troyens dans mon pc Fermé

Question

salut à tous j'ai un petit souci mon pc est infectéwindows xp sp1sygate firewalnorton 2005je vous met le log d'hidjack thismerci de votre aide ogfile of HijackThis v1.99.1Scan saved at 20:19:30, on 20/02/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Sygate\SPF\smc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\ATK0100\Hcontrol.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\AGRSMMSG.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\System32\wdfmgr.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Java\jre1.5.0\bin\jusched.exeC:\WINDOWS\ATK0100\ATKOSD.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\System32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Winamp\winampa.exeC:\WINDOWS\System32\wbem\wmiprvse.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exeC:\Program Files\Asus\Asus ChkMail\ChkMail.exeC:\Program Files\Asus\ASUS Hotkey\Hotkey.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINDOWS\explorer.exeC:\WINDOWS\System32\msiexec.exeC:\WINDOWS\System32\wuauclt.exeC:\Documents and Settings\Jul\Bureau\HijackThis.exeC:\WINDOWS\System32\wuauclt.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com.twR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Jul\LOCALS~1\Temp\sp.dll/sp.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.free.fr/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Progra~1\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exeO4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1O4 - HKLM\..\Run: [ATIPTA] C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startguiO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exeO4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.twO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Kristopher · Answer

Salut,Pour commencer :- Scanne ton PC avec cet antivirus en ligne :http://www.bitdefender.com/scan8/ie.htmlClique sur "I Agree" et scanne tout le PC.Copie/colle le rapport sur le forum.Pense à accepter l'ActiveX bloqué par la barre anti-popup du SP2 (elle clignotera en haut).Ensuite- Télécharge HijackThis : http://www.01net.com/telecharger/windows/Internet/internet_utlitaire/fiches/29061.html- Installe le dans son propre dossier.Par exemple, C:\HijackThisChoisis l'option "do a scan and a logfile", il va te générer un rapport, copie et colle sur le forum.Regarde la démo : http://pageperso.aol.fr/balltrap34/demohijack.htmBonne chance.

jul · Answer

voila j'ai fait comme tu m'a dit j'ai fait un scan en ligne avec bitdefender je te met le rapport le voila:C:\WINDOWS\system32\i	Infected with: Backdoor.BotGet.FtpB.GenC:\WINDOWS\system32\i	DeletedC:\Program Files\Norton AntiVirus\Quarantine\1C7002FF.tmp=>(Quarantine-2)	Infected with: Java.Trojan.Binny.AC:\Program Files\Norton AntiVirus\Quarantine\1C7002FF.tmp=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\1C7002FF.tmp=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\7E5C245E.tmp=>(Quarantine-2)	Infected with: Java.Trojan.Binny.AC:\Program Files\Norton AntiVirus\Quarantine\7E5C245E.tmp=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\7E5C245E.tmp=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\1C742CFB.tmp=>(Quarantine-2)	Infected with: Trojan.Downloader.Ieax.AC:\Program Files\Norton AntiVirus\Quarantine\1C742CFB.tmp=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\1C742CFB.tmp=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\36794058.tmp=>(Quarantine-2)	Infected with: Java.Trojan.Binny.AC:\Program Files\Norton AntiVirus\Quarantine\36794058.tmp=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\36794058.tmp=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\57420CE5.tmp=>(Quarantine-2)	Infected with: Java.Trojan.Binny.AC:\Program Files\Norton AntiVirus\Quarantine\57420CE5.tmp=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\57420CE5.tmp=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\36A1382D.exe=>(Quarantine-2)	Infected with: Dropped:BAT.AutoDelete.AC:\Program Files\Norton AntiVirus\Quarantine\36A1382D.exe=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\36A1382D.exe=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>GetAccess.class	Infected with: Java.Trojan.Exploit.BytverifyC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>GetAccess.class	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>GetAccess.class	DeletedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)	UpdatedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>InsecureClassLoader.class	Infected with: Java.Trojan.Exploit.BytverifyC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>InsecureClassLoader.class	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>InsecureClassLoader.class	DeletedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)	UpdatedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Dummy.class	Infected with: Trojan.Java.Classloader.Dummy.AC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Dummy.class	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Dummy.class	DeletedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)	UpdatedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Installer.class	Infected with: Java.Trojan.OpenConnection.FC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Installer.class	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Installer.class	DeletedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)	UpdatedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip	Update failedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.cla=>(Quarantine-2)	Infected with: Java.Trojan.Exploit.BytverifyC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.cla=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\47367F7D.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\57861DBC.cla=>(Quarantine-2)	Infected with: Trojan.Java.Classloader.Dummy.AC:\Program Files\Norton AntiVirus\Quarantine\57861DBC.cla=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\57861DBC.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\2D573042.cla=>(Quarantine-2)	Infected with: Java.Trojan.Exploit.BytverifyC:\Program Files\Norton AntiVirus\Quarantine\2D573042.cla=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\2D573042.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\1A450958.tmp=>(Quarantine-2)	Infected with: Java.Trojan.Binny.AC:\Program Files\Norton AntiVirus\Quarantine\1A450958.tmp=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\1A450958.tmp=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\3DE27227.tmp=>(Quarantine-2)	Infected with: Java.Trojan.Binny.AC:\Program Files\Norton AntiVirus\Quarantine\3DE27227.tmp=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\3DE27227.tmp=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\1A2904F5.cla=>(Quarantine-2)	Infected with: Trojan.Java.ClassLoader.CC:\Program Files\Norton AntiVirus\Quarantine\1A2904F5.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\16D75095.cla=>(Quarantine-2)	Infected with: Trojan.Java.ClassLoader.DC:\Program Files\Norton AntiVirus\Quarantine\16D75095.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\1A2D2EF1.cla=>(Quarantine-2)	Infected with: Trojan.Exploit.Java.BytverifyC:\Program Files\Norton AntiVirus\Quarantine\1A2D2EF1.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\014E03B9.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\Program Files\Norton AntiVirus\Quarantine\014E03B9.exe=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\014E03B9.exe=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\40B51839.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\Program Files\Norton AntiVirus\Quarantine\40B51839.exe=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\40B51839.exe=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\58810A0B.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\Program Files\Norton AntiVirus\Quarantine\58810A0B.exe=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\58810A0B.exe=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\154E01CE.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\Program Files\Norton AntiVirus\Quarantine\154E01CE.exe=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\154E01CE.exe=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\05440AC9.cla=>(Quarantine-2)	Infected with: Trojan.Java.ClassLoader.CC:\Program Files\Norton AntiVirus\Quarantine\05440AC9.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\160F6E66.cla=>(Quarantine-2)	Infected with: Trojan.Java.ClassLoader.DC:\Program Files\Norton AntiVirus\Quarantine\160F6E66.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\054734C6.cla=>(Quarantine-2)	Infected with: Trojan.Exploit.Java.BytverifyC:\Program Files\Norton AntiVirus\Quarantine\054734C6.cla=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\2FE610E4.fr6=>(Quarantine-2)	Detected with: Adware.Iectr.AC:\Program Files\Norton AntiVirus\Quarantine\2FE610E4.fr6=>(Quarantine-2)	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\2FE610E4.fr6=>(Quarantine-2)	DeletedC:\Program Files\Norton AntiVirus\Quarantine\350810A3.wmf	Infected with: Exploit.Win32.WMF-PFV.DC:\Program Files\Norton AntiVirus\Quarantine\350810A3.wmf	Disinfection failedC:\Program Files\Norton AntiVirus\Quarantine\350810A3.wmf	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064625.dll	Detected with: Adware.Iectr.AC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064625.dll	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064625.dll	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064628.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064628.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064628.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0065625.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0065625.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0065625.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066625.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066625.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066625.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066641.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066641.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066641.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066685.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066685.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066685.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066690.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066690.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066690.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0067117.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0067117.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0067117.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068117.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068117.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068117.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068143.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068143.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068143.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069143.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069143.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069143.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069180.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069180.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069180.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP276\A0069238.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP276\A0069238.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP276\A0069238.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069254.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069254.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069254.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069279.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069279.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069279.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069298.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069298.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069298.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP282\A0069459.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP282\A0069459.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP282\A0069459.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069510.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069510.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069510.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069521.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069521.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069521.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069524.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069524.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069524.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069546.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069546.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069546.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069576.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069576.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069576.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0069588.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0069588.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0069588.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0070588.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0070588.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0070588.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071588.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071588.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071588.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071716.exe	Infected with: Trojan.FakealertC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071716.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071716.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071721.exe	Infected with: Trojan.Downloader.FFZC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071721.exe	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071721.exe	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071753.exe=>(Quarantine-2)	Infected with: Dropped:BAT.AutoDelete.AC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071753.exe=>(Quarantine-2)	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071753.exe=>(Quarantine-2)	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071754.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071754.exe=>(Quarantine-2)	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071754.exe=>(Quarantine-2)	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071755.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071755.exe=>(Quarantine-2)	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071755.exe=>(Quarantine-2)	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071756.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071756.exe=>(Quarantine-2)	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071756.exe=>(Quarantine-2)	DeletedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071757.exe=>(Quarantine-2)	Infected with: Trojan.QDial.34C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071757.exe=>(Quarantine-2)	Disinfection failedC:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071757.exe=>(Quarantine-2)	Deleted	  	maintenant je te met le log de hidjack this le voila:Logfile of HijackThis v1.99.1Scan saved at 16:48:34, on 21/02/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Sygate\SPF\smc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\System32\wdfmgr.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\wbem\wmiprvse.exeC:\WINDOWS\ATK0100\Hcontrol.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\AGRSMMSG.exeC:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\WINDOWS\ATK0100\ATKOSD.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Java\jre1.5.0\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\System32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\Winamp\winampa.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Asus\Asus ChkMail\ChkMail.exeC:\Program Files\Asus\ASUS Hotkey\Hotkey.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\MegaSpoof\SuperMegaSpoof.exeC:\Documents and Settings\Jul\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com.twR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Jul\LOCALS~1\Temp\sp.dll/sp.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.free.fr/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Progra~1\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exeO4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1O4 - HKLM\..\Run: [ATIPTA] C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startguiO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exeO4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.twO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exej'espère tu arrivera à déchiffrémerci de ton aide

Kristopher · Answer

Salut ;)Ça te fait quelques infections en moins ;)1/ Supprime les fichiers temporaires, en vidant tout le contenu des dossiers (en gras) suivant : C:\Documents and Settings	on compte\Local Settings\Temp C:\Documents and Settings	ous les autres comptes\Local Settings\Temp C:\Windows\Temp + Le contenu du dossier prefetch : C:\WINDOWS\Prefetch <= sauf le fichier layout.ini ~~ N'oublie pas de vider la corbeille :D ~~ 2/ Télécharge CCLEANER : http://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html  Installe le programme, nettoie ton PC et également le registre comme indiqué sur cette page :Tutorial là : http://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php3/ Quelques remarques :- Connais tu ce programme : C:\Program Files\MegaSpoof ?- N'oublie pas de procéder aux mises à jour via Windows Update.Good luck.

jul · Answer

1/j'ai déja supprimer les fichiers temp + prefetch2/J'ai déja aussi nettoyer avec ccleaner3/je connais le logiciel megaspoofPour les maj windows update je crains qu'elle ne se fasse pas correctement j'ai l'icone en bas à droite de windows qunad je met ma souris dessus ca met telechargement des maj 15% met ca a l'air de bloquer  c normal?thanks

jul · Answer

salutil me semble que ca se faisait  tout de suite les maj de windows.je te remet un log de hidjack this comme tu me l'as demandé le voici:Logfile of HijackThis v1.99.1Scan saved at 00:52:36, on 22/02/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Sygate\SPF\smc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\System32\wdfmgr.exeC:\WINDOWS\System32\wbem\wmiprvse.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ATK0100\Hcontrol.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\AGRSMMSG.exeC:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\WINDOWS\ATK0100\ATKOSD.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Java\jre1.5.0\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\System32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Winamp\winampa.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exeC:\Program Files\Asus\Asus ChkMail\ChkMail.exeC:\Program Files\Asus\ASUS Hotkey\Hotkey.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINDOWS\System32\wuauclt.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Symantec\LiveUpdate\AUpdate.exeC:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEC:\Documents and Settings\Jul\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com.twR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Jul\LOCALS~1\Temp\sp.dll/sp.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.free.fr/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Progra~1\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dllO4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exeO4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1O4 - HKLM\..\Run: [ATIPTA] C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startguiO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exeO4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin
pjpi150.dllO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.twO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeet encore merci

Troyens dans mon pc

5 réponses