TR/Dldr.Agent.YF

Question

Mon antivirus trouve TR/Dldr.Agent.YF sur mon ordi. Apparemment un Torjan, mais je n'arrive pas à l'enlever. J'ai essayer avec Spybot, Ad-aware, AVPersonal, renommer le fichier, mais rien n'y fait!

Utilisateur anonyme · Answer

salutdemarer<poste de travail< c <program files <av personal < logfiles < NTGRDRT < copie/colle tout ce qu il y a a l interieura+

Utilisateur anonyme · Answer

coucou DelphineJe copie-colle où?Sur le forum...En fait tu vas dans le fichier que je t indique:demarer<poste de travail< c <program files <av personal < logfiles < NTGRDRT (c est un fichier qui resume les infections que tu as subies)Tu te rends dans ce fichier , tu selectionne tout, clik droit et copierTu viens dans un message, clik droit et collerbesoin de plus d explications?a+

Utilisateur anonyme · Answer

Oui, montre moi...a+

Utilisateur anonyme · Answer

saluttelecharge et execute ceciClean Up 40:http://pageperso.aol.fr/balltrap34/CleanUp40.exe -aide en image:(merci à Balltrap34). http://pageperso.aol.fr/balltrap34/democleanup.htmensuite, apparemment tu as telecharger un pps qui te cause du tord ! (nomé VIVELEMAKE-UP.PPS )***¤Affiche tous les fichiers et dossiers : Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage Coche « afficher les fichiers et dossiers cachés » Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décoche « masquer les extensions dont le type est connu » Puis fais «Ok» pour valider les changements. Et appliquer ! ---------------------------------------------------------------------------- Recherche par le chemin et supprime ce que je te met en gras, puis vide ta corbeile !C:\DOCUMENTS AND SETTINGS\WINXP\APPLICATION DATA\MSN6\USERDATA\{9F73FAF0-985A-01C2-0200-00007F1090B2}\HOTMAIL\TEMPORARY MAIL FILES (000545B6)\VIVELEMAKE-UP.PPS A+(pas simpa celui qui te l as envoyé) lol

Delphine · Answer

Dans hotmail je n'ai pas le fichier temporary files.

bernie61 · Answer

saluten l'absence de Régisfais un Update de Antiviret scan aveca+

Delphine · Answer

Toujours là et en plus maintenant j'en ai de nouveaux!!!!

Utilisateur anonyme · Answer

coucou Delphinetélécharge HijackThis ici: http://www.hijackthis.de/downloads/hijackthis_199.zip  Dézippe le dans un dossier prévu à cet effet. Par exemple C:\hijackthis < Enregistre le bien dans c : ! Lance le puis: clique sur "do a system scan and save logfile" (cf démo) faire un copier coller du log entier sur le forumDémo : (merci à balltrap34 pour cette réalisation)http://pageperso.aol.fr/balltrap34/demohijack.htm	Bon courageA+

Delphine · Answer

Logfile of HijackThis v1.99.1Scan saved at 22:31:32, on 10/11/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\cytob.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\Program Files\AVPersonal\AVGNT.EXEC:\WINDOWS\System32\RunDll32.exeC:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXEC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\WINDOWS\system32\srshost.exeC:\Program Files\a-squared\a2guard.exeC:\WINDOWS\System32undll32.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\AVPersonal\AVSched32.EXEC:\Program Files\a-squared\a2start.exeC:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXEC:\Program Files\a-squared\a2scan.exeC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\Documents and Settings\User\Local Settings\Temp\Répertoire temporaire 1 pour hijackthis_199.zip\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - C:\WINDOWS\System32\pmnll.dllO2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\System32\vtutq.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /minO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXEO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [Microsoft Windows System] srwhost.exeO4 - HKLM\..\RunServices: [Microsoft Windows System] srwhost.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [srshost.exe] C:\WINDOWS\system32\srshost.exeO4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/imloader.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{CABEDDDE-DFA8-49C3-8509-8BF4E3703FAC}: NameServer = 195.238.2.21 195.238.2.22O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\i6600gjme6oa0.dllO20 - Winlogon Notify: pmnll - C:\WINDOWS\SYSTEM32\pmnll.dllO20 - Winlogon Notify: vtutq - C:\WINDOWS\System32\vtutq.dllO23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXEO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\U1lTVEVN\command.exe (file missing)O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exeO23 - Service: Windows Archiver (winarc) - Unknown owner - C:\WINDOWS\windat.exeO23 - Service: WindowsSysBoot - Unknown owner - C:\WINDOWS\cytob.exe

Utilisateur anonyme · Answer

coucou delphine,en effet tu es bien infecteTélécharge l2mfix ici: http://www.downloads.subratam.org/l2mfix.exe Double clic sur l2mfix.exe pour lancer l'extraction Dans le dossier l2mfix, double clic sur l2mfix.bat, appuie sur n'importe quelle touche puis choisis l'option #1 (et pas autre chose) et valide avec la touche entrée. Le bloc note va s'ouvrir avec le résultat du scan. Fais un copier coller du résultat ici.a+

Delphine · Answer

This is a fix/uninstaller  for the Version 200 of Look2meThis will only work on this particular version.This is for xp or windows 2000 onlyThese infections are usually indicated by these lines in a hijackthis log:O1 - Hosts: 69.20.16.183 auto.search.msn.comO1 - Hosts: 69.20.16.183 search.netscape.comO1 - Hosts: 69.20.16.183 ieautosearch020 - Seeming valid entry or entries First Menu1. Report Generator to Verify Infection 2. Run Fix 3. This readme.4. Restore registry permission to winlogon key. 5. Fix autoexec.nt error on running dos programs.Upon running the fix the system will perform some procedures and notify its going to reboot.After you press any key it will give a 15 second countdown and rebootThe second.bat should run automatically on bootup and loading of the desktop.If for some reason it does not on bootup it must be run manually. The desktop will dissappear and the fix will proceed.Please wait as this can take upwards of 5 minsWhen it is finished it will produce a log of what was removed and found.Verify the registry entries that were removed in the log and the registry permissions are set back to normal. That should be all.No warranties are expressed or implied. Use at your own risk!! Follow the approriate instructions from a qualified person on the forums if you are not sure.Special Thanks to Rubberducky and OSC for the beta tests. Also all the other experts whowere involved in the various threads with input. Thanks to Option^Explicit for the reboot utility. Thanks to all the other utility program and script writers Also.Thanks for yoyo Sharing his ideas and Code. If you would like to or need to contact me i can be reached at:spywaresubmit@aol.comPlease visit the following forums for help.www.subratam.orgwww.spywareinfo.comwww.tomcoyote.comwww.castlecops.bizwww.atribune.orghttp://net-integration.netA Special Thanks to Atribune and Subratam for Hosting the file!Mirrors Available athttp://downloads.subratam.org/l2mfix.exehttp://www.atribune.org/downloads/l2mfix.exePlease do not host anywhere else. Version 1.0Version 1.01Fixed find log error. Version 1.02Changed Strings routineChanged registry routines to improve cleanupEliminated vbs portionadded sv1 for useragent on xp sp2 machinesadded hosts file cleaning.(still beta)add shortcut to fix autoexec.nt errors(menu option 5)added menu entries to restore notify defaults if needed.(entries missing under notify)(menu option 4)Version 1.02aadded filtering for valid classids under shell extension approved key. Version 1.03 03/12/2004Updated for new files versions released. Version 1.03aupdated for licensing issuesversion 1.03badded remove.com files for fixing log error per gary r and mosiac1 (THANKS!)made winlogon default entries automatic now. it runs when the fix portion is run.version 1.03c added fix for windows update per winhelp and the mskb articleversion 1.03dChanged option 4 to manually restore registry permission if necessary if second.bat fails to complete.Version 1.04Added pd strings to solve freezing issueVersion 1.04a used runonceexkey for reboot.

Utilisateur anonyme · Answer

re,apparemment ca n a pas marche !peux tu recommencer option 1 stpet faire tes mises a jour windows, met le sp1 stphttp://update.microsoft.com/windowsupdate/v6/default.aspx?ln=frA+

Delphine · Answer

En fait, j'ai pas trouvé le tuc .bat. C le fichier qui donne l'écran noir?

Utilisateur anonyme · Answer

re delphine,je t en supplie delphine, peux tu faire tes mises a jour de securité et mettre le sp1? stppppppppppppppppppsinon on va recommencer toutes les semaines, le sp1 permet de corriger les failles d xpBises

Delphine · Answer

L2MFIX find log 1.04a These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnll] "Asynchronous"=dword:00000001 "DllName"="pmnll.dll" "Impersonate"=dword:00000000 "Logon"="Logon" "Logoff"="Logoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SideBySide] "Asynchronous"=dword:00000000 "DllName"="C:\WINDOWS\system32\kt2ul7f91.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ermsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtutq] "Asynchronous"=dword:00000001 "DllName"="C:\WINDOWS\System32\vtutq.dll" "Impersonate"=dword:00000000 "Startup"="SysLogon" "Logoff"="SysLogoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access AUTORITE NT\SYSTEM (IO) ALLOW Full access AUTORITE NT\SYSTEM (NI) ALLOW Full access AUTORITE NT\SYSTEM (IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-NI) ALLOW Read BUILTIN\Utilisateurs (ID-IO) ALLOW Read BUILTIN\Utilisateurs (ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-NI) ALLOW Full access BUILTIN\Administrateurs (ID-IO) ALLOW Full access BUILTIN\Administrateurs (ID-NI) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{1E254B80-0C20-EFB3-2629-7727F1801302}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Explorateur de Bureau" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{A4DF5659-0801-4A60-9607-1C48695EFDA9}"="Dossier de t‚l‚chargement Share-to-Web " "{704EAD88-4359-4B59-8305-120295C64CEC}"="" "{4FA01258-3D84-4EE2-9C5D-9C6E17406B99}"="" "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension" "{C967C46F-E8C8-4084-8FBC-948BFB9BDB6A}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{704EAD88-4359-4B59-8305-120295C64CEC}] @="" "IDEx"="ADDR" [HKEY_CLASSES_ROOT\CLSID\{704EAD88-4359-4B59-8305-120295C64CEC}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{704EAD88-4359-4B59-8305-120295C64CEC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{704EAD88-4359-4B59-8305-120295C64CEC}\InprocServer32] @="C:\WINDOWS\system32\meexcl40.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{4FA01258-3D84-4EE2-9C5D-9C6E17406B99}] @="" [HKEY_CLASSES_ROOT\CLSID\{4FA01258-3D84-4EE2-9C5D-9C6E17406B99}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{4FA01258-3D84-4EE2-9C5D-9C6E17406B99}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{4FA01258-3D84-4EE2-9C5D-9C6E17406B99}\InprocServer32] @="C:\WINDOWS\system32\myacm32.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{C967C46F-E8C8-4084-8FBC-948BFB9BDB6A}] @="" [HKEY_CLASSES_ROOT\CLSID\{C967C46F-E8C8-4084-8FBC-948BFB9BDB6A}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{C967C46F-E8C8-4084-8FBC-948BFB9BDB6A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{C967C46F-E8C8-4084-8FBC-948BFB9BDB6A}\InprocServer32] @="C:\WINDOWS\system32\guard.tmp" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ pncrt.dll Fri 16 Sep 2005 11:28:06 A.... 278.528 272,00 K pndx5016.dll Fri 16 Sep 2005 11:28:08 A.... 6.656 6,50 K pndx5032.dll Fri 16 Sep 2005 11:28:08 A.... 5.632 5,50 K rmoc3260.dll Fri 16 Sep 2005 11:28:10 A.... 122.880 120,00 K sirenacm.dll Thu 13 Oct 2005 8:11:06 A.... 118.784 116,00 K atmtd.dll Tue 25 Oct 2005 16:31:34 A.... 687.592 671,48 K vtutq.dll Thu 27 Oct 2005 20:35:42 ..... 540.692 528,02 K pmnll.dll Fri 28 Oct 2005 7:46:46 ..... 28.173 27,51 K rnched32.dll Sun 6 Nov 2005 8:35:36 ..S.R 235.958 230,43 K myacm32.dll Thu 10 Nov 2005 23:09:52 ..S.R 236.791 231,24 K kt2ul7~1.dll Thu 10 Nov 2005 21:58:58 ..S.R 236.791 231,24 K j80sli~1.dll Thu 10 Nov 2005 23:09:52 ..S.R 234.102 228,61 K jtp607~1.dll Thu 3 Nov 2005 9:44:42 ..S.R 236.867 231,31 K en66l1~1.dll Wed 9 Nov 2005 7:22:52 ..S.R 235.615 230,09 K c400le~1.dll Sun 6 Nov 2005 18:33:58 ..S.R 235.958 230,43 K multisz.dll Tue 30 Aug 2005 17:39:52 ..... 57.344 56,00 K twnlib20.dll Tue 30 Aug 2005 17:39:56 ..... 106.496 104,00 K picn20.dll Tue 30 Aug 2005 17:39:56 ..... 35.328 34,50 K imagx5.dll Tue 30 Aug 2005 17:39:56 ..... 532.480 520,00 K imagr5.dll Tue 30 Aug 2005 17:39:56 ..... 507.904 496,00 K imagxpr5.dll Tue 30 Aug 2005 17:39:56 ..... 275.312 268,86 K 21 items found: 21 files (7 H/S), 0 directories. Total of file sizes: 4.955.883 bytes 4,72 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ mcrh.tmp Thu 10 Nov 2005 21:57:52 A.... 285 0,28 K 1 item found: 1 file, 0 directories. Total of file sizes: 285 bytes 0,28 K ********************************************************************************** Directory Listing of system files: Le volume dans le lecteur C n'a pas de nom. Le num‚ro de s‚rie du volume est 150B-2B27 R‚pertoire de C:\WINDOWS\System32 10/11/2005 23:13 271.076 qtutv.ini 10/11/2005 23:09 236.791 myacm32.dll 10/11/2005 23:09 234.102 j80slid7180.dll 10/11/2005 21:58 236.791 kt2ul7f91.dll 10/11/2005 17:53 271.620 qtutv.bak2 09/11/2005 07:22 235.615 en66l1js1.dll 06/11/2005 18:33 235.958 c400ledm1h0a.dll 06/11/2005 08:35 235.958 rnched32.dll 03/11/2005 09:44 236.867 jtp6077se.dll 05/09/2005 18:24 Microsoft 21/08/2005 11:54 dllcache 9 fichier(s) 2.194.778 octets 2 R‚p(s) 30.252.580.864 octets libres

Utilisateur anonyme · Answer

ok,maintenant fais l option 2et ensuite les mises a jour, d accord?a+

Delphine · Answer

C'est fait, mais le virus est tjs là :(.

Utilisateur anonyme · Answer

oui je sais lol merciIl est la?C:\WINDOWS\System32\vtutq.dll ?1/fais tes mises a jour , met le sp22/remet un hijack thisa+

Delphine · Answer

Logfile of HijackThis v1.99.1Scan saved at 23:45:37, on 10/11/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXEC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\windat.exeC:\WINDOWS\cytob.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exeC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\AVPersonal\AVGNT.EXEC:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exeC:\WINDOWS\System32\RunDll32.exeC:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXEC:\Program Files\Real\RealPlayer\RealPlay.exeC:\WINDOWS\system32\srshost.exeC:\Program Files\a-squared\a2guard.exeC:\WINDOWS\System32undll32.exeC:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32undll32.exeC:\Documents and Settings\User\Local Settings\Temp\Répertoire temporaire 2 pour hijackthis_199.zip\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - C:\WINDOWS\System32\pmnll.dllO2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\System32\vtutq.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /minO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXEO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [Microsoft Windows System] srwhost.exeO4 - HKLM\..\RunServices: [Microsoft Windows System] srwhost.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [srshost.exe] C:\WINDOWS\system32\srshost.exeO4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/imloader.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{CABEDDDE-DFA8-49C3-8509-8BF4E3703FAC}: NameServer = 195.238.2.21 195.238.2.22O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\en0ol1d31.dllO20 - Winlogon Notify: pmnll - C:\WINDOWS\SYSTEM32\pmnll.dllO20 - Winlogon Notify: vtutq - C:\WINDOWS\System32\vtutq.dllO23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXEO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\U1lTVEVN\command.exe (file missing)O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exeO23 - Service: Windows Archiver (winarc) - Unknown owner - C:\WINDOWS\windat.exeO23 - Service: WindowsSysBoot - Unknown owner - C:\WINDOWS\cytob.exe

dlandenne@msn.com · Answer

Je refais les mises à jour: service pack 2

Utilisateur anonyme · Answer

bonjour,
oui service pack 1 ou service pack 2, au moins l un des deux !
Ensuite installe un pare feu comme zone alarm pour empecher les infections des que tu seras clean:
http://download.zonelabs.com/bin/free/3301_fr/zlsSetup_60_667_000.exe

Installe le ! (si generic host process demande a se connecter, accepte le !)

remet un hijack this

a+

TR/Dldr.Agent.YF - Page 2

Votre réponse

Discussions similaires

Newsletters