Victime de browsela...

Question

Bonjour!Je suis infecté par browsela, Norton n'arrive pas à s'en débarasser; au secours!Je suis sous XP, Hijackthis log ci-après:Logfile of HijackThis v1.99.1Scan saved at 14:14:33, on 19/02/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\WINDOWS\SGFucyAmIFJvb3M\command.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Network Monitor
etmon.exeC:\Program Files\Norton Internet Security\NISUM.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\System32\RunDll32.exeC:\WINDOWS\mHotkey.exeC:\WINDOWS\Dit.exeC:\Program Files\Home Cinema\PowerCinema\PCMService.exeC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\Norton Internet Security\IAMAPP.EXEC:\WINDOWS\kdx\KHost.exeC:\PROGRA~1\MI948F~1\GAMECO~1\common\swtrayv4.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Vlcd\Lnnbb.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\Program Files\Norton Internet Security\NISSERV.EXEC:\Program Files\Java\jre1.5.0_01\bin\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Norton Internet Security\SymProxySvc.exeC:\windows\winsysban9.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Skype\Phone\Skype.exeC:\PROGRA~1\COMMON~1\SCURIT~1\winword.exeC:\Tbridge\Flatbed.exeC:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exeC:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32?gsvr32.exeC:\Program Files\Norton Internet Security\ATRACK.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\Documents and Settings\Hans & Roos\Local Settings\Temporary Internet Files\Content.IE5\FMB3FJI4\HijackThis[2].exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {FA90358E-F61C-AE99-1E81-F55A623C17BE} - C:\WINDOWS\System32\bavehtu.dllO2 - BHO: (no name) - {FA90358E-F61C-AE99-1E81-F55A623C17BE} - C:\WINDOWS\System32\bavehtu.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dllO3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [CHotkey] mHotkey.exeO4 - HKLM\..\Run: [ledpointer] CNYHKey.exeO4 - HKLM\..\Run: [Dit] Dit.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXEO4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exeO4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MI948F~1\GAMECO~1\common\swtrayv4.exeO4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exeO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [Jdlyylfw] C:\Program Files\Vlcd\Lnnbb.exeO4 - HKLM\..\Run: [u0ÔÁß]§ú"ü‰üžigÝY] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [¢‰¸K0Ô@ÔÁß]§ú"ü‰üžiC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [¢‰¸K0ÔÁß]§ú"ü‰üžigÝC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [¢‰¸K0ÔÁß]§ú"ü‰»1÷ÕçC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd9.exeO4 - HKLM\..\Run: [winsysban] C:\windows\winsysban9.exeO4 - HKLM\..\Run: [gimmygames] C:\gimmygames9.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [Udot] "C:\PROGRA~1\COMMON~1\SCURIT~1\winword.exe" -vt mtO4 - HKCU\..\Run: [Hztecx] C:\WINDOWS\System32?gsvr32.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Detector.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exeO8 - Extra context menu item: &Search - http://bar.mytotalsearch.com/menusearch.html?p=CPXXXXXX59O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar3.dll/cmcache.htmlO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dllO12 - Plugin for .fpx: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dllO12 - Plugin for .ivr: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dllO15 - Trusted Zone: *.flingstone.comO15 - Trusted Zone: *.i-lookup.comO15 - Trusted Zone: *.offshoreclicks.comO15 - Trusted Zone: *.teensguru.comO15 - Trusted Zone: *.xxxtoolbar.comO16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cabO16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cabO16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://fr.encyclopedia.yahoo.com/rsc/tdserver.cabO16 - DPF: {22945A69-1191-4DCF-9E6F-409BDE94D101} - http://www.solidworks.com/plugins/edrawings/download.cfm?Release=relO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cabO16 - DPF: {511F9316-771B-4953-A268-1C36DA667FE9} - http://ip.sponsoradulto.com/cab/3/fr/SysWebTelecomInt.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/2821fd5ae350f9e3a216/netzip/RdxIE601_fr.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cabO16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cabO20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dllO20 - Winlogon Notify: Explorer - C:\WINDOWS\system32	48u0el9ehq.dllO20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\azaq0395e.dllO20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\jtju0719e.dll (file missing)O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\azaq0395e.dllO20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\wbpdxm.dll (file missing)O20 - Winlogon Notify: winilr32 - C:\WINDOWS\SYSTEM32\winilr32.dllO23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: Cdr4nox - Unknown owner - (no file)O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SGFucyAmIFJvb3M\command.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor
etmon.exeO23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXEO23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeMerci à celui qui peux m'aider!

Kristopher · Answer

Bonjour,

~~ Effectue ces manipulations dans l'ordre ~~

1/ Lance HijackThis, puis -> Do a system scan only et
coche ces lignes :

O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://fr.encyclopedia.yahoo.com/rsc/tdserver.cab
O16 - DPF: {22945A69-1191-4DCF-9E6F-409BDE94D101} - http://www.solidworks.com/plugins/edrawings/download.cfm?Release=rel
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {511F9316-771B-4953-A268-1C36DA667FE9} - http://ip.sponsoradulto.com/cab/3/fr/SysWebTelecomInt.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/2821fd5ae350f9e3a216/netzip/RdxIE601_fr.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

Ensuite, clique sur "Fix checked".

2/ Télécharge le logiciel SmitfraudFix crée par les pros de ce forum :
http://siri.urz.free.fr/Fix/SmitfraudFix.zip et décompresse le.

Lance les 3 options, comme indiqué sur cette page :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

3/ Télécharge l2mfix :
http://www.downloads.subratam.org/l2mfix.exe
Double clic sur l2mfix.exe pour lancer l'extraction.
Dans le dossier l2mfix, double clic sur l2mfix.bat, appuie sur n'importe quelle touche puis choisis l'option #1 (et pas autre chose) et valide avec la touche "Entrée".
Le bloc note va s'ouvrir avec le résultat du scan.
Copie/colle le rapport sur le forum stp.

Hans2210 · Answer

2ème scan: log.txt dans l2mfix:L2mfix 010406Creating Account.La commande s'est termin‚e correctement.Adding Administrative privleges. Checking for L2MFix account(0=no 1=yes): 1 Granting SeDebugPrivilege to L2MFIX   ... successfulChecking for L2MFix account(0=no 1=yes): 0Zipping up files for submission:	zip warning: name not matched: dlls\*.*zip error: Nothing to do! (backup.zip)updating: backregs/notibac.reg (232 bytes security)2ème Hijackthis scan: Logfile of HijackThis v1.99.1Scan saved at 16:33:36, on 19/02/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32undll32.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\System32\RunDll32.exeC:\WINDOWS\mHotkey.exeC:\WINDOWS\CNYHKey.exeC:\WINDOWS\Dit.exeC:\Program Files\Home Cinema\PowerCinema\PCMService.exeC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\Norton Internet Security\IAMAPP.EXEC:\WINDOWS\kdx\KHost.exeC:\PROGRA~1\MI948F~1\GAMECO~1\common\swtrayv4.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Vlcd\Lnnbb.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\Program Files\Java\jre1.5.0_01\bin\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Skype\Phone\Skype.exeC:\PROGRA~1\COMMON~1\SCURIT~1\winword.exeC:\WINDOWS\System32?gsvr32.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\WINDOWS\SGFucyAmIFJvb3M\command.exeC:\WINDOWS\alt.exeC:\Tbridge\Flatbed.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Network Monitor
etmon.exeC:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exeC:\Program Files\Norton Internet Security\NISUM.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Norton Internet Security\SymProxySvc.exeC:\Program Files\Norton Internet Security\NISSERV.EXEC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\iPod\bin\iPodService.exeC:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeC:\WINDOWS\System32\wuauclt.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\WINDOWS\system32\NOTEPAD.EXEC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings\All Users\Documents\Antivirus\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {FA90358E-F61C-AE99-1E81-F55A623C17BE} - C:\WINDOWS\System32\bavehtu.dllO2 - BHO: (no name) - {FA90358E-F61C-AE99-1E81-F55A623C17BE} - C:\WINDOWS\System32\bavehtu.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dllO3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [CHotkey] mHotkey.exeO4 - HKLM\..\Run: [ledpointer] CNYHKey.exeO4 - HKLM\..\Run: [Dit] Dit.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXEO4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exeO4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MI948F~1\GAMECO~1\common\swtrayv4.exeO4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exeO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [Jdlyylfw] C:\Program Files\Vlcd\Lnnbb.exeO4 - HKLM\..\Run: [u0ÔÁß]§ú"ü‰üžigÝY] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [¢‰¸K0Ô@ÔÁß]§ú"ü‰üžiC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [¢‰¸K0ÔÁß]§ú"ü‰üžigÝC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [¢‰¸K0ÔÁß]§ú"ü‰»1÷ÕçC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\iixbdtq.exeO4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [gimmygames] C:\gimmygames9.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [Udot] "C:\PROGRA~1\COMMON~1\SCURIT~1\winword.exe" -vt mtO4 - HKCU\..\Run: [Hztecx] C:\WINDOWS\System32?gsvr32.exeO4 - HKCU\..\Run: [AlexaToolbar] C:\WINDOWS\alt.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Detector.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exeO8 - Extra context menu item: &Search - http://bar.mytotalsearch.com/menusearch.html?p=CPXXXXXX59O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar3.dll/cmcache.htmlO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dllO12 - Plugin for .fpx: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dllO12 - Plugin for .ivr: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dllO20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dllO20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\jtju0719e.dll (file missing)O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\k6nolg5316.dllO20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\wbpdxm.dll (file missing)O20 - Winlogon Notify: winilr32 - C:\WINDOWS\SYSTEM32\winilr32.dllO23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: Cdr4nox - Unknown owner - (no file)O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SGFucyAmIFJvb3M\command.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor
etmon.exeO23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISSERV.EXEO23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\SymProxySvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeAlors, docteur?

Victime de browsela...

2 réponses

Votre réponse

Discussions similaires

Newsletters