[Trojan] Comment le detecter et l'effacer ?
Laurent
-
balltrap34 Messages postés 16241 Statut Contributeur sécurité -
balltrap34 Messages postés 16241 Statut Contributeur sécurité -
Bonjour,
Je vais essayer de vous expliquer mon probleme clairement point par point...
Voila, il y a quelques temps j'ai recu pas mal de **** sur mon pc...
(EliteBar, assistant search, trojan divers, etc...) le tout presque en meme temps !
Etant inquiet, je lance XoftSpy qui me detecte plusieurs de ces programmes et m'efface une partie (les barre entre autres)
Il ne tournait toujours pas "rond" j'ai donc lancé Ad-Aware qui commence son analyse et des qu'il detecte 1 objets critique j'ai un message d'erreur qui me dis que mon pc va s'eteindre (comme le ver: Blaster) mais seulement lors de l'analyse et pas au demarrage !
J'ai essayé plusieurs chose (antivirus en ligne (secuser.com), McAfee, etc)
L'antivirus en ligne ne donne rien.
McAfee ne peux ni les nettoyer et quand je lui demande de les effacé il me dis qu'il ne trouve plus le fichier (mais toujours present si je refait un scann !)
Et maintenant, quand je lance ad-aware je n'ai plus de message d'erreur, il redemarre tout seul...
J'ai pu remarqué qu'il bloquait sur un fichier appellé: nt_hide66.dll
cela vous dis quelque chose ?
En esperant que vous pouvez m'aider et que j'ai ete clair,
je vous souhaite une bonne soirée...
Toutes les propositions sont bienvenues, si vous avez besoin d'autre infos, demander ! je suis ouvert a tout, car la, j'ai plus d'idée !
Merci beaucoup
Laurent, alias Snowguy
Je vais essayer de vous expliquer mon probleme clairement point par point...
Voila, il y a quelques temps j'ai recu pas mal de **** sur mon pc...
(EliteBar, assistant search, trojan divers, etc...) le tout presque en meme temps !
Etant inquiet, je lance XoftSpy qui me detecte plusieurs de ces programmes et m'efface une partie (les barre entre autres)
Il ne tournait toujours pas "rond" j'ai donc lancé Ad-Aware qui commence son analyse et des qu'il detecte 1 objets critique j'ai un message d'erreur qui me dis que mon pc va s'eteindre (comme le ver: Blaster) mais seulement lors de l'analyse et pas au demarrage !
J'ai essayé plusieurs chose (antivirus en ligne (secuser.com), McAfee, etc)
L'antivirus en ligne ne donne rien.
McAfee ne peux ni les nettoyer et quand je lui demande de les effacé il me dis qu'il ne trouve plus le fichier (mais toujours present si je refait un scann !)
Et maintenant, quand je lance ad-aware je n'ai plus de message d'erreur, il redemarre tout seul...
J'ai pu remarqué qu'il bloquait sur un fichier appellé: nt_hide66.dll
cela vous dis quelque chose ?
En esperant que vous pouvez m'aider et que j'ai ete clair,
je vous souhaite une bonne soirée...
Toutes les propositions sont bienvenues, si vous avez besoin d'autre infos, demander ! je suis ouvert a tout, car la, j'ai plus d'idée !
Merci beaucoup
Laurent, alias Snowguy
Configuration: PC Medion Pentium 4, 2.8GHz Windows XP SP2 Internet Explorer V. 5.5
8 réponses
-
Et voila...
Tu comprends quelque chose a ca toi ? :p
en fait mnt tout le monde sait ce que j'ai sur mon pc... enfin, si ca peux m'aider, m'en fout :p lol...
merci !
(ps: dsl, apparemment me suis trompé, j'ai IE v. 6.0 !)
Logfile of HijackThis v1.99.1
Scan saved at 22:16:13, on 11/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\temp\MEDIAG~1.EXE
C:\WINDOWS\system32\9loc5hni.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\etb\pokapoka66.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Laurent\Local Settings\Temporary Internet Files\Content.IE5\YHI7436X\HijackThis[1].exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.ch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sdkij32.exe] C:\WINDOWS\system32\sdkij32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MsScanReg] C:\WINDOWS\system32\scanreg.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Farces & Attrapes] C:\Documents and Settings\Laurent\Bureau\grinchihi.exe \farces
O4 - HKLM\..\Run: [YG0w] C:\WINDOWS\nomym.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Sp2Protect] C:\WINDOWS\system32\sp2protect.exe
O4 - HKLM\..\Run: [Bluetooth] C:\WINDOWS\system32\shell32.exe
O4 - HKLM\..\Run: [Kernel32] C:\WINDOWS\system32\username.exe
O4 - HKLM\..\Run: [I download pirated Software] C:\WINDOWS\system32\_.gof
O4 - HKLM\..\Run: [lsass] C:\windows\system32\elitezyv32.exe
O4 - HKLM\..\Run: [MMC Recovery] C:\WINDOWS\system32\
O4 - HKLM\..\Run: [Local Authority Service] C:\WINDOWS\system32\
O4 - HKLM\..\Run: [Registry Backup] C:\WINDOWS\system32\
O4 - HKLM\..\Run: [Media Gateway] C:\temp\MEDIAG~1.EXE
O4 - HKLM\..\Run: [9loc5hni] C:\WINDOWS\system32\9loc5hni.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [System service66] C:\WINDOWS\etb\pokapoka66.exe
O4 - HKLM\..\Run: [System service65] C:\WINDOWS\etb\pokapoka65.exe
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\Laurent\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [uiiu] C:\PROGRA~1\COMMON~1\uiiu\uiium.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\RunOnce: [Web Offer] C:\WINDOWS\system32\sp2protect.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\vhborwte.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/Bridge-c112.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125685025000
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.147.78.230/activex/AxisCamControl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.tf1.fr/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game15.zylom.tf1.fr/activex/zylomloader.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/feedingfrenzy/SproutLauncher.cab
O18 - Protocol: bw+0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -
salut
fait ceci
HijackThis (ici) http://www.florensac-chasse-trap.com/ section virus
section virus
telecharge le et met le dans son propre dossier ex/c :hj
clik sur do a systeme scan et save a logfile
et copier coller le rapport
demo
http://pageperso.aol.fr/balltrap34/demohijack.htm
-
fait ceci je veut voir quelque chose
telecharge
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
tu le decompresse tu double clik dessus et tu choisi l option 1
cela vas generer un rapport donne nous le -
Voila le rapport:
(je file sous la douche, si tu as besoin d'autre chose je re dans un tit moment, A+)
SmitFraudFix v1.84
Rapport fait à 22:27:15,87 le 11/09/2005
Executé à partir de C:\fix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Laurent\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Laurent\Bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de la clé HKLM\SOFTWARE\SHUDDERLTD
HKLM\SOFTWARE\SHUDDERLTD non trouvé.
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
lol tu as la dose commence par ceci stp
http://pageperso.aol.fr/Balltrap34/virelite.exe
fait l option 1 et donne moi le rapport -
Hello... et merci ! :)
Comment ca "la dose" ? c'est vraiment si critique que ca !?
En esperant que tu puisse m'aider, je te souhaite bonne chance pour dechiffrer les rapport :)
Merci !
voila le rapport !
Rapport fait le: 12/09/2005 à 16:59:48,20
---------- Attention, tous les fichiers trouvés ne sont pas forcement mauvais ----------
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 442C-0AA4
R‚pertoire de C:\WINDOWS\system32
19/08/2001 13:30 11ÿ357 eliteaee32.exe
19/08/2001 13:30 11ÿ357 elitednl32.exe
19/08/2001 13:30 11ÿ357 eliteftb32.exe
19/08/2001 13:30 11ÿ357 elitehas32.exe
19/08/2001 13:30 11ÿ357 eliteiry32.exe
19/08/2001 13:30 11ÿ357 elitencc32.exe
19/08/2001 13:30 11ÿ357 eliteoks32.exe
19/08/2001 13:30 11ÿ357 elitewvk32.exe
19/08/2001 13:30 11ÿ357 elitezyv32.exe
9 fichier(s) 102ÿ213 octets
0 R‚p(s) 27ÿ493ÿ285ÿ888 octets libres -
Re ;)
Je me permet de faire un petit "up" en esperant que balltrap verra mon appel au secours si il s'est pas suicidé apres avoir vu mes problemes !
:) merci !
Laurent -
salut desoler mais je suis absent la semaine
relance virelite et choisi l option 2 et refait un hijack ne reedemarre pas
