comment eliminer winfixerRésolu/Fermé

Question

Bonjour,je tente en vain depuis ce matin d'éliminer winfixer qui ouvre des pop-up intempestives sur mon PC . Mais je n'y arrive toujours pas. Alors je fais appelle à vos connaissances.J'ai suivi les conseils qui se trouvent sur le forum (ad-aware,spybot,a²) et je viens de generer un log hijackthisLogfile of HijackThis v1.99.1Scan saved at 17:23:26, on 17/08/2005Platform: Windows 2000 SP2 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINNT\System32\CTSvcCDA.exeC:\WINNT\System32\svchost.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\system32\stisvc.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\System32\mspmspsv.exeC:\WINNT\System32\ZipToA.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\WINNT\system32undll32.exeC:\WINNT\Explorer.EXEC:\Program Files\Creative\ShareDLL\CtNotify.exeC:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXEC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\WINNT\loadqm.exeC:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\WINNT\system32\internat.exeC:\Program Files\Creative\ShareDLL\MediaDet.ExeC:\hijackthis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: @msdxmLC.dll,-1@1036,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [Détecteur de disque] C:\Program Files\Creative\ShareDLL\CtNotify.exeO4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /tO4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exeO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Microsoft Service] C:\WINNT\system32
twdm.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [LoadQM] loadqm.exeO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKCU\..\Run: [internat.exe] internat.exeO4 - HKCU\..\Run: [Smile Brush] "C:\Program Files\Smile Brush\Smile Brush.exe" aO4 - Global Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dllO9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXEO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXEO20 - Winlogon Notify: MCD - C:\WINNT\system32\wZvemsp.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exeO23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: ZipToA - Iomega Corporation - C:\WINNT\System32\ZipToA.exemerci d'avance pour votre aidecar je ne sais plus quoi faire

Utilisateur anonyme · Answer

salutest ce que tu peux faire analyser ce fichier:C:\WINNT\system32
twdm.exeici:http://www.virustotal.com/xhtml/virustotal_en.htmlou là:http://virusscan.jotti.org/et dis moi s'il trouve quelque chosea+

kido31 · Answer

Salut,voici la réponse de http://www.virustotal.com/xhtml/virustotal_en.html Antivirus Version Update Result AntiVir 6.31.1.0 08.17.2005 no virus found Avast 4.6.695.0 08.17.2005 no virus found AVG 718 08.17.2005 no virus found Avira 6.31.1.0 08.17.2005 no virus found BitDefender 7.0 08.17.2005 no virus found CAT-QuickHeal 7.03 08.17.2005 no virus found ClamAV devel-20050725 08.17.2005 no virus found DrWeb 4.32b 08.17.2005 no virus found eTrust-Iris 7.1.194.0 08.17.2005 no virus found eTrust-Vet 11.9.1.0 08.17.2005 no virus found Fortinet 2.41.0.0 08.17.2005 no virus found F-Prot 3.16c 08.17.2005 no virus found Ikarus 0.2.59.0 08.17.2005 no virus found Kaspersky 4.0.2.24 08.17.2005 no virus found McAfee 4561 08.17.2005 no virus found NOD32v2 1.1195 08.16.2005 no virus found Norman 5.70.10 08.17.2005 no virus found Panda 8.02.00 08.17.2005 no virus found Sophos 3.96.0 08.17.2005 no virus found Sybari 7.5.1314 08.17.2005 no virus found Symantec 8.0 08.17.2005 no virus found TheHacker 5.8.2.090 08.17.2005 no virus found VBA32 3.10.4 08.17.2005 no virus found et la réponse de File:  NTVDM.EXE  Status:  OK  MD5  2d6255c7b94a6fcc901ae1f7c052cea3  Packers detected:  - AntiVir  Found nothing ArcaVir  Found nothing Avast  Found nothing AVG Antivirus  Found nothing BitDefender  Found nothing ClamAV  Found nothing Dr.Web  Found nothing F-Prot Antivirus  Found nothing Fortinet  Found nothing Kaspersky Anti-Virus  Found nothing NOD32  Found nothing Norman Virus Control  Found nothing UNA  Found nothing VBA32  Found nothing ce fichier ne semble pas etre infectéas-tu d'autres idees

Utilisateur anonyme · Answer

c'est pas celui là lolc'estC:\WINNT\system32
twdm.exeavec un w à la place du v

jean38 · Answer

et Moe c'est dans ce post le O20 qui cloche.Lol, je savais bien que c'etait pour toi mais je ne savais plus ou...lol...vive les chameaux, trop de fatigue, je repars.A+

Utilisateur anonyme · Answer

tu as repris le boulot ou il te reste encore du temps pour recupérer ?

jean38 · Answer

tu parles, je reprends Lundi prochain mais je ne sais meme plus l'adresse du bureau alors je crois que je vais reprendre en interim jusqu'à ce qu'il y ai une amelioration... mais je ne sais quand elle va venir.

kido31 · Answer

autant pour moi je n'y vois plus rienpar contre je ne trouve pas de fichier ntwdm.exe dans le répertoire C:\WINNT\system32 ni sur le disque C:\ d'ailleurs

jean38 · Answer

tu as bien affiché les fichiers cachés??si non a faire

kido31 · Answer

oui je l'ai fait

Utilisateur anonyme · Answer

bontelecharge l2mfix ici:http://www.downloads.subratam.org/l2mfix.exeou ici:http://www.atribune.org/downloads/l2mfix.exeDouble clic sur l2mfix.exe pour lancer l'extractionDans le dossier l2mfix, double clic sur l2mfix.bat, appuie sur n'impote quelle touche et choisis l'option #1 (et pas autre chose) et valide avec la touche entrée.Le bloc note va s'ouvrir avec le resultat du scan.Fais un copier coller du résultat ici

kido31 · Answer

voici le résultat du scanL2MFIX find log 1.03cThese are the registry keys present**********************************************************************************Winlogon/notify:Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility]"Asynchronous"=dword:00000000"DllName"="C:\WINNT\system32\wZvemsp.dll""Impersonate"=dword:00000000"Logon"="WinLogon""Logoff"="WinLogoff""Shutdown"="WinShutdown"RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE**********************************************************************************useragent:Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]"{9A6290E1-836D-B060-4E2B-D8197DC6E7CA}"=""**********************************************************************************Shell Extension key:Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia""{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM""{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS""{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile""{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'interpr‚teur de commandes pour le partage""{41E300E0-78B6-11ce-849B-444553540000}"="Extension du Panneau de configuration PlusPack""{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration""{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration""{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration""{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS""{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'interpr‚teur de commandes""{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette""{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'interpr‚teur de commandes pour les objets Microsoft Windows Network""{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM""{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM""{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'interpr‚teur de commandes pour la compression de fichiers""{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension du shell d'imprimante Web""{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI""{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage""{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents""{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext""{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts""{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC""{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes""{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'interpr‚teur de commandes pour le partage""{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension""{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extension de l'interpr‚teur de commande pour Windows Script Host""{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO""{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign""{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau et accŠs … distance""{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler""{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension""{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es""{1A9BA3A0-143A-11CF-8350-444553540000}"="Dossier favori du shell""{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="Poste de travail""{86747AC0-42A0-1069-A2E6-08002B30309D}"="Porte-documents""{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Raccourci vers le dossier""{12518493-00B2-11d2-9FA5-9E3420524153}"="Volume mont‚""{21B22460-3AEA-1069-A2DC-08002B30309D}"="Extension de la page de propri‚t‚s des fichiers""{B091E540-83E3-11CF-A713-0020AFD79762}"="Page des types de fichiers""{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="Gestionnaire des types de fichiers MIME""{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Service Copier vers Microsoft""{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Service D‚placer vers Microsoft""{13709620-C279-11CE-A49E-444553540000}"="Service d'automatisation de l'interface""{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View""{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Menu D‚marrer""{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Service SendTo Microsoft""{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Service Nouvel objet Microsoft""{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Ouvrir avec le gestionnaire de menu contextuel""{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Afficher les extensions HTML du Panneau de configuration""{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop""{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Extension de la page de propri‚t‚s des options des dossiers""{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon""{4657278A-411B-11d2-839A-00C04FD918D0}"="Application d'aide du systŠme pour le glisser-d‚placer""{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Ajouter l'‚l‚ment de cryptage dans les menus contextuels de l'Explorateur""{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft""{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement""{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Dossier Bureau""{5b4dae26-b807-11d0-9815-00c04fd91972}"="Bande de menus""{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Suivi du menu Shell""{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site""{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Barre du Bureau""{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu""{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚""{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy""{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand""{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft""{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche""{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche""{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web""{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Liens""{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre""{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse""{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse""{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft""{7487cd30-f71a-11d0-9ea7-00805f714772}"="Image miniature""{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor""{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU""{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft""{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft""{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft""{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes""{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp""{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau""{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite""{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur""{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global""{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band""{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service""{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer""{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut""{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service""{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique""{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files""{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook""{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4""{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook""{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC""{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC""{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet""{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space""{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service""{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service""{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache""{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck""{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr""{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription""{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler""{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent""{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent""{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent""{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent""{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent""{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler""{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Miniatures""{EAB841A0-9550-11CF-8C16-00805F1408F3}"="Extracteur de miniatures HTML""{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Extracteur de miniatures des filtres graphiques Office""{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)""{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator""{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'application du shell""{0B124F8C-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es""{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher""{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace""{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object""{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI""{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find""{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find""{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI""{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs""{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder""{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook""{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target""{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties""{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Menu Fichiers hors connexion""{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Options du dossier Fichiers hors connexion""{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion""{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler""{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer""{E0D79304-84BE-11CE-9641-444553540000}"="WinZip""{E0D79305-84BE-11CE-9641-444553540000}"="WinZip""{E0D79306-84BE-11CE-9641-444553540000}"="WinZip""{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1""{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter""{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player""{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web""{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler""{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler""{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band""{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU""{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible""{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante""{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses""{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture""{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files""{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band""{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne""{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne""{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object""{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu""{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties""{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes...""{472083B0-C522-11CF-8763-00608CC02F24}"="avast""{24EAEBCF-8ADE-412D-BDD4-94D587871E75}"="""{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}"="""{ACBB7531-E567-456C-AC20-D84D91A3E4A8}"="""{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"**********************************************************************************HKEY ROOT CLASSIDS:Windows Registry Editor Version 5.00[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}]@=""[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}\Implemented Categories]@=""[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]@=""[HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}\InprocServer32]@="C:\WINNT\system32\wZvemsp.dll""ThreadingModel"="Apartment"Windows Registry Editor Version 5.00[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}]@=""[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}\Implemented Categories]@=""[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]@=""[HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}\InprocServer32]@="C:\WINNT\system32\fQxcom.dll""ThreadingModel"="Apartment"Windows Registry Editor Version 5.00[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}]@=""[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}\Implemented Categories]@=""[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]@=""[HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}\InprocServer32]@="C:\WINNT\system32\ajicap32.dll""ThreadingModel"="Apartment"**********************************************************************************Files Found are not all bad files:C:\WINNT\SYSTEM32\   ajicap32.dll   Wed 17 Aug 2005  17:39:56   ..S.R        417 792   408,00 K   iymui.dll      Wed 17 Aug 2005  15:48:06   .....        417 792   408,00 K   impborl.dll    Mon  4 Jul 2005  18:34:58   A....         12 288    12,00 K   arsnw.dll      Mon  4 Jul 2005  19:32:58   A....        417 792   408,00 K   kndfc.dll      Mon  4 Jul 2005  22:29:48   A....        417 792   408,00 K   imengine.dll   Tue  5 Jul 2005   0:06:38   A....        417 792   408,00 K   dbime.dll      Tue  5 Jul 2005   0:07:30   A....        417 792   408,00 K   msc40u.dll     Tue  5 Jul 2005   0:07:56   A....        417 792   408,00 K   nkevent.dll    Tue  5 Jul 2005   0:08:44   A....        417 792   408,00 K   mcwstr10.dll   Tue  5 Jul 2005   0:11:38   A....        417 792   408,00 K   dzvmgr.dll     Tue  5 Jul 2005   0:12:34   A....        417 792   408,00 K   wzvemsp.dll    Sat 23 Jul 2005  11:46:14   ..S.R        417 792   408,00 K12 items found:  12 files (2 H/S), 0 directories.   Total of file sizes:  4 608 000 bytes      4,39 MLocate .tmp files:No matches found.**********************************************************************************Directory Listing of system files: Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est 6C8E-FA5C R‚pertoire de C:\WINNT\System3217/08/2005  17:39              417ÿ792 ajicap32.dll23/07/2005  11:46              417ÿ792 wZvemsp.dll28/12/2000  16:59       <DIR>          dllcache               2 fichier(s)          835ÿ584 octets               1 R‚p(s)   1ÿ297ÿ915ÿ904 octets libres

Utilisateur anonyme · Answer

ok, maintenant relance le et choisis l'opion 2il va te demander pour redemarrer le pc, laisse le faire et accepteune fois redemarrer il va travailler un moment et afficher un rapport dans le bloc note.(si le bloc note ne s'ouvre pas regarde dans le dossier l2mfix et ouvre le fichier  log.txt)poste ce rapport + un nouvel hijacka+

kido31 · Answer

voici le rapport l2mfixL2Mfix 1.03c Running From:C:	mp\l2mfix  RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Denying C(CI) access for predefined group "Administrators" - adding new ACCESS DENY entry Registry Permissions set too:RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(CI)    DENY   --C-------   	BUILTIN\Administrateurs(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting up for Reboot  Starting Reboot! C:	mp\l2mfix System Rebooted!  Running From:C:	mp\l2mfix killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 1188 'explorer.exe'Killing PID 1188 'explorer.exe'Error 0x5 : Accès refusé.Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 1256 'rundll32.exe' Scanning First Pass. Please Wait! First Pass Completed  Second Pass Scanning  Second pass Completed!Backing Up: C:\WINNT\system32\ajicap32.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\ajicap32.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\iymui.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\iymui.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\arsnw.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\arsnw.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\kndfc.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\kndfc.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\imengine.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\imengine.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\dbime.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\dbime.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\msc40u.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\msc40u.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32
kevent.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32
kevent.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\mcwstr10.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\mcwstr10.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\dzvmgr.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\dzvmgr.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\wZvemsp.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\wZvemsp.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\oqbc16gt.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\oqbc16gt.dll        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\guard.tmp        1 fichier(s) copi‚(s).Backing Up: C:\WINNT\system32\guard.tmp        1 fichier(s) copi‚(s).deleting: C:\WINNT\system32\ajicap32.dll  Successfully Deleted: C:\WINNT\system32\ajicap32.dlldeleting: C:\WINNT\system32\ajicap32.dll  Successfully Deleted: C:\WINNT\system32\ajicap32.dlldeleting: C:\WINNT\system32\iymui.dll  Successfully Deleted: C:\WINNT\system32\iymui.dlldeleting: C:\WINNT\system32\iymui.dll  Successfully Deleted: C:\WINNT\system32\iymui.dlldeleting: C:\WINNT\system32\arsnw.dll  Successfully Deleted: C:\WINNT\system32\arsnw.dlldeleting: C:\WINNT\system32\arsnw.dll  Successfully Deleted: C:\WINNT\system32\arsnw.dlldeleting: C:\WINNT\system32\kndfc.dll  Successfully Deleted: C:\WINNT\system32\kndfc.dlldeleting: C:\WINNT\system32\kndfc.dll  Successfully Deleted: C:\WINNT\system32\kndfc.dlldeleting: C:\WINNT\system32\imengine.dll  Successfully Deleted: C:\WINNT\system32\imengine.dlldeleting: C:\WINNT\system32\imengine.dll  Successfully Deleted: C:\WINNT\system32\imengine.dlldeleting: C:\WINNT\system32\dbime.dll  Successfully Deleted: C:\WINNT\system32\dbime.dlldeleting: C:\WINNT\system32\dbime.dll  Successfully Deleted: C:\WINNT\system32\dbime.dlldeleting: C:\WINNT\system32\msc40u.dll  Successfully Deleted: C:\WINNT\system32\msc40u.dlldeleting: C:\WINNT\system32\msc40u.dll  Successfully Deleted: C:\WINNT\system32\msc40u.dlldeleting: C:\WINNT\system32
kevent.dll  Successfully Deleted: C:\WINNT\system32
kevent.dlldeleting: C:\WINNT\system32
kevent.dll  Successfully Deleted: C:\WINNT\system32
kevent.dlldeleting: C:\WINNT\system32\mcwstr10.dll  Successfully Deleted: C:\WINNT\system32\mcwstr10.dlldeleting: C:\WINNT\system32\mcwstr10.dll  Successfully Deleted: C:\WINNT\system32\mcwstr10.dlldeleting: C:\WINNT\system32\dzvmgr.dll  Successfully Deleted: C:\WINNT\system32\dzvmgr.dlldeleting: C:\WINNT\system32\dzvmgr.dll  Successfully Deleted: C:\WINNT\system32\dzvmgr.dlldeleting: C:\WINNT\system32\wZvemsp.dll  Successfully Deleted: C:\WINNT\system32\wZvemsp.dlldeleting: C:\WINNT\system32\wZvemsp.dll  Successfully Deleted: C:\WINNT\system32\wZvemsp.dlldeleting: C:\WINNT\system32\oqbc16gt.dll  Successfully Deleted: C:\WINNT\system32\oqbc16gt.dlldeleting: C:\WINNT\system32\oqbc16gt.dll  Successfully Deleted: C:\WINNT\system32\oqbc16gt.dlldeleting: C:\WINNT\system32\guard.tmp  Successfully Deleted: C:\WINNT\system32\guard.tmpdeleting: C:\WINNT\system32\guard.tmp  Successfully Deleted: C:\WINNT\system32\guard.tmp Desktop.ini sucessfully removed  Zipping up files for submission:  adding: ajicap32.dll (deflated 48%)  adding: iymui.dll (deflated 48%)  adding: arsnw.dll (deflated 48%)  adding: kndfc.dll (deflated 48%)  adding: imengine.dll (deflated 48%)  adding: dbime.dll (deflated 48%)  adding: msc40u.dll (deflated 48%)  adding: nkevent.dll (deflated 48%)  adding: mcwstr10.dll (deflated 48%)  adding: dzvmgr.dll (deflated 48%)  adding: wZvemsp.dll (deflated 48%)  adding: oqbc16gt.dll (deflated 48%)  adding: guard.tmp (deflated 48%)  adding: echo.reg (deflated 6%)  adding: clear.reg (deflated 46%)  adding: desktop.ini (stored 0%)  adding: readme.txt (deflated 50%)  adding: direct.txt (stored 0%)  adding: report.txt (deflated 64%)  adding: lo2.txt (deflated 85%)  adding: test2.txt (deflated 27%)  adding: test3.txt (deflated 27%)  adding: test5.txt (deflated 27%)  adding: test.txt (deflated 87%)  adding: xfind.txt (deflated 83%)  adding: backregs/notibac.reg (deflated 63%)  adding: backregs/shell.reg (deflated 75%)  adding: backregs/24EAEBCF-8ADE-412D-BDD4-94D587871E75.reg (deflated 70%)  adding: backregs/E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82.reg (deflated 70%)  adding: backregs/ACBB7531-E567-456C-AC20-D84D91A3E4A8.reg (deflated 70%) Restoring Registry Permissions:  RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Revoking access for predefined group "Administrators"Inherited ACE can not be revoked here!Inherited ACE can not be revoked here! Registry permissions set too:RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRERestoring Sedebugprivilege:  Granting SeDebugPrivilege to Administrators   ... failed (GetAccountSid(Administrators)=1332  Restoring Windows Update Certificates.: deleting local copy: ajicap32.dll   deleting local copy: ajicap32.dll   deleting local copy: iymui.dll   deleting local copy: iymui.dll   deleting local copy: arsnw.dll   deleting local copy: arsnw.dll   deleting local copy: kndfc.dll   deleting local copy: kndfc.dll   deleting local copy: imengine.dll   deleting local copy: imengine.dll   deleting local copy: dbime.dll   deleting local copy: dbime.dll   deleting local copy: msc40u.dll   deleting local copy: msc40u.dll   deleting local copy: nkevent.dll   deleting local copy: nkevent.dll   deleting local copy: mcwstr10.dll   deleting local copy: mcwstr10.dll   deleting local copy: dzvmgr.dll   deleting local copy: dzvmgr.dll   deleting local copy: wZvemsp.dll   deleting local copy: wZvemsp.dll   deleting local copy: oqbc16gt.dll   deleting local copy: oqbc16gt.dll   deleting local copy: guard.tmp   deleting local copy: guard.tmp    The following Is the Current Export of the Winlogon notify key:****************************************************************************Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\  6c,00,00,00"Logoff"="ChainWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\  6c,00,6c,00,00,00"Logoff"="CryptnetWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]"DLLName"="cscdll.dll""Logon"="WinlogonLogonEvent""Logoff"="WinlogonLogoffEvent""ScreenSaver"="WinlogonScreenSaverEvent""Startup"="WinlogonStartupEvent""Shutdown"="WinlogonShutdownEvent""StartShell"="WinlogonStartShellEvent""Impersonate"=dword:00000000"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]"Logoff"="WLEventLogoff""Impersonate"=dword:00000000"Asynchronous"=dword:00000001"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]"DLLName"="WlNotify.dll""Lock"="SensLockEvent""Logon"="SensLogonEvent""Logoff"="SensLogoffEvent""Safe"=dword:00000001"MaxWait"=dword:00000258"StartScreenSaver"="SensStartScreenSaverEvent""StopScreenSaver"="SensStopScreenSaverEvent""Startup"="SensStartupEvent""Shutdown"="SensShutdownEvent""StartShell"="SensStartShellEvent""Unlock"="SensUnlockEvent""Impersonate"=dword:00000001"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]"DLLName"="wzcdlg.dll""Logon"="WZCEventLogon""Logoff"="WZCEventLogoff""Impersonate"=dword:00000000"Asynchronous"=dword:00000000 The following are the files found: ****************************************************************************C:\WINNT\system32\ajicap32.dll C:\WINNT\system32\ajicap32.dll C:\WINNT\system32\iymui.dll C:\WINNT\system32\iymui.dll C:\WINNT\system32\arsnw.dll C:\WINNT\system32\arsnw.dll C:\WINNT\system32\kndfc.dll C:\WINNT\system32\kndfc.dll C:\WINNT\system32\imengine.dll C:\WINNT\system32\imengine.dll C:\WINNT\system32\dbime.dll C:\WINNT\system32\dbime.dll C:\WINNT\system32\msc40u.dll C:\WINNT\system32\msc40u.dll C:\WINNT\system32
kevent.dll C:\WINNT\system32
kevent.dll C:\WINNT\system32\mcwstr10.dll C:\WINNT\system32\mcwstr10.dll C:\WINNT\system32\dzvmgr.dll C:\WINNT\system32\dzvmgr.dll C:\WINNT\system32\wZvemsp.dll C:\WINNT\system32\wZvemsp.dll C:\WINNT\system32\oqbc16gt.dll C:\WINNT\system32\oqbc16gt.dll C:\WINNT\system32\guard.tmp C:\WINNT\system32\guard.tmp  Registry Entries that were Deleted: Please verify that the listing looks ok.  If there was something deleted wrongly there are backups in the backreg folder. ****************************************************************************REGEDIT4[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]"{24EAEBCF-8ADE-412D-BDD4-94D587871E75}"=-"{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}"=-"{ACBB7531-E567-456C-AC20-D84D91A3E4A8}"=-[-HKEY_CLASSES_ROOT\CLSID\{24EAEBCF-8ADE-412D-BDD4-94D587871E75}][-HKEY_CLASSES_ROOT\CLSID\{E7BAAE5B-B2E2-4E91-9B3E-C1F115EA7E82}][-HKEY_CLASSES_ROOT\CLSID\{ACBB7531-E567-456C-AC20-D84D91A3E4A8}]REGEDIT4[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]****************************************************************************Desktop.ini Contents: ****************************************************************************[.ShellClassInfo]CLSID={645FF040-5081-101B-9F08-00AA002F954E}****************************************************************************et le nouveau hijackLogfile of HijackThis v1.99.1Scan saved at 20:44:50, on 17/08/2005Platform: Windows 2000 SP2 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINNT\System32\CTSvcCDA.exeC:\WINNT\System32\svchost.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\system32\stisvc.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\System32\mspmspsv.exeC:\WINNT\System32\ZipToA.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXEC:\Program Files\Creative\ShareDLL\CtNotify.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\WINNT\loadqm.exeC:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\WINNT\system32\internat.exeC:\Program Files\Creative\ShareDLL\MediaDet.ExeC:\WINNT\explorer.exeC:\WINNT\system32\NOTEPAD.EXEC:\hijackthis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: @msdxmLC.dll,-1@1036,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [Détecteur de disque] C:\Program Files\Creative\ShareDLL\CtNotify.exeO4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /tO4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exeO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Microsoft Service] C:\WINNT\system32
twdm.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [LoadQM] loadqm.exeO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKCU\..\Run: [internat.exe] internat.exeO4 - HKCU\..\Run: [Smile Brush] "C:\Program Files\Smile Brush\Smile Brush.exe" aO4 - Global Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dllO9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXEO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXEO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exeO23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: ZipToA - Iomega Corporation - C:\WINNT\System32\ZipToA.exe

Utilisateur anonyme · Answer

maintenant, vérifie ces dossiers existent sur ton pc:C:\Program files\OutLasterouC:\Programme\OutLasterensuite fais un nettoyage de tous les fichier temporaires c'est important, et en mode sans echec si tu peux:* C:\Documents and Settings	on compte\Local Settings\Temp* C:\Documents and Settings	ous les autres comptes\Local Settings\Temp* C:\Temp* C:\Windows\Tempvider tout le contenu de ces dossiers.redemarre le pc et dis moi si tu as toujours des problemes avec winfixera+

kido31 · Answer

pour l'instant je n'ai pas de fenetre "winfixer " qui s'ouvreest-ce que tu pourrais m'expliquer un peu ce qui s'est passé et quoi faire pour se protéger de ce genre de probleme à l'avenirmerci

Utilisateur anonyme · Answer

maintient ton systeme et ton navigateur le plus à jour possible via windows update.pour winfixer il est assez nouveau, ca peut venir d'un controle active x que tu as accepté, ou d'une page piégé qui exploite une des nombreuses failles d'internet explorer et qui permet d'executer un fichier à distance.dans ton cas ce serait plutot la seconde possibilité, personnellement j'ai laissé tomber IE et remplacé par mozilla ou firefox.ils ne sont pas infaillibles mais leurs editeurs corrigent tres rapidement une faille lorsqu'elle est decouverte contrairement à microsoft.le seul inconvenient c'est qu'il faut verifier souvent si une nouvelle version existe mais tu ne pert ni tes favoris ni tes reglages.http://frenchmozilla.sourceforge.net/par contre je vois dans ton hijack C:\WINNT\system32
twdm.exe essaye de faire ceci:va sur ce sitehttp://virusscan.jotti.org/ clic sur parcourir, mais au lieu de rechercher manuellement le fichier, copie et colle ceci:C:\WINNT\system32
twdm.exe dans "nom du fichier"valide et clic sur submitet dis moi s'il trouve quelque chose

kido31 · Answer

voici ce que j'obtiensThe file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

kido31 · Answer

et aussi celaLast file scanned at least one scanner reported something about: Tibia3D.rar, detected by:Scanner  Malware name  AntiVir  TR/Spy.Perfloger.T  ArcaVir  X  Avast  X  AVG Antivirus  X  BitDefender  X  ClamAV  X  Dr.Web  X  F-Prot Antivirus  X  Fortinet  X  Kaspersky Anti-Virus  not-a-virus:Monitor.Win32.Perflogger.12  NOD32  X  Norman Virus Control  X  UNA  X  VBA32  X

Utilisateur anonyme · Answer

mouais, je trouve pas trop d'infos précises sur ce fichier.si tu as le temps ou quand tu l'auras, fais un scan av en ligne ici:http://webscanner.kaspersky.fr/et/ou làhttp://www.bitdefender.fret poste le rapporta+

kido31 · Answer

bonjour,voici les rapports de scan bitfinder et kaspery:apparament rien à signaler. En tout cas merci pour ton aidea+BitDefender Online Scanner - Rapport virus en temps réel     Généré à: Thu, Aug 18, 2005 - 11:12:55 --------------------------------------------------------------------------------      Info d'analyse     Fichiers scannés 94272 Infectés Fichiers 0            Virus Détectés     Aucun virus trouvé.  ------------------------------------------------------------------------------- KASPERSKY ON-LINE SCANNER REPORT Thursday, August 18, 2005 01:42:02 Operating System: Microsoft Windows 2000 Professional, Service Pack 2 (Build 2195) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 17/08/2005 Kaspersky Anti-Virus database records: 135666-------------------------------------------------------------------------------Scan Settings:	Scan using the following antivirus database: standard	Scan Archives: true	Scan Mail Bases: trueScan Target - My Computer:	A:\	C:\	D:\Scan Statistics:	Total number of scanned objects: 26301	Number of viruses found: 0	Number of infected objects: 0	Number of suspicious objects: 0	Duration of the scan process: 5900 secNo malware has been detected. The sections that have been scanned are CLEAN.Scan process completed.            --------------------------------------------------------------------------------     Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.

Utilisateur anonyme · Answer

salutapparement tout à l'air ok alors, il te reste des soucis ?a+

Comment eliminer winfixer

21 réponses

Discussions similaires

Newsletters