F-63F0-658BB344B0A6}(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(no name) - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}(no name) - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll - {9394EDE7-C8B5-483E-8773-474BF36AF6E4}(no name) - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll - {9ECB9560-04F9-4bbc-943D-298DDF1699E1}(no name) - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}(no name) - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}(no name) - (no file) - {C333CF63-767F-4831-94AC-E683D962C63C}--------------------------------------------------Enumerating Task Scheduler jobs:Norton AntiVirus - Analyser mon ordinateur - eric.jobNorton AntiVirus - Analyser mon ordinateur.jobNorton SystemWorks One Button Checkup.jobSymantec Drmc.jobSymantec NetDetect.job--------------------------------------------------Enumerating Download Program Files:[ChatSpace Full Java Client 3.1.0.229]CODEBASE = http://surechat.com:9000/Java/cfs31229.cabOSD = C:\WINDOWS\Downloaded Program Files\ChatSpace Full Java Client 3.1.0.229.osd[Microsoft XML Parser for Java]CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cabOSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd[QuickTime Object]InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocxCODEBASE = http://www.apple.com/qtactivex/qtplugin.cab[{33564D57-9980-0010-8000-00AA00389B71}]CODEBASE = http://codecs.microsoft.com/codecs/i386/wmv9dmo.cab[HouseCall Control]InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocxCODEBASE = http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab[AvxScanOnline Control]InProcServer32 = C:\WINDOWS\DOWNLO~1\BITDEF~1.OCXCODEBASE = http://www.bitdefender.com/scan/Msie/bitdefender.cab[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab[ActiveScan Installer Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dllCODEBASE = http://www.pandasoftware.com/activescan/as5/asinst.cab[CRAVOnline Object]InProcServer32 = C:\WINDOWS\Downloaded Program Filesavonline.dllCODEBASE = http://www.ravantivirus.com/scan/ravonline.cab[Shockwave Flash Object]InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocxCODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab--------------------------------------------------Enumerating Winsock LSP files:NameSpace #1: C:\WINDOWS\System32\mswsock.dllNameSpace #2: C:\WINDOWS\System32\winrnr.dllNameSpace #3: C:\WINDOWS\System32\mswsock.dllProtocol #1: C:\WINDOWS\system32\mswsock.dllProtocol #2: C:\WINDOWS\system32\mswsock.dllProtocol #3: C:\WINDOWS\system32\mswsock.dllProtocol #4: C:\WINDOWS\system32svpsp.dllProtocol #5: C:\WINDOWS\system32svpsp.dllProtocol #6: C:\WINDOWS\system32\mswsock.dllProtocol #7: C:\WINDOWS\system32\mswsock.dllProtocol #8: C:\WINDOWS\system32\mswsock.dllProtocol #9: C:\WINDOWS\system32\mswsock.dllProtocol #10: C:\WINDOWS\system32\mswsock.dllProtocol #11: C:\WINDOWS\system32\mswsock.dllProtocol #12: C:\WINDOWS\system32\mswsock.dllProtocol #13: C:\WINDOWS\system32\mswsock.dllProtocol #14: C:\WINDOWS\system32\mswsock.dllProtocol #15: C:\WINDOWS\system32\mswsock.dllProtocol #16: C:\WINDOWS\system32\mswsock.dllProtocol #17: C:\WINDOWS\system32\mswsock.dll--------------------------------------------------Enumerating Windows NT/2000/XP servicesPilote ACPI Microsoft: System32\DRIVERS\ACPI.sys (system)Suppresseur d'écho acoustique (Noyau Microsoft): system32\drivers\aec.sys (manual start)Environnement de prise en charge de réseau AFD: \SystemRoot\System32\drivers\afd.sys (system)Avertissement: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)Service de la passerelle de la couche Application: %SystemRoot%\System32\alg.exe (manual start)Pilote de processeur AMD K7: System32\DRIVERS\amdk7.sys (system)Gestion d'applications: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)Pilote de média asynchrone RAS: System32\DRIVERS\asyncmac.sys (manual start)Contrôleur de disque dur IDE/ESDI standard: System32\DRIVERS\atapi.sys (system)Protocole client ATM ARP: System32\DRIVERS\atmarpc.sys (manual start)Audio Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Pilote audio Stub: System32\DRIVERS\audstub.sys (manual start)Service de transfert intelligent en arrière-plan: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Explorateur d'ordinateur: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Décodeur sous-titre fermé: System32\DRIVERS\CCDECODE.sys (manual start)Symantec Event Manager: "C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe" (autostart)Symantec Network Proxy: "C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe" (autostart)Symantec Password Validation: "C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe" (manual start)Symantec Settings Manager: "C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe" (autostart)Pilote de CD-ROM: System32\DRIVERS\cdrom.sys (system)Service d'indexation: C:\WINDOWS\System32\cisvc.exe (manual start)Gestionnaire de l'Album: %SystemRoot%\system32\clipsrv.exe (disabled)C-Media WDM Audio Interface: system32\drivers\cmuda.sys (manual start)Application système COM+: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)Services de cryptographie: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)d346bus: system32\DRIVERS\d346bus.sys (system)d346prt: System32\Drivers\d346prt.sys (system)Lanceur de processus serveur DCOM: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)Client DHCP: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Pilote de disque: System32\DRIVERS\disk.sys (system)Service d'administration du Gestionnaire de disque logique: %SystemRoot%\System32\dmadmin.exe /com (manual start)dmboot: System32\drivers\dmboot.sys (disabled)Pilote de Gestionnaire de disque logique: System32\drivers\dmio.sys (system)dmload: System32\drivers\dmload.sys (system)Gestionnaire de disque logique: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Synthétiseur DLS du noyau Microsoft: system32\drivers\DMusic.sys (manual start)Client DNS: %SystemRoot%\System32\svchost.exe -k NetworkService (disabled)Dot4 HPH11: System32\DRIVERS\hphid411.sys (manual start)Print Class Driver for IEEE-1284.4 HPH11: System32\DRIVERS\hphipr11.sys (manual start)Storage Class Driver for IEEE-1284.4 (HPH11): System32\Drivers\hphs2k11.sys (manual start)Dot4Usb HPH11: System32\drivers\hphius11.sys (manual start)Filtre de décodeur DRM (Noyau Microsoft): system32\drivers\drmkaud.sys (manual start)Service de rapport d'erreurs: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Journal des événements: %SystemRoot%\system32\services.exe (autostart)Système d'événements de COM+: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)Compatibilité avec le Changement rapide d'utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Carte réseau virtuelle FreeBox USB: system32\DRIVERS\fbxusb32.sys (manual start)Pilote de contrôleur de lecteur de disquettes: System32\DRIVERS\fdc.sys (manual start)FinePix F601 ZOOM: System32\Drivers\V4CB0109.SYS (manual start)Pilote de lecteur de disquettes: System32\DRIVERS\flpydisk.sys (manual start)FltMgr: system32\drivers\fltmgr.sys (system)Pilote du Gestionnaire de volume: System32\DRIVERS\ftdisk.sys (system)Énumérateur de port jeu: System32\DRIVERS\gameenum.sys (manual start)GhostStartService: C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE (autostart)GhostPciScanner: \??\C:\Program Files\Norton SystemWorks\Norton Ghost\ghpciscan.sys (system)Classificateur de paquets générique: System32\DRIVERS\msgpc.sys (manual start)Aide et support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Accès du périphérique d'interface utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)HTTP: System32\Drivers\HTTP.sys (manual start)HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)Pilote pour clavier i8042 et souris sur port PS/2: System32\DRIVERS\i8042prt.sys (system)Imagedrv: System32\DRIVERS\imagedrv.sys (system)Pilote de filtre de gravure CD: System32\DRIVERS\imapi.sys (system)Service COM de gravage de CD IMAPI: C:\WINDOWS\System32\imapi.exe (manual start)Pilote du pare-feu Windows IPv6: system32\drivers\ip6fw.sys (manual start)Pilote de filtre de trafic IP: System32\DRIVERS\ipfltdrv.sys (manual start)Pilote de tunnelage IP dans IP: System32\DRIVERS\ipinip.sys (manual start)Traducteur d'adresses réseau IP: System32\DRIVERS\ipnat.sys (manual start)Pilote IPSEC: System32\DRIVERS\ipsec.sys (system)Service énumérateur IR: System32\DRIVERS\irenum.sys (manual start)Pilote de bus Plug-and-Play ISA/EISA: System32\DRIVERS\isapnp.sys (system)Pilote de la classe Clavier: System32\DRIVERS\kbdclass.sys (system)Mélangeur audio Wave de noyau Microsoft: system32\drivers\kmixer.sys (manual start)Serveur: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Station de travail: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Assistance TCP/IP NetBIOS: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)Machine Debug Manager: "C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe" (autostart)Affichage des messages: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Partage de Bureau à distance NetMeeting: C:\WINDOWS\System32\mnmsrvc.exe (manual start)Pilote de la classe Souris: System32\DRIVERS\mouclass.sys (system)Redirecteur client WebDav: System32\DRIVERS\mrxdav.sys (manual start)MRXSMB: System32\DRIVERS\mrxsmb.sys (system)Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)Proxy de service de répartition Microsoft: system32\drivers\MSKSSRV.sys (manual start)Proxy d'horloge de répartition Microsoft: system32\drivers\MSPCLOCK.sys (manual start)Proxy de gestion de qualité de répartition Microsoft: system32\drivers\MSPQM.sys (manual start)Pilote BIOS de gestion de systèmes Microsoft: System32\DRIVERS\mssmbios.sys (manual start)Convertisseur en T/site-à-site de répartition Microsoft: system32\drivers\MSTEE.sys (manual start)Codec NABTS/FEC VBI: System32\DRIVERS\NABTSFEC.sys (manual start)Service Norton AntiVirus Auto-Protect: "C:\Program Files\Norton SystemWorks\Norton Antivirus
avapsvc.exe" (autostart)NAVENG: \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20050518.008\NAVENG.Sys (manual start)NAVEX15: \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20050518.008\NavEx15.Sys (manual start)Connection TV/vidéo Microsoft: System32\DRIVERS\NdisIP.sys (manual start)Pilote TAPI NDIS d'accès distant: System32\DRIVERS
distapi.sys (manual start)NDIS mode utilisateur E/S Protocole: System32\DRIVERS
disuio.sys (manual start)Pilote réseau étendu NDIS d'accès distant: System32\DRIVERS
diswan.sys (manual start)Interface NetBIOS: System32\DRIVERS
etbios.sys (system)NetBIOS sur TCP/IP: System32\DRIVERS
etbt.sys (system)DDE réseau: %SystemRoot%\system32
etdde.exe (disabled)DSDM DDE réseau: %SystemRoot%\system32
etdde.exe (disabled)Ouverture de session réseau: %SystemRoot%\System32\lsass.exe (manual start)Connexions réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)NLA (Network Location Awareness): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Norton Unerase Protection Driver: \??\C:\WINDOWS\System32\Drivers\NPDRIVER.SYS (manual start)Norton Unerase Protection: C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE (autostart)Fournisseur de la prise en charge de sécurité LM NT: %SystemRoot%\System32\lsass.exe (manual start)Stockage amovible: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)nv: system32\DRIVERS
v4_mini.sys (manual start)NVIDIA Display Driver Service: %SystemRoot%\system32
vsvc32.exe (autostart)Pilote de filtre de trafic IPX: System32\DRIVERS
wlnkflt.sys (manual start)Pilote de transfert de trafic IPX: System32\DRIVERS
wlnkfwd.sys (manual start)Pilote de port parallèle: System32\DRIVERS\parport.sys (manual start)PCI Bus Driver: System32\DRIVERS\pci.sys (system)PCIIde: System32\DRIVERS\pciide.sys (system)JVC Communication PIX-MC10 Driver: System32\Drivers\pixmc10c.sys (manual start)JVC PIX-MC10 Audio Capture: System32\Drivers\pixmc10a.sys (manual start)JVC PIX-MC10 Video Capture: System32\Drivers\pixmc10v.sys (manual start)Plug-and-Play: %SystemRoot%\system32\services.exe (autostart)Pml Driver HPH11: C:\WINDOWS\System32\HPHipm11.exe (manual start)Services IPSEC: %SystemRoot%\System32\lsass.exe (autostart)Miniport réseau étendu (PPTP): System32\DRIVERSaspptp.sys (manual start)Pilote processeur: System32\DRIVERS\processr.sys (system)Emplacement protégé: %SystemRoot%\system32\lsass.exe (autostart)Planificateur de paquets QoS: System32\DRIVERS\psched.sys (manual start)Pilote de liaison parallèle directe: System32\DRIVERS\ptilink.sys (manual start)PxHelp20: System32\DRIVERS\PxHelp20.sys (system)Pilote de connexion automatique d'accès distant: System32\DRIVERSasacd.sys (system)Gestionnaire de connexion automatique d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Miniport réseau étendu (L2TP): System32\DRIVERSasl2tp.sys (manual start)Gestionnaire de connexions d'accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote PPPOE d'accès à distance: System32\DRIVERSaspppoe.sys (manual start)Parallèle direct: System32\DRIVERSaspti.sys (manual start)Rdbss: System32\DRIVERSdbss.sys (system)RDPCDD: System32\DRIVERS\RDPCDD.sys (system)Pilote de redirecteur de périphérique Terminal Server: System32\DRIVERSdpdr.sys (manual start)Gestionnaire de session d'aide sur le Bureau à distance: C:\WINDOWS\system32\sessmgr.exe (manual start)Pilote de filtre de lecture digitale de CD audio: System32\DRIVERSedbook.sys (system)Routage et accès distant: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)Accès à distance au Registre: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)Localisateur d'appels de procédure distante (RPC): %SystemRoot%\System32\locator.exe (manual start)Appel de procédure distante (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)QoS RSVP: %SystemRoot%\System32svp.exe (manual start)Gestionnaire de comptes de sécurité: %SystemRoot%\system32\lsass.exe (autostart)SAVRT: \??\C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVRT.SYS (manual start)SAVRTPEL: \??\C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVRTPEL.SYS (system)SAVScan: C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe (manual start)ScriptBlocking Service: C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart)Carte à puce: %SystemRoot%\System32\SCardSvr.exe (manual start)Planificateur de tâches: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)SDdriver: \??\C:\WINDOWS\System32\Drivers\sddriver.sys (manual start)Secdrv: System32\DRIVERS\secdrv.sys (autostart)Connexion secondaire: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Notification d'événement système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)Pilote de filtre Serenum: System32\DRIVERS\serenum.sys (manual start)Pilote de port série: System32\DRIVERS\serial.sys (system)Pare-feu Windows / Partage de connexion Internet: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Détection matériel noyau: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)SiS AGP Filter: System32\DRIVERS\SISAGPX.sys (system)SiS PCI Fast Ethernet Adapter Driver: System32\DRIVERS\sisnic.sys (manual start)Steganos Live Encryption Engine (Version 503) [Driver]: \??\C:\WINDOWS\system32\drivers\SLEE503.sys (autostart)Steganos Live Encryption Engine (Version 503) [Service]: C:\WINDOWS\system32\SLEE503.exe (autostart)Détrameur décalage BDA: System32\DRIVERS\SLIP.sys (manual start)Symantec Network Drivers Service: "C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe" (autostart)Speed Disk service: C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE (autostart)Splitter audio du noyau Microsoft: system32\drivers\splitter.sys (manual start)Spouleur d'impression: %SystemRoot%\system32\spoolsv.exe (autostart)Pilote de filtre de restauration système: System32\DRIVERS\sr.sys (system)Service de restauration système: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Srv: System32\DRIVERS\srv.sys (manual start)Service de découvertes SSDP: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Acquisition d'image Windows (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (manual start)BDA IPSink: System32\DRIVERS\StreamIP.sys (manual start)Pilote de bus logiciel: System32\DRIVERS\swenum.sys (manual start)Synthétiseur de table de sons GC noyau Microsoft: system32\drivers\swmidi.sys (manual start)MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{E6591932-0E8A-4C4E-8101-9051843AED6D} (manual start)SYMDNS: \SystemRoot\System32\Drivers\SYMDNS.SYS (manual start)SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (manual start)SYMFW: \SystemRoot\System32\Drivers\SYMFW.SYS (manual start)SYMIDS: \SystemRoot\System32\Drivers\SYMIDS.SYS (manual start)SYMIDSCO: \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\idsdefs\20050512.030\symidsco.sys (manual start)SYMNDIS: \SystemRoot\System32\Drivers\SYMNDIS.SYS (manual start)SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)SymWMI Service: C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe (autostart)Périphérique audio système du noyau Microsoft: system32\drivers\sysaudio.sys (manual start)Journaux et alertes de performance: %SystemRoot%\system32\smlogsvc.exe (manual start)Téléphonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Pilote du protocole TCP/IP: System32\DRIVERS	cpip.sys (system)Pilote de périphérique terminal: System32\DRIVERS	ermdd.sys (system)Services Terminal Server: %SystemRoot%\System32\svchost -k DComLaunch (manual start)Thèmes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Telnet: C:\WINDOWS\System32	lntsvr.exe (manual start)Client de suivi de lien distribué: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)Windows User Mode Driver Framework: C:\WINDOWS\System32\wdfmgr.exe (autostart)Pilote de mise à jour microcode: System32\DRIVERS\update.sys (manual start)Hôte de périphérique universel Plug-and-Play: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)Onduleur: %SystemRoot%\System32\ups.exe (manual start)Microsoft USB Generic Parent Driver: System32\DRIVERS\usbccgp.sys (manual start)Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft: System32\DRIVERS\usbehci.sys (manual start)Concentrateur USB2: System32\DRIVERS\usbhub.sys (manual start)Pilote miniport de contrôleur hôte ouvert USB Microsoft: System32\DRIVERS\usbohci.sys (manual start)Pilote de stockage de masse USB: System32\DRIVERS\USBSTOR.SYS (manual start)Carte vidéo VGA.: \SystemRoot\System32\drivers\vga.sys (system)Cliché instantané de volume: %SystemRoot%\System32\vssvc.exe (manual start)Horloge Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Pilote ARP IP d'accès distant: System32\DRIVERS\wanarp.sys (manual start)Pilote WINMM de compatibilité audio WDM Microsoft: system32\drivers\wdmaud.sys (manual start)WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)Infrastructure de gestion Windows: %systemroot%\system32\svchost.exe -k netsvcs (autostart)Service de numéro de série du lecteur multimédia portable: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Extensions du pilote WMI: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)Carte de performance WMI: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)Centre de sécurité: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Codec Teletext standard: System32\DRIVERS\WSTCODEC.SYS (manual start)Mises à jour automatiques: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)Configuration automatique sans fil: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)Service d'approvisionnement réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)--------------------------------------------------Enumerating Windows NT logon/logoff scripts:*No scripts set to run*Windows NT checkdisk command:BootExecute = autocheck autochk *Windows NT 'Wininit.ini':PendingFileRenameOperations: *Registry value not found*--------------------------------------------------Enumerating ShellServiceObjectDelayLoad items:PostBootReminder: C:\WINDOWS\system32\SHELL32.dllCDBurn: C:\WINDOWS\system32\SHELL32.dllWebCheck: C:\WINDOWS\System32\webcheck.dllSysTray: C:\WINDOWS\System32\stobject.dll--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*Registry key not found*--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run*Registry key not found*--------------------------------------------------End of report, 37 762 bytesReport generated in 0,500 secondsCommand line options:   /verbose  - to add additional info on each section   /complete - to include empty sections and unsuspicious data   /full     - to include several rarely-important sections   /force9x  - to include Win9x-only startups even if running on WinNT   /forcent  - to include WinNT-only startups even if running on Win9x   /forceall - to include all Win9x and WinNT startups, regardless of platform   /history  - to list version history onlyVoilà ce que tu m'a demandé, et franchement merci encore à toi et à balltrap pour tout ce que vous faites pour m'aider.

balltrap34 · Answer

salutne fait rien pour l instantpour moe que pense tu de cecij ai vu qu il a un ghost en auto star ce ne serait pas ceci qui nous le remattrait en permanence

Utilisateur anonyme · Answer

possible, j'avais pas fais attention au ghostil faudrait faire quoi, le désactiver le temp de la manip ?ce prog, perso je désinstalleraisDivX Codec 3.11<- celui là est reconnu pour installer des spysUltimate Messenger Lock 1.0 <- je trouve pas grand chose pour celui là tu connais ?

balltrap34 · Answer

ok avec toi pour les deux premier quanr au dernier pas d info defini

Utilisateur anonyme · Answer

bon, alors désactive provisoirement norton ghost, c'est peut etre lui qui le regenere.je te conseille de désinstaller DivX Codec, qui contient probablement des spywaresFais demarrer >> executer et tape regeditdeplace toi sur ces clé à l'aide du signe +supprime seulement les valeurs en gras:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\qopvbiltfh HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Rundans la fenetre de droite supprime: "qopvbiltfh"="c:\windows\system32\qopvbiltfh.exe -start" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qopvbiltfh HKEY_USERS\S-1-5-21-1844237615-796845957-839522115-1003\Software\Microsoft\Search Assistant\ACMru\5603 double clic dans la fenetre de droite sur 000 et supprime qopvbiltfh HKEY_USERS\S-1-5-21-1844237615-796845957-839522115-1003\Software\Microsoft\Search Assistant\ACMru\5604 double clic dans la fenetre de droite sur 000 et supprime qopvbiltfh HKEY_USERS\S-1-5-21-1844237615-796845957-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache dans la fenetre de droite supprime"C:\windows\system32\qopvbiltfh.exe"="qopvbiltfh"ensuite supprime avec killbox C:\windows\system32\qopvbiltfh.exe, je te remet pas la manip, vu que tu l'as déjà faite plusieurs foisune fois redemarré, reposte un silentrunnersest ce que tu connais ce prog: Ultimate Messenger Lock1.0 installé par toi ?

sab77 · Answer

Bonsoir,Je n'arrive pas à désactiver norton ghost, j'ai essayé mais je n'ai rien trouvé.pour le programme divx codec, je l'ai désinstaller et ultimate messenger lock, j'ai été dans ajout/suppression programme et cela ferait parti de a-squared free.Pour ce qui est du registre, toutes les clés qui commence par : HKEY_LOCAL............ je n'en trouve aucuneet celle en HKEY_USERS je les ai supprimer (enfin ce qui est en gras) mais apparement la derniere revient après le redémarrageen ce qui concerne kill box en cherchant par là je ne trouve pas le fichier, mais j'ai quand meme mis le chemin et supprimerdonc voici mon silentrunners :"Silent Runners.vbs", revision 36, http://www.silentrunners.org/Operating System: Windows XP SP2Output limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]"SFS6" = ""C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting" [null data]"SpyderBar" = "C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe" [file not found]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]"SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."]"HPDJ Taskbar Utility" = "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]"HPHmon04" = "C:\WINDOWS\System32\hphmon04.exe" ["Hewlett-Packard"]"HPHUPD04" = ""C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"" ["Hewlett-Packard"]"Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]"REGSHAVE" = "C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]"URLLSTCK.exe" = "C:\Program Files\Norton Internet Security\UrlLstCk.exe" ["Symantec Corporation"]"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"" [MS]"MMTray" = "MMTray.exe" ["Morgan Multimedia"]"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe"  -lang 1033" ["DAEMON'S HOME"]"gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]"UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]"qopvbiltfh" = "c:\windows\system32\qopvbiltfh.exe -start" [null data]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll" [MS]{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "CNisExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "CNavExtBho Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WinZip\WZSHLSTB.DLL" ["WinZip Computing, Inc."]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]Enabled Wallpaper and Active Desktop:-------------------------------------Active Desktop is disabled.HKCU\Control Panel\Desktop\"Wallpaper" = "C:\Documents and Settings\eric\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"Startup items in "eric" & "All Users" startup folders:------------------------------------------------------C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Exif Launcher" -> shortcut to: "C:\Program Files\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur - eric" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\NAVW32.EXE /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton AntiVirus - Analyser mon ordinateur" -> launches: "C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe  /CUSTOM /SCHEDULE" ["Symantec Corporation"]"Symantec Drmc" -> launches: "C:\Program Files\Fichiers communs\Symantec Shared\SymDrmc.exe  /CUSTOM /SCHEDULE" [null data]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"  -> {CLSID}\(Default) = "Web assistant"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}"  -> {CLSID}\(Default) = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll" ["Symantec Corporation"]"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"  -> {CLSID}\(Default) = "MSN"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\"ButtonText" = "AIM""Exec" = "C:\Program Files\AIM95\aim.exe" ["America Online, Inc."]{FB5F1910-F110-11D2-BB9E-00C04F795683}\"ButtonText" = "Messenger""MenuText" = "Windows Messenger""Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]Running Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------GhostStartService, GhostStartService, "C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE" ["Symantec Corporation"]Machine Debug Manager, MDM, ""C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"" [MS]Norton Unerase Protection, NProtectService, "C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"]NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]Pml Driver HPH11, Pml Driver HPH11, "C:\WINDOWS\System32\HPHipm11.exe" ["HP"]SAVScan, SAVScan, "C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe" ["Symantec Corporation"]Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"" ["Symantec Corporation"]Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"]Steganos Live Encryption Engine (Version 503) [Service], SLEE_503_SERVICE, "C:\WINDOWS\system32\SLEE503.exe" [null data]Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]Symantec Network Proxy, ccProxy, ""C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]SymWMI Service, SymWSC, "C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]----------This report excludes default entries except where indicated.To see *everywhere* the script checks and *everything* it finds,launch it from a command prompt or a shortcut with the -all parameter.----------

Utilisateur anonyme · Answer

salut sabca deviens de plus en plus dur pour trouver une solution....telecharge startdreck ici:http://www.niksoft.at/php/dl.php?f=startdreck.zip dezippe le et lance startdreck.exe Clic sur config clic sur unmarck all dans la colonne registry coche: - run keys - browsers helpers object - internet explorer - shellServicesObjectDelayLoad dans la colonne Files coche: - autostart folders dans la colonne System/drivers coche: - running processes Valide ok et clic sur refresh Maintenant, clique sur save pour enregistrer le log. poste le resultat du log.telecharge pfind newhttp://www.bleepingcomputer.com/files/grinler/pfind-new.zipdezippe le et lance pfind.batposte le rapport.a+

sab77 · Answer

salut moe, franchement tu as du courage pour tout ça, merci. voici le log de startdreck : StartDreck (build 2.1.7 public stable) - 2005-05-25 @ 21:39:54 (GMT +02:00) Platform: Windows XP (Win NT 5.1.2600 Service Pack 2) Internet Explorer: 6.0.2900.2180 Logged in as eric at LEMONNIER »Registry »Run Keys »Current User »Run *ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe *SFS6="C:\Program Files\Steganos Secure FileSharing 6\sfs.exe" /booting *SpyderBar=C:\Program Files\TGTSoft\SpyderBar\SpyderBar.exe »RunOnce »Default User »Run *CTFMON.EXE=C:\WINDOWS\System32\CTFMON.EXE *ALUAlert=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe »RunOnce »Local Machine »Run *HTpatch=C:\WINDOWS\htpatch.exe *SiSUSBRG=C:\WINDOWS\SiSUSBrg.exe *HPDJ Taskbar Utility=C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe *HPHmon04=C:\WINDOWS\System32\hphmon04.exe *HPHUPD04="C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe" *Share-to-Web Namespace Daemon=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe *REGSHAVE=C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN *ccApp="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" *URLLSTCK.exe=C:\Program Files\Norton Internet Security\UrlLstCk.exe *NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe *Cmaudio=RunDll32 cmicnfg.cpl,CMICtrlWnd *msnappau="C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe" *MMTray=MMTray.exe *AcctMgr=C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup *QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime *Symantec NetDriver Monitor=C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer *DAEMON Tools-1033="C:\Program Files\D-Tools\daemon.exe" -lang 1033 *gcasServ="C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" *NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup *nwiz=nwiz.exe /install *NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit *UserFaultCheck=%systemroot%\system32\dumprep 0 -u +OptionalComponents +MSFS *Installed=1 +MAPI *Installed=1 *NoChange=1 +MAPI *Installed=1 *NoChange=1 »RunOnce »RunServices »RunServicesOnce »RunOnceEx »RunServicesOnceEx »Browser Helper Objects (LM) *{05FFF3DB-4986-8F7F-63F0-658BB344B0A6} `InprocServer32= *AcroIEHelper.AcroIEHlprObj.1/{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} `InprocServer32=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll *ST/{9394EDE7-C8B5-483E-8773-474BF36AF6E4} `InprocServer32=C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll *Nisbho.CNisExtBho.1/{9ECB9560-04F9-4bbc-943D-298DDF1699E1} `InprocServer32=C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll *MSNToolBandBHO/{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} `InprocServer32=C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll *Navbho.CNavExtBho.1/{BDF3E430-B101-42AD-A544-FADC6B084872} `InprocServer32=C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll *CoTGT_BHO Class/{C333CF63-767F-4831-94AC-E683D962C63C} `InprocServer32= »Internet Explorer »Current User *Local Page=C:\WINDOWS\system32\blank.htm *Search Bar=http://www.free.fr/search/ *Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Start Page=http://home.free.fr/ +SearchUrl *provider= »Default User »Local Machine *Default_Page_URL=http://home.free.fr/ *Default_Search_URL=http://home.microsoft.com/search/search.asp *Local Page=C:\WINDOWS\system32\blank.htm *Search Bar=http://www.free.fr/search/ *Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch *Start Page=http://www.msn.com *CustomizeSearch=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm *SearchAssistant=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm »ShellServiceObjectDelayLoad (LM) *PostBootReminder={7849596a-48ea-486e-8937-a2a3009f31a9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *CDBurn={fbeb8a05-beee-4442-804e-409d6c4515e9} `InprocServer32=%SystemRoot%\system32\SHELL32.dll *WebCheck={E6FB5E20-DE35-11CF-9C87-00AA005127ED} `InprocServer32=%SystemRoot%\System32\webcheck.dll *SysTray={35CEC8A3-2BE6-11D2-8773-92E220524153} `InprocServer32=C:\WINDOWS\System32\stobject.dll »Files »Autostart Folders »Current User *C:\Documents and Settings\eric\Menu Démarrer\Programmes\Démarrage\desktop.ini »Default User *C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\desktop.ini »Local Machine *C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini *C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Exif Launcher.lnk *C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk *C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk »System/Drivers »Running Processes +0= +4= +468=\SystemRoot\System32\smss.exe +684=\??\C:\WINDOWS\system32\csrss.exe +708=\??\C:\WINDOWS\system32\winlogon.exe +760=C:\WINDOWS\system32\services.exe +772=C:\WINDOWS\system32\lsass.exe +928=C:\WINDOWS\system32\svchost.exe +988=C:\WINDOWS\system32\svchost.exe +1132=C:\WINDOWS\System32\svchost.exe +1356=C:\WINDOWS\System32\svchost.exe +1480=C:\WINDOWS\Explorer.EXE +1648=C:\WINDOWS\system32\spoolsv.exe +1752=C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe +1772=C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe +1812=C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE +1836=C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe +1880=C:\Program Files\Norton SystemWorks\Norton Antivirus avapsvc.exe +1920=C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE +1940=C:\WINDOWS\system32 vsvc32.exe +156=C:\WINDOWS\system32\SLEE503.exe +208=C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe +312=C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE +412=C:\WINDOWS\System32\wdfmgr.exe +528=C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe +616=C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe +1372=C:\WINDOWS\htpatch.exe +1544=C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe +1556=C:\WINDOWS\System32\hphmon04.exe +1572=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe +1592=C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe +1964=C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe +2028=C:\WINDOWS\system32\MMTray.exe +2040=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe +2068=C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe +2088=C:\Program Files\QuickTime\qttask.exe +2144=C:\Program Files\D-Tools\daemon.exe +2176=C:\Program Files\Microsoft AntiSpyware\gcasServ.exe +2312=C:\WINDOWS\system32\RUNDLL32.EXE +2352=C:\WINDOWS\system32\ctfmon.exe +2368=C:\Program Files\Steganos Secure FileSharing 6\sfs.exe +2768=C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe +3632=C:\WINDOWS\System32\HPHipm11.exe +3828=C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe +2248=C:\Program Files\FinePixViewer\QuickDCF.exe +736=C:\WINDOWS\System32\alg.exe +3768=C:\Program Files\Internet Explorer\iexplore.exe +3716=C:\Program Files\Messenger\msmsgs.exe +1048=C:\Documents and Settings\eric\Mes documents\Mes fichiers reçus\StartDreck.exe »Application specific et voici celui de pfind-new : Files found with this application may be legitimate. Only remove files that you know are malware related. Checking the C: folder Checking the C:\Program Files folder Checking the C:\WINDOWS folder C:\WINDOWS\ccGetMgr.exe: UPX! C:\WINDOWS\daemon.dll: UPX! C:\WINDOWS sc.exe: UPX! C:\WINDOWS\vsapi32.dll: UPX!t4 C:\WINDOWS\WMCRRS.exe: UPX! Checking the C:\WINDOWS\SYSTEM32 folder C:\WINDOWS\SYSTEM32\msclock32.dll: UPX! C:\WINDOWS\SYSTEM32\msplock32.dll: UPX! C:\WINDOWS\SYSTEM32 tdll.dll: .aspack Checking all directories under the C:\WINDOWS\SYSTEM32\drivers folder Checking the C:\Documents and Settings\All Users\Start Menu\programs\Startup\ folder Checking the C:\Documents and Settings\All Users\Application Data folder Checking the C:\Documents and Settings\eric\Start Menu\programs\Startup\ folder Checking the C:\Documents and Settings\eric\Application Data folder Checking the Windows folder for system and hidden files within the last 60 days C:\WINDOWS\ bootstat.dat Wed 25 May 2005 7:48:54 A.S.. 2 048 2,00 K C:\WINDOWS\HELP\ update.gid Fri 22 Apr 2005 14:29:34 A..H. 10 820 10,57 K C:\WINDOWS\TASKS\ sa.dat Wed 25 May 2005 7:48:56 A..H. 6 0,00 K C:\WINDOWS\SYSTEM32\CONFIG\ default.log Wed 25 May 2005 20:57:40 A..H. 1 024 1,00 K sam.log Wed 25 May 2005 7:48:56 A..H. 1 024 1,00 K security.log Wed 25 May 2005 7:49:46 A..H. 1 024 1,00 K software.log Wed 25 May 2005 21:48:36 A..H. 1 024 1,00 K system.log Wed 25 May 2005 21:48:44 A..H. 1 024 1,00 K C:\WINDOWS\SYSTEM32\CATROOT\{F750E~1\ kb8938~2.cat Wed 4 May 2005 14:45:46 ..S.. 29 493 28,80 K oem3.cat Wed 6 Apr 2005 16:11:04 ..S.. 21 255 20,75 K C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\ ntuser~1.log Wed 11 May 2005 7:45:14 A..H. 1 024 1,00 K C:\WINDOWS\SYSTEM32\REINST~1\0005\DRIVER~1\ nv4_disp.cat Wed 6 Apr 2005 16:11:04 A.S.. 21 255 20,75 K C:\WINDOWS\SYSTEM32\MICROS~1\PROTECT\S-1-5-18\USER\ 88f1f1~1 Wed 20 Apr 2005 13:49:06 A.SH. 388 0,38 K prefer~1 Wed 20 Apr 2005 13:49:06 A.SH. 24 0,02 K 14 items found: 14 files, 0 directories. Total of file sizes: 91 433 bytes 89,29 K

Utilisateur anonyme · Answer

salut sabApparement le scan du dernier prog, montre 2 fichiers du spy NaviPromo.cPour le 2 autres il fraudrait un peu plus renseignementsest ce que tu peux faire analyser ces fichiers ici stpC:\WINDOWS\ccGetMgr.exeC:\WINDOWS\WMCRRS.exehttp://virusscan.jotti.org/a+

Utilisateur anonyme · Answer

il faudra peut etre rendre visible les fichiers cachés et systeme pour les voir.panneau de configuration > options des dossiers > onglet affichage Cocher " afficher les fichiers et dossiers cachés "Décocher " masquer les extentions des fichiers dont le type est connu Décocher " masquer les fichiers protégés du système"clic sur ok pour validera+

sab77 · Answer

Salut Moe,alors, je viens de faire l'analyse des 2 fichiers que tu m'as demandé, par contre je n'ai pas compris de quoi tu me parlais en disant "2 fichiers du spy NaviPromo.c "Service load:  0%        100%   File:  ccGetMgr.exe  Status:  MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.)  MD5  bf6695e3c9dd7f332b009ac37419442c  Packers detected:  UPX Scanner resultsAntiVir  Found nothing Avast  Found nothing AVG Antivirus  Found nothing BitDefender  Found nothing ClamAV  Found nothing Dr.Web  Found nothing F-Prot Antivirus  Found nothing Fortinet  Found nothing Kaspersky Anti-Virus  Found nothing mks_vir  Found nothing NOD32  Found nothing Norman Virus Control  Found nothing VBA32  Found nothing Service load:  0%        100%   File:  WMCRRS.exe  Status:  MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.)  MD5  f21770c8deb94385f04a6d85df003a5f  Packers detected:  UPX Scanner results  AntiVir  Found nothing Avast  Found nothing AVG Antivirus  Found nothing BitDefender  Found nothing ClamAV  Found nothing Dr.Web  Found nothing F-Prot Antivirus  Found nothing Fortinet  Found nothing Kaspersky Anti-Virus  Found nothing mks_vir  Found nothing NOD32  Found nothing Norman Virus Control  Found nothing VBA32  Found nothing Merci, @+.

Utilisateur anonyme · Answer

salut sabapparement le scan de pfind new à trouvé 2 fichiers qui apres recherches, appartiennent au spyware NaviPromo.cmsclock32.dll msplock32.dll1- Ferme tout les progs en cours2- Double-clic sur KillBox.exe3- Selectionne "Delete on Reboot"4- Copie la 1ere ligne de la liste en gras et colle dans "Full Path of File to Delete"5- selectionne "Unregister dll Before deleting"6- clic sur la croix rouge7- une fenetre va apparaitre pour confirmation clic sur YES8- une seconde fenetre te demande si tu veux redemarrer clic sur NORecommence à l'étape 3 pour chaques lignes en gras.une fois le dernier fichier selectionné à l'étape 8 clic sur YES.LISTE:C:\WINDOWS\WMCRRS.exe C:\WINDOWS\SYSTEM32\msclock32.dll C:\WINDOWS\SYSTEM32\msplock32.dllle pc devrait redemarrer, dans le cas contraire redemarre manuellementreposte un log pfind new, et dis moi ou en sont tes problemes a+

sab77 · Answer

Re,alors 2 problèmes :- je ne vois pas où se trouve  : "Unregister dll Before deleting"- et pour les fichiers C:\WINDOWS\SYSTEM32\msclock32.dll C:\WINDOWS\SYSTEM32\msplock32.dll , en fait ils se trouvent tous les 2 dans le chemin suivant :C:\WINDOWS\SYSTEM32\backup.zipet lorsque je clique sur le fichier dans parcourir avec Killbox rien n'apparait dans "Full Path of File to Delete" Que faut-il que je fasse??

Utilisateur anonyme · Answer

salutdsl pour "Unregister dll Before deleting", fausse manip de ma partlaisse tomber killboxqu'est ce qu'il y a d'autre dans le dossier backup.zip ?pour C:\WINDOWS\WMCRRS.exe supprime le manuellementredemarre le pc et passe tes antispywares (spybot, ad-aware) apres les avoir mis à jours (important)et dis moi si tu à encore des pubsa+

Hijackthis

75 réponses

Discussions similaires

Newsletters