Troyens dans mon pc

jul -  
Kristopher Messages postés 3752 Statut Contributeur -
salut à tous
j'ai un petit souci mon pc est infecté
windows xp sp1
sygate firewal
norton 2005

je vous met le log d'hidjack this
merci de votre aide

ogfile of HijackThis v1.99.1
Scan saved at 20:19:30, on 20/02/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Jul\Bureau\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com.tw
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Jul\LOCALS~1\Temp\sp.dll/sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.free.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Progra~1\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ATIPTA] C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.tw
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

5 réponses

  1.
    Kristopher Messages postés 3752 Statut Contributeur 106
     
    Salut,

    Pour commencer :

    - Scanne ton PC avec cet antivirus en ligne :
    http://www.bitdefender.com/scan8/ie.html
    Clique sur "I Agree" et scanne tout le PC.
    Copie/colle le rapport sur le forum.

    Pense à accepter l'ActiveX bloqué par la barre anti-popup du SP2 (elle clignotera en haut).

    Ensuite

    - Télécharge HijackThis : http://www.01net.com/telecharger/windows/Internet/internet_utlitaire/fiches/29061.html
    - Installe le dans son propre dossier.
    Par exemple, C:\HijackThis
    Choisis l'option "do a scan and a logfile", il va te générer un rapport, copie et colle sur le forum.
    Regarde la démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

    Bonne chance.
    0
  2. jul
     
    voila j'ai fait comme tu m'a dit j'ai fait un scan en ligne avec bitdefender je te met le rapport le voila:

    C:\WINDOWS\system32\i

    Infected with: Backdoor.BotGet.FtpB.Gen

    C:\WINDOWS\system32\i

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\1C7002FF.tmp=>(Quarantine-2)

    Infected with: Java.Trojan.Binny.A

    C:\Program Files\Norton AntiVirus\Quarantine\1C7002FF.tmp=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\1C7002FF.tmp=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\7E5C245E.tmp=>(Quarantine-2)

    Infected with: Java.Trojan.Binny.A

    C:\Program Files\Norton AntiVirus\Quarantine\7E5C245E.tmp=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\7E5C245E.tmp=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\1C742CFB.tmp=>(Quarantine-2)

    Infected with: Trojan.Downloader.Ieax.A

    C:\Program Files\Norton AntiVirus\Quarantine\1C742CFB.tmp=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\1C742CFB.tmp=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\36794058.tmp=>(Quarantine-2)

    Infected with: Java.Trojan.Binny.A

    C:\Program Files\Norton AntiVirus\Quarantine\36794058.tmp=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\36794058.tmp=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\57420CE5.tmp=>(Quarantine-2)

    Infected with: Java.Trojan.Binny.A

    C:\Program Files\Norton AntiVirus\Quarantine\57420CE5.tmp=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\57420CE5.tmp=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\36A1382D.exe=>(Quarantine-2)

    Infected with: Dropped:BAT.AutoDelete.A

    C:\Program Files\Norton AntiVirus\Quarantine\36A1382D.exe=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\36A1382D.exe=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>GetAccess.class

    Infected with: Java.Trojan.Exploit.Bytverify

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>GetAccess.class

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>GetAccess.class

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)

    Updated

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>InsecureClassLoader.class

    Infected with: Java.Trojan.Exploit.Bytverify

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>InsecureClassLoader.class

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>InsecureClassLoader.class

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)

    Updated

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Dummy.class

    Infected with: Trojan.Java.Classloader.Dummy.A

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Dummy.class

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Dummy.class

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)

    Updated

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Installer.class

    Infected with: Java.Trojan.OpenConnection.F

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Installer.class

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)=>Installer.class

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip=>(Quarantine-2)

    Updated

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.zip

    Update failed

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.cla=>(Quarantine-2)

    Infected with: Java.Trojan.Exploit.Bytverify

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.cla=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\47367F7D.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\57861DBC.cla=>(Quarantine-2)

    Infected with: Trojan.Java.Classloader.Dummy.A

    C:\Program Files\Norton AntiVirus\Quarantine\57861DBC.cla=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\57861DBC.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\2D573042.cla=>(Quarantine-2)

    Infected with: Java.Trojan.Exploit.Bytverify

    C:\Program Files\Norton AntiVirus\Quarantine\2D573042.cla=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\2D573042.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\1A450958.tmp=>(Quarantine-2)

    Infected with: Java.Trojan.Binny.A

    C:\Program Files\Norton AntiVirus\Quarantine\1A450958.tmp=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\1A450958.tmp=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\3DE27227.tmp=>(Quarantine-2)

    Infected with: Java.Trojan.Binny.A

    C:\Program Files\Norton AntiVirus\Quarantine\3DE27227.tmp=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\3DE27227.tmp=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\1A2904F5.cla=>(Quarantine-2)

    Infected with: Trojan.Java.ClassLoader.C

    C:\Program Files\Norton AntiVirus\Quarantine\1A2904F5.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\16D75095.cla=>(Quarantine-2)

    Infected with: Trojan.Java.ClassLoader.D

    C:\Program Files\Norton AntiVirus\Quarantine\16D75095.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\1A2D2EF1.cla=>(Quarantine-2)

    Infected with: Trojan.Exploit.Java.Bytverify

    C:\Program Files\Norton AntiVirus\Quarantine\1A2D2EF1.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\014E03B9.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\Program Files\Norton AntiVirus\Quarantine\014E03B9.exe=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\014E03B9.exe=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\40B51839.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\Program Files\Norton AntiVirus\Quarantine\40B51839.exe=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\40B51839.exe=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\58810A0B.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\Program Files\Norton AntiVirus\Quarantine\58810A0B.exe=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\58810A0B.exe=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\154E01CE.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\Program Files\Norton AntiVirus\Quarantine\154E01CE.exe=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\154E01CE.exe=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\05440AC9.cla=>(Quarantine-2)

    Infected with: Trojan.Java.ClassLoader.C

    C:\Program Files\Norton AntiVirus\Quarantine\05440AC9.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\160F6E66.cla=>(Quarantine-2)

    Infected with: Trojan.Java.ClassLoader.D

    C:\Program Files\Norton AntiVirus\Quarantine\160F6E66.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\054734C6.cla=>(Quarantine-2)

    Infected with: Trojan.Exploit.Java.Bytverify

    C:\Program Files\Norton AntiVirus\Quarantine\054734C6.cla=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\2FE610E4.fr6=>(Quarantine-2)

    Detected with: Adware.Iectr.A

    C:\Program Files\Norton AntiVirus\Quarantine\2FE610E4.fr6=>(Quarantine-2)

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\2FE610E4.fr6=>(Quarantine-2)

    Deleted

    C:\Program Files\Norton AntiVirus\Quarantine\350810A3.wmf

    Infected with: Exploit.Win32.WMF-PFV.D

    C:\Program Files\Norton AntiVirus\Quarantine\350810A3.wmf

    Disinfection failed

    C:\Program Files\Norton AntiVirus\Quarantine\350810A3.wmf

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064625.dll

    Detected with: Adware.Iectr.A

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064625.dll

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064625.dll

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064628.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064628.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0064628.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0065625.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0065625.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0065625.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066625.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066625.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066625.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066641.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066641.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066641.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066685.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066685.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066685.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066690.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066690.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP274\A0066690.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0067117.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0067117.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0067117.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068117.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068117.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068117.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068143.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068143.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0068143.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069143.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069143.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069143.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069180.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069180.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP275\A0069180.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP276\A0069238.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP276\A0069238.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP276\A0069238.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069254.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069254.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069254.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069279.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069279.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069279.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069298.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069298.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP277\A0069298.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP282\A0069459.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP282\A0069459.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP282\A0069459.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069510.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069510.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069510.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069521.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069521.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069521.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069524.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069524.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069524.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069546.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069546.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069546.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069576.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069576.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP283\A0069576.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0069588.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0069588.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0069588.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0070588.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0070588.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0070588.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071588.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071588.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071588.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071716.exe

    Infected with: Trojan.Fakealert

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071716.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071716.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071721.exe

    Infected with: Trojan.Downloader.FFZ

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071721.exe

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP284\A0071721.exe

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071753.exe=>(Quarantine-2)

    Infected with: Dropped:BAT.AutoDelete.A

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071753.exe=>(Quarantine-2)

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071753.exe=>(Quarantine-2)

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071754.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071754.exe=>(Quarantine-2)

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071754.exe=>(Quarantine-2)

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071755.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071755.exe=>(Quarantine-2)

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071755.exe=>(Quarantine-2)

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071756.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071756.exe=>(Quarantine-2)

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071756.exe=>(Quarantine-2)

    Deleted

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071757.exe=>(Quarantine-2)

    Infected with: Trojan.QDial.34

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071757.exe=>(Quarantine-2)

    Disinfection failed

    C:\System Volume Information\_restore{9C153807-097E-4C4D-A5E0-4C57C69569B6}\RP286\A0071757.exe=>(Quarantine-2)

    Deleted

    maintenant je te met le log de hidjack this le voila:

    Logfile of HijackThis v1.99.1
    Scan saved at 16:48:34, on 21/02/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\WINDOWS\ATK0100\Hcontrol.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\ATK0100\ATKOSD.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Winamp\winampa.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
    C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\MegaSpoof\SuperMegaSpoof.exe
    C:\Documents and Settings\Jul\Bureau\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com.tw
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Jul\LOCALS~1\Temp\sp.dll/sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.free.fr/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Progra~1\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
    O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [ATIPTA] C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
    O4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.tw
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

    j'espère tu arrivera à déchiffré

    merci de ton aide
    0
  3. Kristopher Messages postés 3752 Statut Contributeur 106
     
    Salut ;)

    Ça te fait quelques infections en moins ;)

    1/ Supprime les fichiers temporaires, en vidant tout le contenu des dossiers (en gras) suivant :

    C:\Documents and Settings\ton compte\Local Settings\Temp

    C:\Documents and Settings\tous les autres comptes\Local Settings\Temp

    C:\Windows\Temp

    + Le contenu du dossier prefetch :

    C:\WINDOWS\Prefetch <= sauf le fichier layout.ini

    ~~ N'oublie pas de vider la corbeille :D ~~

    2/ Télécharge CCLEANER : http://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

    Installe le programme, nettoie ton PC et également le registre comme indiqué sur cette page :

    Tutorial là : http://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

    3/ Quelques remarques :

    - Connais tu ce programme :
    C:\Program Files\MegaSpoof ?

    - N'oublie pas de procéder aux mises à jour via Windows Update.

    Good luck.
    0
  4. jul
     
    1/j'ai déja supprimer les fichiers temp + prefetch

    2/J'ai déja aussi nettoyer avec ccleaner

    3/je connais le logiciel megaspoof

    Pour les maj windows update je crains qu'elle ne se fasse pas correctement j'ai l'icone en bas à droite de windows qunad je met ma souris dessus ca met telechargement des maj 15% met ca a l'air de bloquer c normal?
    thanks
    0
    1. Kristopher Messages postés 3752 Statut Contributeur 106
       
      Re,

      Remets un nouveau log HijackThis.

      Si non, pour les maj, je ne vois pas trop pourquoi elles se bloquent.
      Ça s'est toujours passé comme ça ou c'est la première fois ?

      ++
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. jul
     
    salut
    il me semble que ca se faisait tout de suite les maj de windows.
    je te remet un log de hidjack this comme tu me l'as demandé le voici:

    Logfile of HijackThis v1.99.1
    Scan saved at 00:52:36, on 22/02/2006
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\ATK0100\Hcontrol.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\WINDOWS\ATK0100\ATKOSD.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\WINDOWS\System32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Winamp\winampa.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
    C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    C:\Documents and Settings\Jul\Bureau\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com.tw
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Jul\LOCALS~1\Temp\sp.dll/sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.free.fr/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Progra~1\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
    O4 - HKLM\..\Run: [Power_Gear] C:\Progra~1\ASUS\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [ATIPTA] C:\Progra~1\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
    O4 - Global Startup: Hotkey.lnk = C:\Program Files\Asus\ASUS Hotkey\Hotkey.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.tw
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

    et encore merci
    0
    1. Kristopher Messages postés 3752 Statut Contributeur 106
       
      Salut,

      Il y a toujours cette ligne qui me gêne :

      On voit cela par rapport à R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Jul\LOCALS~1\Temp\sp.dll/sp.html

      Essaie de nettoyer ton PC avec CleanUp! :

      http://www.stevengould.org/software/cleanup/

      ++
      0