Infecté par gator a

Bonjour Maria,

~~ Fais ceci dans l'ordre ~~

1/ Télécharge et scanne ton PC avec Ewido Security Suite : https://www.01net.com/telecharger/
Copie/colle le rapport entier sur le forum.

2/ Scanne ton PC avec cet antivirus en ligne :
https://www.bitdefender.com/toolbox/
Clique sur "I Agree" et scanne tout le PC.
Pense à accepter l'ActiveX bloqué par la barre anti-popup du SP2 (elle clignotera en haut).
Copie/colle le rapport entier sur le forum.

3/ Remets un nouveau log HijackThis.
Bonne chance.

++

Re bonjour

voici le log du hijack après scan ewido
merci pour ton analyse

Logfile of HijackThis v1.99.1
Scan saved at 20:04:21, on 28/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\snippy_snippy_0.22_anglais_15177.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccVScan.exe
C:\Documents and Settings\GIL\Mes documents\Maria\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tiscali.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DD1671DA-DC10-2EDC-255F-AA2A2C74ECD1} - C:\DOCUME~1\GIL\APPLIC~1\tonsmess\SeekPlus.exe (file missing)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
O4 - HKCU\..\Run: [PURETIME] C:\DOCUME~1\GIL\APPLIC~1\CREATI~1\SUPPORT BALL ANTI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.caisse-epargne.fr/particuliers
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://eu.access.imerysnet.com/whalecom1a3da390a5a248560291036bd63acf950b4d06bdf...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

ok
je lance le scan
je mange avec ma petite famille
et je reviens

merci encore pour tout

maria

bonsoir,
voila le scan effectué avec bitfender

merci

maria

BitDefender Online Scanner

Scan report generated at: Tue, Mar 28, 2006 - 21:51:09

Scan path: C:\;D:\;E:\;G:\;H:\;I:\;

Statistics

Time
01:23:07

Files
527741

Folders
8030

Boot Sectors
2

Archives
6415

Packed Files
69310

Results

Identified Viruses
20

Infected Files
61

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
61

Engines Info

Virus Definitions
342327

Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

Scan plugins
13

Archive plugins
39

Unpack plugins
4

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\Documents and Settings\GIL\Application Data\Creative play\ezlakewp.exe
Infected with: Trojan.Swizzor.CZ

C:\Documents and Settings\GIL\Application Data\Creative play\ezlakewp.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\ezlakewp.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\ganslbxr.exe
Infected with: Trojan.Swizzor.CK

C:\Documents and Settings\GIL\Application Data\Creative play\ganslbxr.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\ganslbxr.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\hwrsygjo.exe
Infected with: Trojan.Swizzor.AX

C:\Documents and Settings\GIL\Application Data\Creative play\hwrsygjo.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\hwrsygjo.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\mdudieku.exe
Infected with: Trojan.Downloader.Swizzor.DF

C:\Documents and Settings\GIL\Application Data\Creative play\mdudieku.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\mdudieku.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\moqbkcaj.exe
Infected with: Trojan.Downloader.Swizzor.DH

C:\Documents and Settings\GIL\Application Data\Creative play\moqbkcaj.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\moqbkcaj.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\nqlwszfw.exe
Infected with: Trojan.Swizzor.BA

C:\Documents and Settings\GIL\Application Data\Creative play\nqlwszfw.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\nqlwszfw.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\nyegfafn.exe
Infected with: Trojan.Downloader.Swizzor.CC

C:\Documents and Settings\GIL\Application Data\Creative play\nyegfafn.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\nyegfafn.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\oxtwikwu.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV

C:\Documents and Settings\GIL\Application Data\Creative play\oxtwikwu.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\oxtwikwu.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\suikxsyi.exe
Infected with: Trojan.Downloader.Swizzor.DV

C:\Documents and Settings\GIL\Application Data\Creative play\suikxsyi.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\ThatPileSixth.exe
Infected with: Trojan.Swizzor.DH

C:\Documents and Settings\GIL\Application Data\Creative play\ThatPileSixth.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\ThatPileSixth.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\thoybzsq.exe
Infected with: Trojan.Downloader.Swizzor.DR

C:\Documents and Settings\GIL\Application Data\Creative play\thoybzsq.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\thoybzsq.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\tiyzholu.exe
Infected with: Trojan.Swizzor.CZ

C:\Documents and Settings\GIL\Application Data\Creative play\tiyzholu.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\tiyzholu.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\uuyxoehw.exe
Infected with: Trojan.Downloader.Swizzor.DE

C:\Documents and Settings\GIL\Application Data\Creative play\uuyxoehw.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\uuyxoehw.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\vzlveymh.exe
Infected with: Trojan.Downloader.Swizzor.DH

C:\Documents and Settings\GIL\Application Data\Creative play\vzlveymh.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\vzlveymh.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\wolylmgj.exe
Infected with: Trojan.Downloader.Swizzor.CC

C:\Documents and Settings\GIL\Application Data\Creative play\wolylmgj.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\wolylmgj.exe
Deleted

C:\Documents and Settings\GIL\Application Data\Creative play\woyppccb.exe
Infected with: Trojan.Downloader.Swizzor.CA

C:\Documents and Settings\GIL\Application Data\Creative play\woyppccb.exe
Disinfection failed

C:\Documents and Settings\GIL\Application Data\Creative play\woyppccb.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\1791af3.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV

C:\Documents and Settings\GIL\Local Settings\Temp\1791af3.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\1791af3.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\56e33.exe
Infected with: Trojan.Downloader.Swizzor.DR

C:\Documents and Settings\GIL\Local Settings\Temp\56e33.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\56e33.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\56f48.exe
Infected with: Trojan.Downloader.Swizzor.DR

C:\Documents and Settings\GIL\Local Settings\Temp\56f48.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\56f48.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\dfnqtyfm.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\dfnqtyfm.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\dfnqtyfm.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\dqljzmbt.exe
Infected with: Trojan.Lopad.G

C:\Documents and Settings\GIL\Local Settings\Temp\dqljzmbt.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\dqljzmbt.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\lfgqbaai.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\lfgqbaai.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\lfgqbaai.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\lopremover.exe
Detected with: Adware.Lop

C:\Documents and Settings\GIL\Local Settings\Temp\lopremover.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\lopremover.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\npkzehlg.exe
Infected with: Trojan.Lopad.G

C:\Documents and Settings\GIL\Local Settings\Temp\npkzehlg.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\npkzehlg.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\pbikoltw.exe
Infected with: Trojan.Lopad.M

C:\Documents and Settings\GIL\Local Settings\Temp\pbikoltw.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\pbikoltw.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\pqvjkrwq.exe
Infected with: Trojan.Lopad.G

C:\Documents and Settings\GIL\Local Settings\Temp\pqvjkrwq.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\pqvjkrwq.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\qyvybatx.exe
Infected with: Trojan.Lopad.M

C:\Documents and Settings\GIL\Local Settings\Temp\qyvybatx.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\qyvybatx.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\rsxpeyfa.exe
Infected with: Trojan.Lopad.G

C:\Documents and Settings\GIL\Local Settings\Temp\rsxpeyfa.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\rsxpeyfa.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\swwscxgy.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\swwscxgy.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\swwscxgy.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\tedcpalb.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\tedcpalb.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\tedcpalb.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\vhtnzdvs.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\vhtnzdvs.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\vhtnzdvs.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\wgujcscl.exe
Infected with: Trojan.Lopad.N

C:\Documents and Settings\GIL\Local Settings\Temp\wgujcscl.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\wgujcscl.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\xflwormc.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\xflwormc.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\xflwormc.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\yephfylo.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\yephfylo.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\yephfylo.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\yuwlzhvr.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\yuwlzhvr.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\yuwlzhvr.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temp\zpqvkgnz.exe
Infected with: Trojan.Swizzor.X

C:\Documents and Settings\GIL\Local Settings\Temp\zpqvkgnz.exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temp\zpqvkgnz.exe
Deleted

C:\Documents and Settings\GIL\Local Settings\Temporary Internet Files\Content.IE5\SNCPWX4Z\new_uninstall[1].exe
Detected with: Adware.Lop

C:\Documents and Settings\GIL\Local Settings\Temporary Internet Files\Content.IE5\SNCPWX4Z\new_uninstall[1].exe
Disinfection failed

C:\Documents and Settings\GIL\Local Settings\Temporary Internet Files\Content.IE5\SNCPWX4Z\new_uninstall[1].exe
Deleted

C:\Documents and Settings\GIL\Mes documents\Mes images\Alexandra\petit film\Fitnessdesdoigts.exe
Infected with: Joke.Buttons

C:\Documents and Settings\GIL\Mes documents\Mes images\Alexandra\petit film\Fitnessdesdoigts.exe
Disinfection failed

C:\Documents and Settings\GIL\Mes documents\Mes images\Alexandra\petit film\Fitnessdesdoigts.exe
Deleted

C:\Documents and Settings\GIL\Mes documents\Stéphanie\petit fim\Fitnessdesdoigts.exe
Infected with: Joke.Buttons

C:\Documents and Settings\GIL\Mes documents\Stéphanie\petit fim\Fitnessdesdoigts.exe
Disinfection failed

C:\Documents and Settings\GIL\Mes documents\Stéphanie\petit fim\Fitnessdesdoigts.exe
Deleted

C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip=>La 1Šre astuce pour tricher avec eurobarre/Eurofake.exe
Infected with: Win32.Worm.Kelvir.BP

C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip=>La 1Šre astuce pour tricher avec eurobarre/Eurofake.exe
Disinfection failed

C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip=>La 1Šre astuce pour tricher avec eurobarre/Eurofake.exe
Deleted

C:\Program Files\eMule\Incoming\Comment Gagner gros sur internet by ANGE\La 1ère astuce pour tricher avec eurobarre.zip
Updated

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009647.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009647.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009647.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009648.exe
Infected with: Trojan.Swizzor.DH

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009648.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009648.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009680.exe
Detected with: Adware.Lop

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009680.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP52\A0009680.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP53\A0009791.exe
Infected with: Trojan.Swizzor.DH

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP53\A0009791.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP53\A0009791.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP56\A0009947.exe
Infected with: Trojan.Swizzor.DH

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP56\A0009947.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP56\A0009947.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010322.exe
Infected with: Trojan.Swizzor.CZ

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010322.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010322.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010323.exe
Infected with: Trojan.Swizzor.CK

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010323.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010323.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010324.exe
Infected with: Trojan.Swizzor.AX

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010324.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010324.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010325.exe
Infected with: Trojan.Downloader.Swizzor.DF

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010325.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010325.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010326.exe
Infected with: Trojan.Downloader.Swizzor.DH

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010326.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010326.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010327.exe
Infected with: Trojan.Swizzor.BA

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010327.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010327.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010328.exe
Infected with: Trojan.Downloader.Swizzor.CC

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010328.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010328.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010329.exe
Infected with: MemScan:Trojan.Downloader.Swizzor.DV

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010329.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010329.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010330.exe
Infected with: Trojan.Downloader.Swizzor.DV

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010330.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010331.exe
Infected with: Trojan.Swizzor.DH

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010331.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010331.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010332.exe
Infected with: Trojan.Downloader.Swizzor.DR

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010332.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010332.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010333.exe
Infected with: Trojan.Swizzor.CZ

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010333.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010333.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010334.exe
Infected with: Trojan.Downloader.Swizzor.DE

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010334.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010334.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010335.exe
Infected with: Trojan.Downloader.Swizzor.DH

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010335.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010335.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010336.exe
Infected with: Trojan.Downloader.Swizzor.CC

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010336.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010336.exe
Deleted

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010337.exe
Infected with: Trojan.Downloader.Swizzor.CA

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010337.exe
Disinfection failed

C:\System Volume Information\_restore{DFC8925A-94BC-48EE-9031-BB585301C46E}\RP58\A0010337.exe
Deleted

voila j'ai fais le ccleaner
malheureusement quand je fais lancer le nettoyage il me dit :
NETTOYAGE COMPLET - (0,132 secs)
------------------------------------------------------------------------------------------
6,61KB supprimés.
------------------------------------------------------------------------------------------

Détails des fichiers à effacer
------------------------------------------------------------------------------------------
Fichiers Temporaires d'Internet Explorer (fichiers 3) 6,61KB

ensuite je fais analyse et voila :

ANALYSE COMPLETE - (0,131 secs)
------------------------------------------------------------------------------------------
36,15KB ont été supprimé. (Taille approximative)
------------------------------------------------------------------------------------------

Détails des fichiers à supprimer (Note: AUCUN fichier n'a pour l'instant été supprimé)
------------------------------------------------------------------------------------------
C:\DOCUME~1\GIL\LOCALS~1\Temp\CmdLineExt02.dll 36,00KB
C:\WINDOWS\Debug\UserMode\userenv.log 154 bytes

je clique plusieurs fois et c'est toujours pareil

Est-ce normal ?

merci
maria

bonsoir,

Comme le scan dure tout de meme plus d'une heure je le lancerai demain soir et me permetrai de vous recontacter à ce moment là

merci pour votre patience

a demain

maria

Bonsoir....
Me revoila avec le rapport du nouveau scan de bitfender
pas de virus trouver ouf !!!!!

que dois-je faire maintenant svp?

BitDefender Online Scanner

Scan report generated at: Wed, Mar 29, 2006 - 21:03:49

Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;

Statistics

Time
01:15:27

Files
495925

Folders
7639

Boot Sectors
2

Archives
4721

Packed Files
68516

Results

Identified Viruses
0

Infected Files
0

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
0

Engines Info

Virus Definitions
349792

Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

Scan plugins
13

Archive plugins
39

Unpack plugins
4

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

No virus found.

Bonsoir,

Je pense aussi que c bon mais un peu plus haut dans la discussion tu me dis de faire un point de restauration manuel
Faut-il vraiment le faire?

en attendant je te remercie pour ton aide
Je ne connaissais pas ce forum et c le premier qui me donne la solution à mon problème.

merci
@+

Je te remercie de me rappeler à l'ordre mais c comme ça qu'on apprends
Donc je fais et te re-message si j'ai réussi ou pas
A tout à l'heure

@+
maria

Eh voila !!!! Enfin c fait

J'ai bien suivi toute la procédure que tu m'a donné et j'espère que maintenant grâce à ton aide et tes conseils je pourrai à l'avenir résoudre et nettoyer plus efficacement mon PC et surtout ne plus me laisser envahir par les virus, trojan et autres attaques .....

Je mets le lien de ce forum dans mes favoris car c'est le premier qui m'a donné rapidement une solution à mon problème

et merci à tous ceux qui donnent de leur temps pour aider des utilisateurs comme moi - Continuez -Bravo -

Merci pour ta patience

@

maria

voilà !!!!

Peux-tu m'expliquer le problème?
Merci
@+
maria

Logfile of HijackThis v1.99.1
Scan saved at 22:34:49, on 29/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\RAMASST.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\snippy_snippy_0.22_anglais_15177.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccVScan.exe
C:\Documents and Settings\GIL\Mes documents\Maria\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tiscali.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {DD1671DA-DC10-2EDC-255F-AA2A2C74ECD1} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\RunServices: [SystemSAS] system32.exe
O4 - HKCU\..\Run: [PURETIME] C:\DOCUME~1\GIL\APPLIC~1\CREATI~1\SUPPORT BALL ANTI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.caisse-epargne.fr/particuliers
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://eu.access.imerysnet.com/whalecom1a3da390a5a248560291036bd63acf950b4d06bdf...
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab27571.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab27571.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://register.tiscali.fr/configurateur/AccountHelper.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Merci pour ton analyse
A part ça pourquoi dois-je supprimer cette ligne ci dessous car "imerys" est la société dans laquelle je travaille et elle nous permet de lire nos courriel de chez nous
est-ce vraiment un virus? et pourquoi?

Merci de me dire s'il faut tout de même supprimer les lignes faisant apparaitre le nom d'imerys.

Merci pour ta réponse avant que je commence la procédure que tu m'a donnée à faire.
@+
maria

O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://eu.access.imerysnet.com:/InternalSite/WhlCompMgr.cab

Re,

Merci
Je fais le hijackthis ce soir et le reste de la procédure demain car il est minuit
Je te recontacte demain si tu peux? et te donne le résultat.

OK?

en attendant bonne nuit et à demain

@+
maria

Re,

Désolée je ne suis pas encore couchée

dans ta procédure tu me demande de supprimer le dossier qui commence par CREAT... Impossible il ne veut pas se supprimer SUPPORT BALL ANTI.exe

que faire stp ?

merci
maria

Re,

je vais me coucher
Bonne nuit
A demain si tu veux

@+
maria

Bonjour,
De retour sur le forum

Voila le hijackthis demandé après avoir supprimer le dossier Creat....et surtout le fichier SUPPORT BALL ANTI

merci pour ton analyse

Logfile of HijackThis v1.99.1
Scan saved at 19:00:25, on 30/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\GIL\Mes documents\Maria\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tiscali.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [Seticon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{17374192-BB5E-4681-B514-4D7EB1B16708}: NameServer = 213.36.80.1 213.36.80.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

@+
maria

eh voila
C ok non?

This is a report processed by VirusTotal on 03/30/2006 at 19:56:33 (CET) after scanning the file "XCSyncML.exe" file.
Antivirus Version Update Result
AntiVir 6.34.0.14 03.30.2006 no virus found
Avast 4.6.695.0 03.29.2006 no virus found
AVG 386 03.30.2006 no virus found
Avira 6.34.0.54 03.30.2006 no virus found
BitDefender 7.2 03.30.2006 no virus found
CAT-QuickHeal 8.00 03.30.2006 no virus found
ClamAV devel-20060202 03.29.2006 no virus found
DrWeb 4.33 03.30.2006 no virus found
eTrust-InoculateIT 23.71.115 03.30.2006 no virus found
eTrust-Vet 12.4.2144 03.30.2006 no virus found
Ewido 3.5 03.30.2006 no virus found
Fortinet 2.71.0.0 03.30.2006 no virus found
F-Prot 3.16c 03.28.2006 no virus found
Ikarus 0.2.59.0 03.30.2006 no virus found
Kaspersky 4.0.2.24 03.30.2006 no virus found
McAfee 4730 03.30.2006 no virus found
NOD32v2 1.1462 03.30.2006 no virus found
Norman 5.70.10 03.30.2006 no virus found
Panda 9.0.0.4 03.30.2006 no virus found
Sophos 4.04.0 03.30.2006 no virus found
Symantec 8.0 03.30.2006 no virus found
TheHacker 5.9.7.122 03.30.2006 no virus found
UNA 1.83 03.23.2006 no virus found
VBA32 3.10.5 03.30.2006 no virus found

@+
maria

Bonsoir et

merci beaucoup pour ton aide précieuse

@+

maria

Re
merci encore

Mais où dois-je coher STP

bye

@+

Re

Non y'a rien qui me permet de cocher
Un petit carré est à droite de mon titre mais ne sert pas à ça

Tant pis

@++++++

maria