SVP besoin de votre aide pour log HJ

Question

Bonjour,Logfile of HijackThis v1.99.1Scan saved at 08:25:38, on 21/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\brss01a.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\WINDOWS\system32\Brmfrmps.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\VeriSign\NAVI
aviagent.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZONELABS\vsmon.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\igfxtray.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Progra~1\Launch Manager\LaunchAp.exeC:\Progra~1\Launch Manager\PowerKey.exeC:\Progra~1\Launch Manager\HotkeyApp.exeC:\Progra~1\Launch Manager\CtrlVol.exeC:\Progra~1\Launch Manager\Wbutton.exeC:\Program Files\Acer\Notebook Manager\almxptray.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\ltmoh\Ltmoh.exeC:\WINDOWS\system32undll32.exeC:\Program Files\AVPersonal\AVSched32.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Brother\ControlCenter2\brctrcen.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\system32\grgthijv.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\valérie morel\Mes documents\hijack this\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet ExplorerR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllF2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [LaunchApp] LaunAppO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exeO4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exeO4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exeO4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exeO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /minO4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exeO4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorunO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [System Services] grgthijv.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\RunServices: [System Services] grgthijv.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [System Services] grgthijv.exeO4 - HKCU\..\Run: [Mobipocket Reader Notifications] C:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeO4 - HKCU\..\RunServices: [System Services] grgthijv.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cabO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096014657414O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://stareat.it.helsinki.fi/activex/AMC.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {EB6D7E70-AAA9-40D9-BA05-F214089F2275} (Vitalize Class) - http://www.clickteam.com/vitalize3/vitalize.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: VeriSign Updater (navi) - Unknown owner - C:\Program Files\VeriSign\NAVI
aviagent.exe"  uimode=agentupdate (file missing)O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

^^Marie^^ · Answer

Bonjour,

la,nce ce scan et apres on avisera
Lance ce scan en ligne:
http://www.bitdefender.com/scan/licence.php
Copie/colle le rapport

fais pré-nettoyage avec
ewido (dowload)
http://www.ewido.net/fr/download/

dont tu colleras le rapport

A+

valy · Answer

B

---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 10:34:34, 22/01/2006
+ Somme de contrôle: 2469351F

+ Résultats du scan:

C:\Documents and Settings\valérie morel\Local Settings\Temp\Cookies\valérie morel@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@weborama[2].txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@estat[1].txt -> Spyware.Cookie.Estat : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@adtech[2].txt -> Spyware.Cookie.Adtech : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@as-eu.falkag[1].txt -> Spyware.Cookie.Falkag : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Nettoyer et sauvegarder
C:\Documents and Settings\valérie morel\Cookies\valérie morel@as1.falkag[2].txt -> Spyware.Cookie.Falkag : Nettoyer et sauvegarder

::Fin du rapport

valy · Answer

bonjour , voici la suite de ce que tu as demandée
Statistics

Time
02:32:33

Files
299500

Folders
4010

Boot Sectors
4

Archives
6892

Packed Files
32347

Results

Identified Viruses
3

Infected Files
10

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
10

Engines Info

Virus Definitions
252389

Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

Scan plugins
13

Archive plugins
39

Unpack plugins
4

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR
Infected with: Trojan.Swizzor.L

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR00
Infected with: Trojan.Downloader.Swizzor.DG

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR00
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR00
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR01
Infected with: Trojan.Downloader.Swizzor.DG

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR01
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR01
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR02
Infected with: Trojan.Downloader.Swizzor.DG

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR02
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR02
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR03
Infected with: Trojan.Downloader.Swizzor.DG

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR03
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR03
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR13
Infected with: Trojan.Lopad.G

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR13
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR13
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR14
Infected with: Trojan.Lopad.G

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR14
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR14
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR15
Infected with: Trojan.Lopad.G

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR15
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR15
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR16
Infected with: Trojan.Lopad.G

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR16
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR16
Deleted

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR17
Infected with: Trojan.Lopad.G

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR17
Disinfection failed

C:\Program Files\AVPersonal\INFECTED\film dumb.VIR17
Deleted

valy · Answer

Bonsoir,Après avoir exécuté ces actions, voici mon nouveau HJ, qu'en pensez-vous?Merci beaucoup de me consacrer un peu de votre tempsLogfile of HijackThis v1.99.1Scan saved at 19:44:27, on 26/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\brss01a.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\igfxtray.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Progra~1\Launch Manager\LaunchAp.exeC:\Progra~1\Launch Manager\PowerKey.exeC:\Progra~1\Launch Manager\HotkeyApp.exeC:\Progra~1\Launch Manager\CtrlVol.exeC:\Progra~1\Launch Manager\Wbutton.exeC:\Program Files\Acer\Notebook Manager\almxptray.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\ltmoh\Ltmoh.exeC:\WINDOWS\system32undll32.exeC:\Program Files\AVPersonal\AVSched32.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Brother\ControlCenter2\brctrcen.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\WINDOWS\system32\Brmfrmps.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\VeriSign\NAVI
aviagent.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZONELABS\vsmon.exeC:\Documents and Settings\valérie morel\Mes documents\hijack this\HijackThis.exeC:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet ExplorerR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllF2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [LaunchApp] LaunAppO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exeO4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exeO4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exeO4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exeO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /minO4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exeO4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorunO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [System Services] grgthijv.exeO4 - HKCU\..\Run: [Mobipocket Reader Notifications] C:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeO4 - HKCU\..\RunServices: [System Services] grgthijv.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cabO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096014657414O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://stareat.it.helsinki.fi/activex/AMC.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {EB6D7E70-AAA9-40D9-BA05-F214089F2275} (Vitalize Class) - http://www.clickteam.com/vitalize3/vitalize.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: VeriSign Updater (navi) - Unknown owner - C:\Program Files\VeriSign\NAVI
aviagent.exe"  uimode=agentupdate (file missing)O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

aranjuez31 · Answer

bsr

à mary : tu refuses ce combat à mener ? ya plein de bêtes

à valy : on continue un nettoyage avant l attaque

Télécharge ceci: (merci a S!RI pour ce petit programme).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
----------------------------------------------------------------------------
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

valy · Answer

Bonjour à Aranjuez et à tous
SmitFraudFix v2.15

Rapport fait à 10:42:58,65 le 28/01/2006
Executé à partir de C:\Documents and Settings\val‚rie morel\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\val‚rie morel\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

voici le 1er scan, je continue la suite des opérations

valy · Answer

voici la suite :

SmitFraudFix v2.15

Rapport fait à 14:41:53,05 le 28/01/2006
Executé à partir de C:\Documents and Settings\val‚rie morel\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

valy · Answer

etje refais un HT je ne sais pas s'il fallait mais bon!Logfile of HijackThis v1.99.1Scan saved at 18:39:24, on 28/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\brss01a.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\WINDOWS\system32\Brmfrmps.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\VeriSign\NAVI
aviagent.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZONELABS\vsmon.exeC:\WINDOWS\System32\igfxtray.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Progra~1\Launch Manager\LaunchAp.exeC:\Progra~1\Launch Manager\PowerKey.exeC:\Progra~1\Launch Manager\HotkeyApp.exeC:\Progra~1\Launch Manager\CtrlVol.exeC:\Progra~1\Launch Manager\Wbutton.exeC:\Program Files\Acer\Notebook Manager\almxptray.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\ltmoh\Ltmoh.exeC:\WINDOWS\system32undll32.exeC:\Program Files\AVPersonal\AVSched32.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Brother\ControlCenter2\brctrcen.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\valérie morel\Mes documents\hijack this\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet ExplorerR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllF2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [LaunchApp] LaunAppO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exeO4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exeO4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exeO4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exeO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /minO4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exeO4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorunO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [System Services] grgthijv.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\RunServices: [System Services] grgthijv.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [System Services] grgthijv.exeO4 - HKCU\..\Run: [Mobipocket Reader Notifications] C:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeO4 - HKCU\..\RunServices: [System Services] grgthijv.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cabO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096014657414O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://stareat.it.helsinki.fi/activex/AMC.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {EB6D7E70-AAA9-40D9-BA05-F214089F2275} (Vitalize Class) - http://www.clickteam.com/vitalize3/vitalize.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: VeriSign Updater (navi) - Unknown owner - C:\Program Files\VeriSign\NAVI
aviagent.exe"  uimode=agentupdate (file missing)O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

aranjuez31 · Answer

re
fixe ces lignes
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096014657414
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://stareat.it.helsinki.fi/activex/AMC.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {EB6D7E70-AAA9-40D9-BA05-F214089F2275} (Vitalize Class) - http://www.clickteam.com/vitalize3/vitalize.cab
-----------
scan online à nouveau et colle rapport
que je sache où j'en suis
http://www.bitdefender.fr/bd/site/search.php#
--------
m^me chose avec
http://assiste.free.fr/p/antivirus_gratuits_en_ligne/antivirus_en_ligne.php

valy · Answer

Bonjour,A Aranjuezj'ai fixé les lignes mais je ne peux pas faire bitdefender car service pack 2 détecté surmon ordiQuand à l'autre lien, il y a tout un tas d'antivirus quel est celui que je dois faire?Logfile of HijackThis v1.99.1Scan saved at 10:45:04, on 29/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\brss01a.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\igfxtray.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Progra~1\Launch Manager\LaunchAp.exeC:\Progra~1\Launch Manager\PowerKey.exeC:\Progra~1\Launch Manager\HotkeyApp.exeC:\Progra~1\Launch Manager\CtrlVol.exeC:\Progra~1\Launch Manager\Wbutton.exeC:\Program Files\Acer\Notebook Manager\almxptray.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\ltmoh\Ltmoh.exeC:\WINDOWS\system32undll32.exeC:\Program Files\AVPersonal\AVSched32.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Brother\ControlCenter2\brctrcen.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\WINDOWS\system32\Brmfrmps.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\VeriSign\NAVI
aviagent.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZONELABS\vsmon.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Documents and Settings\valérie morel\Mes documents\hijack this\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet ExplorerR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllF2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [LaunchApp] LaunAppO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exeO4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exeO4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exeO4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exeO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /minO4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exeO4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorunO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [System Services] grgthijv.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\RunServices: [System Services] grgthijv.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [System Services] grgthijv.exeO4 - HKCU\..\Run: [Mobipocket Reader Notifications] C:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeO4 - HKCU\..\RunServices: [System Services] grgthijv.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: VeriSign Updater (navi) - Unknown owner - C:\Program Files\VeriSign\NAVI
aviagent.exe"  uimode=agentupdate (file missing)O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

aranjuez31 · Answer

bjr
n'importe lequel sauf norton et ceux qui ne réparent pas, doc tu as choix entre panda , kaspresky, etc.......
il est peut être nécessaire de désactiver ton antivirus pendant la manip
il faut bien sur accepter les activeX pour que cela fonctionne

valy · Answer

reIncident                                                                        Statut                        Analyse                                                                                                                                                                                                                                                         Adware:adware/ist.yoursitebar                                                   No Désinfecté                 C:\WINDOWS\DOWNLOADED PROGRAM FILES\ysbactivex.inf                                                                                                                                                                                                              Adware:adware/wupd                                                              No Désinfecté                 C:\PROGRAM FILES\AdTools Service                                                                                                                                                                                                                                Adware:adware/transponder                                                       No Désinfecté                 C:\WINDOWS\inst                                                                                                                                                                                                                                                 Adware:adware/dyfuca                                                            No Désinfecté                 Registre Windows                                                                                                                                                                                                                                                Outil indésirable:Application/Processor                                         No Désinfecté                 C:\WINDOWS\system32\Process.exe                                                                                                                                                                                                                                 Adware:Adware/IST.YourSiteBar                                                   No Désinfecté                 C:\WINDOWS\Downloaded Program Files\ysbactivex.inf                                                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\All Users\Application Data\Ante Rule Idol Soap\Save wipe.exe                                                                                                                                                                          Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\All Users\Application Data\Ante Rule Idol Soap\errormath.exe                                                                                                                                                                          Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\All Users\Application Data\Ante Rule Idol Soap\deadstart.exe                                                                                                                                                                          Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\All Users\Application Data\Ante Rule Idol Soap\signokay.exe                                                                                                                                                                           Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\All Users\Application Data\Ante Rule Idol Soap\LINKJUNK.exe                                                                                                                                                                           Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\All Users\Application Data\Ante Rule Idol Soap\Buildinter.exe                                                                                                                                                                         Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\All Users\Application Data\Ante Rule Idol Soap\Glue Face.exe                                                                                                                                                                          Spyware:Cookie/Xiti                                                             No Désinfecté                 C:\Documents and Settings\valérie morel\Local Settings\Temp\Cookies\valérie morel@xiti[1].txt                                                                                                                                                                   Outil indésirable:Application/Processor                                         No Désinfecté                 C:\Documents and Settings\valérie morel\Bureau\SmitfraudFix\SmitfraudFix\Process.exe                                                                                                                                                                            Spyware:Cookie/Xiti                                                             No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@xiti[2].txt                                                                                                                                                                                       Spyware:Cookie/go                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@go[1].txt                                                                                                                                                                                         Spyware:Cookie/Belnk                                                            No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@belnk[1].txt                                                                                                                                                                                      Spyware:Cookie/Falkag                                                           No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@as1.falkag[2].txt                                                                                                                                                                                 Spyware:Cookie/Belnk                                                            No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@dist.belnk[2].txt                                                                                                                                                                                 Spyware:Cookie/24/7 Realmedia                                                   No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@247realmedia[1].txt                                                                                                                                                                               Spyware:Cookie/Weborama                                                         No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@weborama[1].txt                                                                                                                                                                                   Spyware:Cookie/fe.lea.lycos                                                     No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@fe.lea.lycos[1].txt                                                                                                                                                                               Spyware:Cookie/Zedo                                                             No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@zedo[2].txt                                                                                                                                                                                       Spyware:Cookie/Adtech                                                           No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@adtech[2].txt                                                                                                                                                                                     Spyware:Cookie/Ccbill                                                           No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@ccbill[2].txt                                                                                                                                                                                     Spyware:Cookie/Falkag                                                           No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@as-eu.falkag[1].txt                                                                                                                                                                               Spyware:Cookie/Falkag                                                           No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@sel.as-eu.falkag[1].txt                                                                                                                                                                           Spyware:Cookie/Casalemedia                                                      No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@casalemedia[1].txt                                                                                                                                                                                Spyware:Cookie/MetriWeb                                                         No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@metriweb[1].txt                                                                                                                                                                                   Spyware:Cookie/cs.sexcounter                                                    No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@cs.sexcounter[2].txt                                                                                                                                                                              Spyware:Cookie/Bluestreak                                                       No Désinfecté                 C:\Documents and Settings\valérie morel\Cookies\valérie morel@bluestreak[2].txt                                                                                                                                                                                 Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Application Data\hopemessbook\qwodvelv.exe                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Application Data\hopemessbook\iozowabi.exe                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Application Data\hopemessbook\ufutngue.exe                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Application Data\hopemessbook\btflathz.exe                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Application Data\hopemessbook
errhhgi.exe                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Application Data\hopemessbook\gugrmuto.exe                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Documents and Settings\valérie morel\Application Data\hopemessbook\ztjdqwfa.exe                                                                                                                                                                              Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR04                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR05                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR06                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR07                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR08                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR09                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR10                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR11                                                                                                                                                                                                            Adware:Adware/Lop                                                               No Désinfecté                 C:\Program Files\AVPersonal\INFECTED\film dumb.VIR12

aranjuez31 · Answer

bsr

tu vas charger ts ces prog, du moins ceux que tu nas pas,
les mettre à jour
les faire tous fonctionner

nettoyer réguliérement avec

Ad-Aware (gratuit) :
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/11643.html
Le patch en Français pour Ad-Aware (gratuit) :
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/25543.html

Spybot (gratuit) :
http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/26157.html

a-squared
http://www.emsisoft.net/fr/software/download/

ewido (dowload)
http://www.ewido.net/fr/download/

spycatcher express free
http://www.tenebril.com/downloads/

regcleaner ( nettoyeur de registre)
http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html

- et cleanup40 (nettoyeur de cookies+temps+tempos+prefetch+historique+etc..)
http://pageperso.aol.fr/balltrap34/democleanup.htm
¤Télécharger CleanUp40 (qui élimine les fichiers temporaires) sur ce lien : http://pageperso.aol.fr/Balltrap34/CleanUp40.exe
---------
aprés cela
t'en donnerai un autre pour rechercher + profondément

valy · Answer

voilà qui est fait jete poste le dernier HTLogfile of HijackThis v1.99.1Scan saved at 22:59:19, on 29/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\brss01a.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\igfxtray.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Progra~1\Launch Manager\LaunchAp.exeC:\Progra~1\Launch Manager\PowerKey.exeC:\Progra~1\Launch Manager\HotkeyApp.exeC:\Progra~1\Launch Manager\CtrlVol.exeC:\Progra~1\Launch Manager\Wbutton.exeC:\Program Files\Acer\Notebook Manager\almxptray.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\ltmoh\Ltmoh.exeC:\WINDOWS\system32undll32.exeC:\Program Files\AVPersonal\AVSched32.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Brother\ControlCenter2\brctrcen.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeC:\Program Files\AVPersonal\AVWUPSRV.EXEC:\WINDOWS\system32\Brmfrmps.exeC:\WINDOWS\system32\drivers\CDAC11BA.EXEC:\Program Files\VeriSign\NAVI
aviagent.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZONELABS\vsmon.exeC:\Program Files\SpyCatcher 2006\Scheduler daemon.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\RegCleaner\RegCleanr.exeC:\Documents and Settings\valérie morel\Mes documents\hijack this\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet ExplorerR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllF2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [LaunchApp] LaunAppO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exeO4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exeO4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exeO4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exeO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exeO4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /minO4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exeO4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorunO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [System Services] grgthijv.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminderO4 - HKLM\..\RunServices: [System Services] grgthijv.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [System Services] grgthijv.exeO4 - HKCU\..\Run: [Mobipocket Reader Notifications] C:\Program Files\Mobipocket.com\Mobipocket Readereadernotify.exeO4 - HKCU\..\RunServices: [System Services] grgthijv.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher 2006\Protector.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: interceptor.dllO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXEO23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXEO23 - Service: VeriSign Updater (navi) - Unknown owner - C:\Program Files\VeriSign\NAVI
aviagent.exe"  uimode=agentupdate (file missing)O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe te poste le dernier HT

aranjuez31 · Answer

re

Télécharge aussi ce prog:
http://cjoint.com/?bDoSfqKyPv
dezippe le sur le bureau et double clic sur rtksrchtest.bat
le bloc note va s'ouvrir, copie et colle le contenu ici.
(si le contenu de bloc note est vide, c'est qu'il ne detecte rien)

valy · Answer

Bonjour,

C:\WINDOWS\System32\TFTP???? Présent

!!! Attention, les fichiers qui suivent ne sont pas tous infect‚s !!!

C:\setup.exe

C:\WINDOWS\T2I
C:\WINDOWS\RegisteredPackages
C:\WINDOWS\stmchart.INI

C:\WINDOWS\System32\stmctrl.dll
C:\WINDOWS\System32\InsFiles
C:\WINDOWS\System32\TFTP280
C:\WINDOWS\System32\TFTP256
C:\WINDOWS\System32\i.pif
C:\WINDOWS\System32\TFTP1544

********************************************

aranjuez31 · Answer

bsrai qques difficultés à reconna^tre l ivraiehttp://www.virustotal.com/flash/index_en.htmlà l'aide ce lien, tu vas scanner ces lignes et me coller résultats

valy · Answer

re

C:\WINDOWS\System32\TFTP1544
Antivirus Version Update Result
AntiVir 6.33.0.81 01.30.2006 no virus found
Avast 4.6.695.0 01.30.2006 no virus found
AVG 718 01.30.2006 no virus found
Avira 6.33.0.81 01.30.2006 no virus found
BitDefender 7.2 01.30.2006 no virus found
CAT-QuickHeal 8.00 01.27.2006 (Suspicious) - DNAScan
ClamAV devel-20051123 01.30.2006 Trojan.Mybot-1485
DrWeb 4.33 01.30.2006 no virus found
eTrust-InoculateIT 23.71.63 01.29.2006 no virus found
eTrust-Vet 12.4.2060 01.30.2006 no virus found
Ewido 3.5 01.30.2006 no virus found
Fortinet 2.54.0.0 01.30.2006 no virus found
F-Prot 3.16c 01.30.2006 no virus found
Ikarus 0.2.59.0 01.30.2006 no virus found
Kaspersky 4.0.2.24 01.30.2006 no virus found
McAfee 4685 01.30.2006 no virus found
NOD32v2 1.1388 01.30.2006 no virus found
Norman 5.70.10 01.30.2006 GenericDrp
Panda 9.0.0.4 01.30.2006 Suspicious file
Sophos 4.02.0 01.30.2006 no virus found
Symantec 8.0 01.30.2006 no virus found
TheHacker 5.9.3.084 01.29.2006 no virus found
UNA 1.83 01.27.2006 Worm.P2P.SpyBot.cy
VBA32 3.10.5 01.30.2006 no virus found

This is a report processed by VirusTotal on 01/30/2006 at 19:29:31 (CET) after scanning the file "i.pif_" file.
Antivirus Version Update Result
AntiVir 6.33.0.81 01.30.2006 no virus found
Avast 4.6.695.0 01.30.2006 no virus found
AVG 718 01.30.2006 no virus found
Avira 6.33.0.81 01.30.2006 no virus found
BitDefender 7.2 01.30.2006 no virus found
CAT-QuickHeal 8.00 01.27.2006 no virus found
ClamAV devel-20051123 01.30.2006 no virus found
DrWeb 4.33 01.30.2006 no virus found
eTrust-InoculateIT 23.71.63 01.29.2006 no virus found
eTrust-Vet 12.4.2060 01.30.2006 no virus found
Ewido 3.5 01.30.2006 no virus found
Fortinet 2.54.0.0 01.30.2006 no virus found
F-Prot 3.16c 01.30.2006 no virus found
Ikarus 0.2.59.0 01.30.2006 no virus found
Kaspersky 4.0.2.24 01.30.2006 no virus found
McAfee 4685 01.30.2006 no virus found
NOD32v2 1.1388 01.30.2006 no virus found
Norman 5.70.10 01.30.2006 no virus found
Panda 9.0.0.4 01.30.2006 no virus found
Sophos 4.02.0 01.30.2006 no virus found
Symantec 8.0 01.30.2006 no virus found
TheHacker 5.9.3.084 01.29.2006 no virus found
UNA 1.83 01.27.2006 no virus found
VBA32 3.10.5 01.30.2006 no virus found
a
This is a report processed by VirusTotal on 01/30/2006 at 20:33:28 (CET) after scanning the file "stmctrl.dll" file.
Antivirus Version Update Result
AntiVir 6.33.0.81 01.30.2006 no virus found
Avast 4.6.695.0 01.30.2006 no virus found
AVG 718 01.30.2006 no virus found
Avira 6.33.0.81 01.30.2006 no virus found
BitDefender 7.2 01.30.2006 no virus found
CAT-QuickHeal 8.00 01.27.2006 no virus found
ClamAV devel-20051123 01.30.2006 no virus found
DrWeb 4.33 01.30.2006 no virus found
eTrust-InoculateIT 23.71.63 01.29.2006 no virus found
eTrust-Vet 12.4.2060 01.30.2006 no virus found
Ewido 3.5 01.30.2006 no virus found
Fortinet 2.54.0.0 01.30.2006 no virus found
F-Prot 3.16c 01.30.2006 no virus found
Ikarus 0.2.59.0 01.30.2006 no virus found
Kaspersky 4.0.2.24 01.30.2006 no virus found
McAfee 4685 01.30.2006 no virus found
NOD32v2 1.1388 01.30.2006 no virus found
Norman 5.70.10 01.30.2006 no virus found
Panda 9.0.0.4 01.30.2006 no virus found
Sophos 4.02.0 01.30.2006 no virus found
Symantec 8.0 01.30.2006 no virus found
TheHacker 5.9.3.084 01.29.2006 no virus found
UNA 1.83 01.27.2006 no virus found
VBA32 3.10.5 01.30.2006 no virus found

Pour tous les autres ca me fait

File size can't be more than 10 Megabytes.
You can't try compressing it.

j'sais pas quoi faire, TFTP 280 et 256 sont vides (0 octet) les autres je ne sais pas je ne les ai pas trouvés dans system 32

valy · Answer

Hello and help!

valy · Answer

up

SVP besoin de votre aide pour log HJ

27 réponses

Votre réponse

Discussions similaires

Newsletters