[Trojan] Comment le detecter et l'effacer ?

Question

Bonjour,

Je vais essayer de vous expliquer mon probleme clairement point par point...

Voila, il y a quelques temps j'ai recu pas mal de **** sur mon pc...
(EliteBar, assistant search, trojan divers, etc...) le tout presque en meme temps !

Etant inquiet, je lance XoftSpy qui me detecte plusieurs de ces programmes et m'efface une partie (les barre entre autres)

Il ne tournait toujours pas "rond" j'ai donc lancé Ad-Aware qui commence son analyse et des qu'il detecte 1 objets critique j'ai un message d'erreur qui me dis que mon pc va s'eteindre (comme le ver: Blaster) mais seulement lors de l'analyse et pas au demarrage !

J'ai essayé plusieurs chose (antivirus en ligne (secuser.com), McAfee, etc)

L'antivirus en ligne ne donne rien.
McAfee ne peux ni les nettoyer et quand je lui demande de les effacé il me dis qu'il ne trouve plus le fichier (mais toujours present si je refait un scann !)

Et maintenant, quand je lance ad-aware je n'ai plus de message d'erreur, il redemarre tout seul...
J'ai pu remarqué qu'il bloquait sur un fichier appellé: nt_hide66.dll
cela vous dis quelque chose ?

En esperant que vous pouvez m'aider et que j'ai ete clair,
je vous souhaite une bonne soirée...

Toutes les propositions sont bienvenues, si vous avez besoin d'autre infos, demander ! je suis ouvert a tout, car la, j'ai plus d'idée !

Merci beaucoup

Laurent, alias Snowguy

Afficher la suite

balltrap34 · Answer

salutfait ceci HijackThis                         (ici)              http://www.florensac-chasse-trap.com/   section virussection virus telecharge le et met le dans son propre dossier ex/c :hj clik sur do a systeme scan et save a logfileet copier coller le rapportdemohttp://pageperso.aol.fr/balltrap34/demohijack.htm

Laurent · Answer

Et voila...Tu comprends quelque chose a ca toi ? :pen fait mnt tout le monde sait ce que j'ai sur mon pc... enfin, si ca peux m'aider, m'en fout :p lol...merci !(ps: dsl, apparemment me suis trompé, j'ai IE v. 6.0 !)Logfile of HijackThis v1.99.1Scan saved at 22:16:13, on 11/09/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\SYSTEM32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\RunDll32.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\system32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\WINDOWS\system32undll32.exeC:\Program Files\D-Tools\daemon.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:	emp\MEDIAG~1.EXEC:\WINDOWS\system32\9loc5hni.exeC:\PROGRA~1\mcafee.com\vso\mcvsshld.exec:\progra~1\mcafee.com\vso\mcvsescn.exeC:\WINDOWS\etb\pokapoka66.exeC:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exeC:\Program Files\Messenger\msmsgs.exec:\PROGRA~1\mcafee.com\vso\mcvsrte.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\iPod\bin\iPodService.exec:\program files\mcafee.com\agent\mcagent.exec:\progra~1\mcafee.com\vso\mcvsftsn.exec:\PROGRA~1\mcafee.com\vso\mcshield.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\System32\cisvc.exeC:\WINDOWS\SYSTEM32\cidaemon.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Laurent\Local Settings\Temporary Internet Files\Content.IE5\YHI7436X\HijackThis[1].exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.chR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.phpR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingF2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [sdkij32.exe] C:\WINDOWS\system32\sdkij32.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [MsScanReg] C:\WINDOWS\system32\scanreg.exeO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exeO4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [Farces & Attrapes] C:\Documents and Settings\Laurent\Bureau\grinchihi.exe \farcesO4 - HKLM\..\Run: [YG0w] C:\WINDOWS
omym.exeO4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgentO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [Sp2Protect] C:\WINDOWS\system32\sp2protect.exeO4 - HKLM\..\Run: [Bluetooth] C:\WINDOWS\system32\shell32.exeO4 - HKLM\..\Run: [Kernel32] C:\WINDOWS\system32\username.exeO4 - HKLM\..\Run: [I download pirated Software] C:\WINDOWS\system32\_.gofO4 - HKLM\..\Run: [lsass] C:\windows\system32\elitezyv32.exeO4 - HKLM\..\Run: [MMC Recovery] C:\WINDOWS\system32\O4 - HKLM\..\Run: [Local Authority Service] C:\WINDOWS\system32\O4 - HKLM\..\Run: [Registry Backup] C:\WINDOWS\system32\O4 - HKLM\..\Run: [Media Gateway] C:	emp\MEDIAG~1.EXEO4 - HKLM\..\Run: [9loc5hni] C:\WINDOWS\system32\9loc5hni.exeO4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktaskO4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exeO4 - HKLM\..\Run: [System service66] C:\WINDOWS\etb\pokapoka66.exeO4 - HKLM\..\Run: [System service65] C:\WINDOWS\etb\pokapoka65.exeO4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\Laurent\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [uiiu] C:\PROGRA~1\COMMON~1\uiiu\uiium.exeO4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exeO4 - HKCU\..\RunOnce: [Web Offer] C:\WINDOWS\system32\sp2protect.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\vhborwte.exeO16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/Bridge-c112.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125685025000O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://212.147.78.230/activex/AxisCamControl.cabO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cabO16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.tf1.fr/activex/zylomgamesplayer.cabO16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game15.zylom.tf1.fr/activex/zylomloader.cabO16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.shockwave.com/content/feedingfrenzy/SproutLauncher.cabO18 - Protocol: bw+0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw+0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw-0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw-0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw00 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw00s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw10 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw10s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw20 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw20s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw30 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw30s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw40 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw40s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw50 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw50s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw60 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw60s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw70 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw70s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw80 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw80s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw90 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bw90s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwa0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwa0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwb0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwb0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwc0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwc0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwd0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwd0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwe0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwe0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwf0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwf0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dllO18 - Protocol: bwg0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwg0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwh0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwh0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwi0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwi0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwj0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwj0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwk0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwk0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwl0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwl0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwm0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwm0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwn0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwn0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwo0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwo0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwp0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwp0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwq0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwq0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwr0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwr0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bws0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bws0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwt0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwt0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwu0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwu0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwv0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwv0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bww0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bww0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwx0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwx0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwy0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwy0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwz0 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: bwz0s - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO18 - Protocol: offline-8876480 - {7851F02A-62A5-494A-AE8C-6317D7088F08} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllO23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exeO23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exeO23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

balltrap34 · Answer

fait ceci je veut voir quelque chosetelechargehttp://siri.urz.free.fr/Fix/SmitfraudFix.ziptu le decompresse tu double clik dessus et tu choisi l option 1cela vas generer un rapport donne nous le

Laurent · Answer

Voila le rapport:
(je file sous la douche, si tu as besoin d'autre chose je re dans un tit moment, A+)

SmitFraudFix v1.84

Rapport fait à 22:27:15,87 le 11/09/2005
Executé à partir de C:\fix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Laurent\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Laurent\Bureau

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de la clé HKLM\SOFTWARE\SHUDDERLTD

HKLM\SOFTWARE\SHUDDERLTD non trouvé.

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

balltrap34 · Answer

lol tu as la dose commence par ceci stp http://pageperso.aol.fr/Balltrap34/virelite.exefait l option 1 et donne moi le rapport

Laurent · Answer

Hello... et merci ! :)

Comment ca "la dose" ? c'est vraiment si critique que ca !?

En esperant que tu puisse m'aider, je te souhaite bonne chance pour dechiffrer les rapport :)
Merci !

voila le rapport !

Rapport fait le: 12/09/2005 à 16:59:48,20

---------- Attention, tous les fichiers trouvés ne sont pas forcement mauvais ----------

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 442C-0AA4

R‚pertoire de C:\WINDOWS\system32

19/08/2001 13:30 11ÿ357 eliteaee32.exe
19/08/2001 13:30 11ÿ357 elitednl32.exe
19/08/2001 13:30 11ÿ357 eliteftb32.exe
19/08/2001 13:30 11ÿ357 elitehas32.exe
19/08/2001 13:30 11ÿ357 eliteiry32.exe
19/08/2001 13:30 11ÿ357 elitencc32.exe
19/08/2001 13:30 11ÿ357 eliteoks32.exe
19/08/2001 13:30 11ÿ357 elitewvk32.exe
19/08/2001 13:30 11ÿ357 elitezyv32.exe
9 fichier(s) 102ÿ213 octets
0 R‚p(s) 27ÿ493ÿ285ÿ888 octets libres

Laurent · Answer

Re ;)Je me permet de faire un petit "up" en esperant que balltrap verra mon appel au secours si il s'est pas suicidé apres avoir vu mes problemes !:) merci !Laurent

balltrap34 · Answer

salut desoler mais je suis absent la semaine relance virelite et choisi l option 2 et refait un hijack ne reedemarre pas

[Trojan] Comment le detecter et l'effacer ?

8 réponses

Votre réponse

Discussions similaires

Newsletters