virus infection par Win32:Dialer-gen

Question

salut etant totalement noob ds ce domaines et apres 2 semaines de galere avec c virus Win32:dialer-gen pouvez vous m aider svp cela serait vraiment gentils de votre part g deja un hijack this:voila meri davance charleneLogfile of HijackThis v1.99.1Scan saved at 20:17:35, on 08/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\Program Files\Alwil Software\Avast4\aswUpdSv.exeD:\Program Files\Alwil Software\Avast4\ashServ.exeD:\WINDOWS\eHome\ehRecvr.exeD:\WINDOWS\eHome\ehSched.exeD:\WINDOWS\system32
vsvc32.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\system32\dllhost.exeD:\Program Files\Alwil Software\Avast4\ashMaiSv.exeD:\Program Files\Alwil Software\Avast4\ashWebSv.exeD:\WINDOWS\Explorer.EXED:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeD:\Program Files\MessengerPlus! 3\MsgPlus.exeD:\Program Files\Internet Explorer\iexplore.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\MSN Messenger\msnmsgr.exeD:\WINDOWS\system32svp.exeD:\Documents and Settings\ju\Bureau\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = free.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.generation-nt.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = free.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.generation-nt.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [find iso comp 16] D:\Documents and Settings\All Users\Application Data\phonewavefindiso\Bonecopy.exeO4 - HKLM\..\Run: [dmjmr.exe] D:\WINDOWS\system32\dmjmr.exeO4 - HKLM\..\Run: [yaemu.exe] D:\WINDOWS\system32\yaemu.exeO4 - HKCU\..\Run: [updateMgr] D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB0_0_0 -reboot 1O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb012YYFRO8 - Extra context menu item: Bloquer ce serveur... - d:\program files\avant browser\AddAllToADBlackList.htmO8 - Extra context menu item: Bloquer cette publicité... - d:\program files\avant browser\AddToADBlackList.htmO8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - d:\program files\avant browser\OpenInNewBrowser.htmO8 - Extra context menu item: Ouvrir tous les liens de la page... - d:\program files\avant browser\OpenAllLinks.htmO8 - Extra context menu item: Rechercher sur le Web... - d:\program files\avant browser\Search.htmO8 - Extra context menu item: Surligner - d:\program files\avant browser\Highlight.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=www.generation-nt.comO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cabO16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} - O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136556939625O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B562BC94-9A3A-4760-AE48-0D52FD01B1B5} (VeriSign Software Update Service) - http://download.verisign-grs.com/plug-in/i-navinstall.cabO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4598/mcfscan.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{307D37EE-3C22-4F08-B3FA-58023AC7A970}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD39C48-1003-4752-8BBF-B61D0FBCAF52}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{6950DA05-77F2-49B1-9025-A7D70587B266}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{EF0B0E51-2508-4396-B540-CAF3E97F7EAC}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CS1\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CS2\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: MCD - D:\WINDOWS\system32\l0r00a9med.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: fsbwsys - Unknown owner - D:\Program Files\F-Secure Anti-Virus\backweb\4476822\program\fsbwsys.exe (file missing)O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - D:\WINDOWS\system32\HPHipm11.exe

incognito02 · Answer

Bonsoir ,

Dans un premier temps, fait déja tout cela :

telecharge et execute ces antispywares ( pense a les mettre a jour avant de les lancer)
(1) ad-aware version 1.06

(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite
voir demo
http://pageperso.aol.fr/balltrap34/adwseflash.zip

***

(2) spybot version 1.4

(ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite

voir demo d utilisation
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

***

(3) a2

http://www.emsisoft.net/fr/
penser a le metre a jour avant de scanner le pc
***
ps : un grand merci a balltrap pour les lien :)

(4) Edwido
http://download.ewido.net/ewido-setup.exe
Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour.

Clique sur scanner puis sur scan complet du système.

(5)SmitfraudFix

http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

(6) Relance hijackthis et colle le log ici stp.

Bon courage

A+

sharshar · Answer

salut je vien de voir ke tu propose une solution c cool de passer du temps pour nous les incultes de la micro.je teste tout ce ke tu ma dit et je poserai les logs ds lapresmidi je pense merci encore

sharshar · Answer

salut incognito g telecharger a² il me dit que le fichier smitfraudfix que tu ma dit de dl est un malware est ce normal?

sharshar · Answer

merci actuellemen janalyse avec ewidoo il me trouve plein de cochonneries ensuite je pose mes log ou je passe un spy sweeper dabord?

aranjuez31 · Answer

bjr tu nettoies un max avant

sharshar · Answer

re: voila les gars jaie suivi e les etapes de a à z jespere que ca va marcher voici le rapport de smitfraudfix:
SmitFraudFix v2.13

Rapport fait à 14:41:12,34 le 09/01/2006
Executé à partir de D:\Documents and Settings\ju\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\

»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS

D:\WINDOWS\inet20099\ PRESENT!

»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS\system32

D:\WINDOWS\system32\yaemu.exe PRESENT !
D:\WINDOWS\system32\z14.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\Documents and Settings\ju\Application Data

D:\Documents and Settings\ju\Application Data\Install.dat PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"
"{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}"="OutPost FireWall"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

sharshar · Answer

encore moi ^^ jai le log que tu ma demander incognito voila:Logfile of HijackThis v1.99.1Scan saved at 14:45:53, on 09/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\Program Files\Alwil Software\Avast4\aswUpdSv.exeD:\Program Files\Alwil Software\Avast4\ashServ.exeD:\WINDOWS\eHome\ehRecvr.exeD:\WINDOWS\eHome\ehSched.exeD:\WINDOWS\system32
vsvc32.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\system32\dllhost.exeD:\Program Files\Alwil Software\Avast4\ashMaiSv.exeD:\Program Files\Alwil Software\Avast4\ashWebSv.exeD:\WINDOWS\system32undll32.exeD:\WINDOWS\Explorer.EXED:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeD:\Program Files\MessengerPlus! 3\MsgPlus.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\ewido anti-malware\ewidoctrl.exeD:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeD:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Documents and Settings\ju\Bureau\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = free.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.generation-nt.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = free.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.generation-nt.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [find iso comp 16] D:\Documents and Settings\All Users\Application Data\phonewavefindiso\Bonecopy.exeO4 - HKLM\..\Run: [dmjxx.exe] D:\WINDOWS\system32\dmjxx.exeO4 - HKLM\..\Run: [yaemu.exe] D:\WINDOWS\system32\yaemu.exeO4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - HKCU\..\Run: [updateMgr] D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB0_0_0 -reboot 1O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb012YYFRO8 - Extra context menu item: Bloquer ce serveur... - d:\program files\avant browser\AddAllToADBlackList.htmO8 - Extra context menu item: Bloquer cette publicité... - d:\program files\avant browser\AddToADBlackList.htmO8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - d:\program files\avant browser\OpenInNewBrowser.htmO8 - Extra context menu item: Ouvrir tous les liens de la page... - d:\program files\avant browser\OpenAllLinks.htmO8 - Extra context menu item: Rechercher sur le Web... - d:\program files\avant browser\Search.htmO8 - Extra context menu item: Surligner - d:\program files\avant browser\Highlight.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=www.generation-nt.comO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136556939625O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B562BC94-9A3A-4760-AE48-0D52FD01B1B5} (VeriSign Software Update Service) - http://download.verisign-grs.com/plug-in/i-navinstall.cabO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4598/mcfscan.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{307D37EE-3C22-4F08-B3FA-58023AC7A970}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD39C48-1003-4752-8BBF-B61D0FBCAF52}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{6950DA05-77F2-49B1-9025-A7D70587B266}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{EF0B0E51-2508-4396-B540-CAF3E97F7EAC}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CS1\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CS2\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO20 - Winlogon Notify: ShellServiceObjectDelayLoad - D:\WINDOWS\system32\gp06l3ds1.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: fsbwsys - Unknown owner - D:\Program Files\F-Secure Anti-Virus\backweb\4476822\program\fsbwsys.exe (file missing)O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - D:\WINDOWS\system32\HPHipm11.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

sharshar · Answer

personne ne peut maider?c vraiment enbetant c machin la je me demande si ya une solution...

sharshar · Answer

jte remercie du fon du coeur car cela fait maintenant 2 semaines ke mon pc me fait peter un cable jessaye tt de suite et je re apres jespere ke ca va marcher!!!!!!

aranjuez31 · Answer

re
mais si

mais à l'heure du thé on soufle un peu !!!

fixe ceci
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.generation-nt.com
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb012YYFR
puis encore
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136556939625
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B562BC94-9A3A-4760-AE48-0D52FD01B1B5} (VeriSign Software Update Service) - http://download.verisign-grs.com/plug-in/i-navinstall.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4598/mcfscan.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
et les ukrainiens
O17 - HKLM\System\CCS\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{307D37EE-3C22-4F08-B3FA-58023AC7A970}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD39C48-1003-4752-8BBF-B61D0FBCAF52}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{6950DA05-77F2-49B1-9025-A7D70587B266}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF0B0E51-2508-4396-B540-CAF3E97F7EAC}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CS2\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165
et j'en laisse à inco
c'etait pour te faire patienter

sharshar · Answer

voila mon hijack this escuz arenjuez mais je scannait le pc et g effacer d truks regarde mon new hijack si tu peu merci davance!!!Logfile of HijackThis v1.99.1Scan saved at 16:24:31, on 09/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Alwil Software\Avast4\aswUpdSv.exeD:\Program Files\Alwil Software\Avast4\ashServ.exeD:\WINDOWS\eHome\ehRecvr.exeD:\WINDOWS\Explorer.EXED:\WINDOWS\eHome\ehSched.exeD:\Program Files\ewido anti-malware\ewidoctrl.exeD:\WINDOWS\system32
vsvc32.exeD:\WINDOWS\system32\svchost.exeD:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeD:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeD:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeD:\WINDOWS\system32\dllhost.exeD:\Program Files\Alwil Software\Avast4\ashMaiSv.exeD:\Program Files\Alwil Software\Avast4\ashWebSv.exeD:\WINDOWS\system32\wuauclt.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Documents and Settings\ju\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.generation-nt.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [find iso comp 16] D:\Documents and Settings\All Users\Application Data\phonewavefindiso\Bonecopy.exeO4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb012YYFRO8 - Extra context menu item: Bloquer ce serveur... - d:\program files\avant browser\AddAllToADBlackList.htmO8 - Extra context menu item: Bloquer cette publicité... - d:\program files\avant browser\AddToADBlackList.htmO8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - d:\program files\avant browser\OpenInNewBrowser.htmO8 - Extra context menu item: Ouvrir tous les liens de la page... - d:\program files\avant browser\OpenAllLinks.htmO8 - Extra context menu item: Rechercher sur le Web... - d:\program files\avant browser\Search.htmO8 - Extra context menu item: Surligner - d:\program files\avant browser\Highlight.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=www.generation-nt.comO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136556939625O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B562BC94-9A3A-4760-AE48-0D52FD01B1B5} (VeriSign Software Update Service) - http://download.verisign-grs.com/plug-in/i-navinstall.cabO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4598/mcfscan.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD39C48-1003-4752-8BBF-B61D0FBCAF52}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{6950DA05-77F2-49B1-9025-A7D70587B266}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CCS\Services\Tcpip\..\{EF0B0E51-2508-4396-B540-CAF3E97F7EAC}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CS1\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O17 - HKLM\System\CS2\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: Dynamic Directory - D:\WINDOWS\system32\p6n8lg5u16.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: fsbwsys - Unknown owner - D:\Program Files\F-Secure Anti-Virus\backweb\4476822\program\fsbwsys.exe (file missing)O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - D:\WINDOWS\system32\HPHipm11.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Kristopher · Answer

re :)

Tu as effectué la manip que je t'ai dis de faire tout à l'heure ?

Il reste à fixer ces lignes :

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb012YYFR
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136556939625
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B562BC94-9A3A-4760-AE48-0D52FD01B1B5} (VeriSign Software Update Service) - http://download.verisign-grs.com/plug-in/i-navinstall.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4598/mcfscan.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD39C48-1003-4752-8BBF-B61D0FBCAF52}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{6950DA05-77F2-49B1-9025-A7D70587B266}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF0B0E51-2508-4396-B540-CAF3E97F7EAC}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CS1\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165
O17 - HKLM\System\CS2\Services\Tcpip\..\{107CCC1D-B77C-4F8E-AD8C-C1B80F95C7A6}: NameServer = 85.255.116.117,85.255.112.165

Bon courage

++

sharshar · Answer

re: merci de maider encore une fois jaurai jamais reussi tt seul.j ai fixer les lignes que tu ma dit maintenant voila mon nouveau hijack est ce quil en reste?Logfile of HijackThis v1.99.1Scan saved at 16:34:06, on 09/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Alwil Software\Avast4\aswUpdSv.exeD:\Program Files\Alwil Software\Avast4\ashServ.exeD:\WINDOWS\eHome\ehRecvr.exeD:\WINDOWS\Explorer.EXED:\WINDOWS\eHome\ehSched.exeD:\Program Files\ewido anti-malware\ewidoctrl.exeD:\WINDOWS\system32
vsvc32.exeD:\WINDOWS\system32\svchost.exeD:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeD:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeD:\Program Files\Internet Explorer\iexplore.exeD:\WINDOWS\system32\dllhost.exeD:\Program Files\Alwil Software\Avast4\ashMaiSv.exeD:\Program Files\Alwil Software\Avast4\ashWebSv.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Documents and Settings\ju\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [find iso comp 16] D:\Documents and Settings\All Users\Application Data\phonewavefindiso\Bonecopy.exeO4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO8 - Extra context menu item: Bloquer ce serveur... - d:\program files\avant browser\AddAllToADBlackList.htmO8 - Extra context menu item: Bloquer cette publicité... - d:\program files\avant browser\AddToADBlackList.htmO8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - d:\program files\avant browser\OpenInNewBrowser.htmO8 - Extra context menu item: Ouvrir tous les liens de la page... - d:\program files\avant browser\OpenAllLinks.htmO8 - Extra context menu item: Rechercher sur le Web... - d:\program files\avant browser\Search.htmO8 - Extra context menu item: Surligner - d:\program files\avant browser\Highlight.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=www.generation-nt.comO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: Dynamic Directory - D:\WINDOWS\system32\p6n8lg5u16.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: fsbwsys - Unknown owner - D:\Program Files\F-Secure Anti-Virus\backweb\4476822\program\fsbwsys.exe (file missing)O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - D:\WINDOWS\system32\HPHipm11.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Kristopher · Answer

Salut,

Est ce que tu as effectué la manip. du poste < 10 > ?

-Scanne ton PC avec cet antivirus en ligne : http://www.pandasoftware.com/activescan/fr/activescan_principal.htm
Copie/colle le résultat sur le forum.

++

sharshar · Answer

super!!!! les gars mon avast est rester trankill 20min depuis 2semaines il doit reprendre sont souffle lol;donc apparemment plus de virus mais tjs d pubs(moins)et spysweeper detecte un programme ki veut se lancer au demarrage dmdwo.exe c koi cte bestiole?merci encore les gars

sharshar · Answer

no je nai pas effectuer la manip du poste 10 g passer smartfraud fix et spysweeper en mode sans echecs fixer les lignes ke tu ma dit vider cookies temp etc...

Kristopher · Answer

salut,no je nai pas effectuer la manip du poste 10 g passer smartfraud fix et spysweeper en mode sans echecs fixer les lignes ke tu ma dit vider cookies temp etc...c'est dommage parce que CCLEANER t'aurait bien nettoyé le PC......apparemment plus de virus mais tjs d pubs(moins)et spysweeper detecte un programme ki veut se lancer au demarrage dmdwo.exe c koi cte bestiole?scannes ton PC avec BitDefender en ligne : http://www.bitdefender.fr/scan/license.phpCopie/Colle le rapport sur le forum.++

sharshar · Answer

g nettoye tout ca avec ccleaner justement tout a lheure tu ma dit de scanner avec panda g installe active scan et avast me dit ke c un virus c normal? bon je fait une analyse avec bitdefender alors???

sharshar · Answer

ok c sympa daider les autres comme ca tu fait koi ds la vie?a++ pour en finir avec cette histoire^^

sharshar · Answer

nouveau log si vous pouvez jeter un coup doeil ca serait super cool merci davance bisous^^Logfile of HijackThis v1.99.1Scan saved at 18:54:52, on 09/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\Program Files\Alwil Software\Avast4\aswUpdSv.exeD:\Program Files\Alwil Software\Avast4\ashServ.exeD:\WINDOWS\eHome\ehRecvr.exeD:\WINDOWS\eHome\ehSched.exeD:\Program Files\ewido anti-malware\ewidoctrl.exeD:\WINDOWS\system32
vsvc32.exeD:\WINDOWS\system32\svchost.exeD:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeD:\WINDOWS\Explorer.EXED:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeD:\WINDOWS\system32\dllhost.exeD:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeD:\Program Files\Alwil Software\Avast4\ashMaiSv.exeD:\WINDOWS\system32undll32.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Alwil Software\Avast4\ashWebSv.exed:\progra~1\intern~1\iexplore.exeD:\Documents and Settings\ju\Bureau\eMule\emule.exeD:\Program Files\ewido anti-malware\SecuritySuite.exeD:\Program Files\Internet Explorer\iexplore.exeD:\Documents and Settings\ju\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO8 - Extra context menu item: Bloquer ce serveur... - d:\program files\avant browser\AddAllToADBlackList.htmO8 - Extra context menu item: Bloquer cette publicité... - d:\program files\avant browser\AddToADBlackList.htmO8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - d:\program files\avant browser\OpenInNewBrowser.htmO8 - Extra context menu item: Ouvrir tous les liens de la page... - d:\program files\avant browser\OpenAllLinks.htmO8 - Extra context menu item: Rechercher sur le Web... - d:\program files\avant browser\Search.htmO8 - Extra context menu item: Surligner - d:\program files\avant browser\Highlight.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=www.generation-nt.comO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: Uninstall - D:\WINDOWS\system32\h4n0le5m1h.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: fsbwsys - Unknown owner - D:\Program Files\F-Secure Anti-Virus\backweb\4476822\program\fsbwsys.exe (file missing)O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - D:\WINDOWS\system32\HPHipm11.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

sharshar · Answer

voila grace a vous g reussi a enlever les[trj]mais persiste tjs les meme pubs qui saffiche voila le rapport smitfraudfix:SmitFraudFix v2.13Rapport fait à 19:00:28,17 le 09/01/2006Executé à partir de D:\Documents and Settings\ju\Bureau\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\WINDOWS\system32»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\Documents and Settings\ju\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau»»»»»»»»»»»»»»»»»»»»»»»» Recherche D:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau  »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui""{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

incognito02 · Answer

Bonsoir Sharshar,Salut Kristopher :-))Si ça ne va pas mieux, reposte un log hijackthis.Kristopher, je pense que c'est la O20 qui pose problème.A+

incognito02 · Answer

Exactement, tu deviens un pro !A+

aranjuez31 · Answer

bsrsuis du même avis pour 02 et l2mfixai aussi un sérieux doute quant à la legitimité deO14 - IERESET.INF: START_PAGE_URL=www.generation-nt.com

sharshar · Answer

re les gars merci  pour avoir effacer les virus de mon poste!!!mais comme une bonne nouvelle narrive jamais sans une mauvaise:maintenant mon pc redemarre tout seul et a chaque demarrage windows me dit que winlogon.exe a rencontrer un pb et doit fermer dou cela peut venir?ah oui il reste ausi 2 3 pub ki saffiche de temps en temps mais rien de grave^^voila en attendant une reponse de votre part.cordialement lol SharshaR

sharshar · Answer

Logfile of HijackThis v1.99.1Scan saved at 12:50:45, on 10/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\system32undll32.exeD:\Program Files\Alwil Software\Avast4\aswUpdSv.exeD:\Program Files\Alwil Software\Avast4\ashServ.exeD:\WINDOWS\eHome\ehRecvr.exeD:\WINDOWS\Explorer.EXED:\WINDOWS\eHome\ehSched.exeD:\Program Files\ewido anti-malware\ewidoctrl.exeD:\WINDOWS\system32
vsvc32.exeD:\WINDOWS\system32\svchost.exeD:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeD:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeD:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeD:\WINDOWS\system32undll32.exeD:\WINDOWS\system32\dllhost.exeD:\Program Files\Alwil Software\Avast4\ashMaiSv.exeD:\Program Files\Alwil Software\Avast4\ashWebSv.exeD:\Documents and Settings\ju\Bureau\eMule\emule.exeD:\Documents and Settings\ju\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://free.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO8 - Extra context menu item: Bloquer ce serveur... - d:\program files\avant browser\AddAllToADBlackList.htmO8 - Extra context menu item: Bloquer cette publicité... - d:\program files\avant browser\AddToADBlackList.htmO8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - d:\program files\avant browser\OpenInNewBrowser.htmO8 - Extra context menu item: Ouvrir tous les liens de la page... - d:\program files\avant browser\OpenAllLinks.htmO8 - Extra context menu item: Rechercher sur le Web... - d:\program files\avant browser\Search.htmO8 - Extra context menu item: Surligner - d:\program files\avant browser\Highlight.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\PROGRA~1\COPERN~1\COPERN~1.EXEO9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=www.generation-nt.comO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: DateTime - D:\WINDOWS\system32\k6js0g17e6.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: fsbwsys - Unknown owner - D:\Program Files\F-Secure Anti-Virus\backweb\4476822\program\fsbwsys.exe (file missing)O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPH11 - HP - D:\WINDOWS\system32\HPHipm11.exeO23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

sharshar · Answer

salut boulepate!!! en effet mais g limpression qu il reste d traces c un virus tu croit??

sharshar · Answer

g vu dans le log kil restait d traces de McAfee alor ke je l es desinstalle comme f secure

sharshar · Answer

re dans services.msc il y a une ligne mcafee mais en clikant droit je ne peu queffectuer demarrer la service et non pas arreter et dans msconfig il y a mcafee ke g decocher mais pa de ligne avec fsecure????je suis perdu

sharshar · Answer

apres avoir decocher la case mcafee spysweeper me detecte un nouveau prog qui sexecute au demarrage cest MSconfig c koi?

sharshar · Answer

ok je croit que c bon, au demarage windows ma demander si je voulait revenir au mode de demarrage normal, g mis oui,est-ce que j'ai bien fait?il me rste un spam je croit ;-]

sharshar · Answer

re au fait,comment on fait pour effacer le 2eme poste que g fait?

sharshar · Answer

voila g desactiver f-secure qui sappelait(la ligne):fsbwbdepuis plu de spam que mon conseille tu Ô toi grand manitou de linformatique(ta pris d cours du soir ou koi?)

Virus infection par Win32:Dialer-gen

33 réponses

Discussions similaires

Newsletters