Cheval de Troie : De l'aide !! Résolu

Question

Bonjour, 
Pouvez vous m'aider ? Je suis perdue.
Je copie le rapport HijackThis. 
Merci beaucoup d'avance. 

Logfile of HijackThis v1.99.1 
Scan saved at 19:42:48, on 27/09/2006 
Platform: Windows 2000 SP4 (WinNT 5.00.2195) 
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) 

Running processes: 
C:\WINNT\System32\smss.exe 
C:\WINNT\system32\winlogon.exe 
C:\WINNT\system32\services.exe 
C:\WINNT\system32\lsass.exe 
C:\WINNT\system32\Ati2evxx.exe 
C:\WINNT\system32\svchost.exe 
C:\WINNT\system32\spoolsv.exe 
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
C:\Program Files\Alwil Software\Avast4\ashServ.exe 
C:\WINNT\system32\svchost.exe 
C:\WINNT\system32egsvc.exe 
C:\WINNT\system32\MSTask.exe 
C:\WINNT\system32\stisvc.exe 
C:\WINNT\System32\WBEM\WinMgmt.exe 
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe 
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe 
C:\WINNT\system32\Ati2evxx.exe 
C:\WINNT\Explorer.exe 
C:\WINNT\system32\msejavaupdt32.exe 
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
C:\Program Files\MessengerPlus! 3\MsgPlus.exe 
C:\Program Files\Softwin\BitDefender8\vsserv.exe 
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
C:\WINNT\system32\wunupdsr.exe 
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
C:\Program Files\Softwin\BitDefender8\bdnagent.exe 
C:\WINNT\system32\dev.exe 
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
C:\WINNT\system32\internat.exe 
C:\Program Files\MSN Messenger\MsnMsgr.Exe 
C:\PROGRA~1\INCRED~1\bin\IMApp.exe 
C:\Program Files\Incredimail\bin\IncMail.exe 
C:\Program Files\Microsoft Office\Office\WINWORD.EXE 
C:\WINNT\msagent\AgentSvr.exe 
C:\Program Files\Hijackthis\hijackthis_199\HijackThis.exe 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens 
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll 
F2 - REG:system.ini: Shell=Explorer.exe msejavaupdt32.exe 
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msejavaupdt32.exe 
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll 
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx 
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon 
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" 
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
O4 - HKLM\..\Run: [Connection Managers] wunupdsr.exe 
O4 - HKLM\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe 
O4 - HKLM\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe 
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender8\bdmcon.exe 
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\bdswitch.exe 
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender8\bdnagent.exe 
O4 - HKLM\..\Run: [Windows APCI Verifier] dev.exe 
O4 - HKLM\..\Run: [Windows Explorer] C:\WINNT\system32\explorer.exe 
O4 - HKLM\..\RunServices: [Connection Managers] wunupdsr.exe 
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe 
O4 - HKCU\..\Run: [internat.exe] internat.exe 
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c 
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart 
O4 - HKCU\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe 
O4 - HKCU\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe 
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background 
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm 
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm 
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab 
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com 
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com 
O18 - Protocol: bw+0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw+0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw-0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw-0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw00 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw00s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw10 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw10s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw20 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw20s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw30 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw30s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw40 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw40s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw50 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw50s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw60 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw60s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw70 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw70s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw80 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw80s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw90 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bw90s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwa0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwa0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwb0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwb0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwc0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwc0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwd0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwd0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwe0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwe0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwf0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwf0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll 
O18 - Protocol: bwg0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwg0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwh0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwh0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwi0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwi0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwj0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwj0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwk0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwk0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwl0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwl0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwm0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwm0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwn0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwn0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwo0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwo0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwp0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwp0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwq0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwq0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwr0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwr0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bws0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bws0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwt0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwt0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwu0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwu0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwv0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwv0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bww0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bww0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwx0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwx0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwy0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwy0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwz0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: bwz0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O18 - Protocol: offline-8876480 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 
O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll 
O20 - Winlogon Notify: Run - C:\WINNT\system32\enj0l11m1.dll (file missing) 
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe 
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe 
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe 
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) 
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) 
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing) 
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe 
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender8\vsserv.exe" /service (file missing) 
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing) 
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing) 

Claire

Séb08 · Answer

slt,

désinstale ceci (en gras):

C:\Program Files\Deskbar 

ensuite :

Scanne ton Pc avec ce log :

ewido (gratuit même après la période d’essai) 
Téléchargement :
http://perso.orange.fr/entraide-hijackthis/Ewido/
Cliques sur « update » fais les mise à jour ensuite clique sur « scanner » puis sur « complete scan system ».
Tuto pour la version 4 d’Ewido :
https://www.malekal.com/tutorial-et-guide-ewido-v4/

delete tout ce qu'il te trouve et copie/colle le rapport.

A+

Claire · Answer

Salut,

merci d'avoir répondu

mais ewido ne veut pas s'installer, le fenêtre se ferme à chaque fois, sans doute à cause du cheval de Troie. De plus toute fenêtre contenant le mot Trojan se ferme.
La désintallation de deskbar ne se fait pas complétement, il reste des dossiers qui ne peuvent pas être supprimés.

Que dois-je faire ?

Le compte-rendu HijackThis ne paut pas d'aider ?

Séb08 · Answer

Vire tout ce qui concerne Deskbar s'il le faut vire le en mode sans echec :

Rappel :

Redémarres le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou F5 ) et tu choisis le mode sans échec) 

seulement après remet un log Hijack.

A+

Claire · Answer

Bonjour,

je vois que le dernier rmessage que je t'ai envoyé n'a pas marché.

en fait j'ai réussi à enlever deskbar mais ça revient à chaque redémarrage de l'ordi.

Je ne suis pas chez moi donc je te renverrai le log plus tard (d'ailleurs le HijackThis plante en faisant la première option).

Merci de ton aide.

Séb08 · Answer

Ok remet moi un log Hijack dès que tu peux .

A+

Claire · Answer

Voici le log : 

Logfile of HijackThis v1.99.1
Scan saved at 22:58:14, on 02/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32egsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\msejavaupdt32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\dev.exe
C:\WINNT\system32\logon.exe
C:\WINNT\system32\wunupdsr.exe
C:\exo32.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\msiexec.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe msejavaupdt32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msejavaupdt32.exe
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe
O4 - HKLM\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe
O4 - HKLM\..\Run: [Windows APCI Verifier] dev.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [newname] C:\nwnmff_e20.exe
O4 - HKLM\..\Run: [keyboard] C:\kybrdff_e20.exe
O4 - HKLM\..\Run: [defender] C:\dfndrff_e19.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINNT\system32\logon.exe
O4 - HKLM\..\Run: [Connection Managers] wunupdsr.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\exo32.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\RunServices: [Connection Managers] wunupdsr.exe
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe
O4 - HKCU\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O18 - Protocol: bw+0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)


Merci de ton aide

Séb08 · Answer

Ensuite télécharges smitfraudfix :
 
En image : 
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu le décompresses tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 1 
cela vas générer un rapport.
Si tu vois des lignes avec PRESENT! Continue la manip qui suit.

Redémarres le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou F5 ) et tu choisis le mode sans échec) 

- Ouvre le dossier "SmitfraudFix" et double clic sur "Smitfraudfix.cmd", choisit l’option 2 et tu réponds oui à tout. 

Copie/colle le rapport sur le forum stp.


a+

Claire · Answer

Bonjour,

voici le rapport : 

SmitFraudFix v2.104

Rapport fait à 19:33:49,28, mar. 03/10/2006
Executé à partir de C:\Program Files\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


Il y a aussi "Project1' qui se lance à chaque démarrage et qui ralentit le PC et  nous sommes obligés de le supprimer dans le gestionnaire des tâches.

On va finir par le formater si ça continue !

Bonne soirée.

Claire

Séb08 · Answer

du calme .. ;-)

Redémarre en mode normal et remet un log Hijack STP

A+

Claire · Answer

Voici le log :

Logfile of HijackThis v1.99.1
Scan saved at 20:55:46, on 03/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32egsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\msejavaupdt32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\dev.exe
C:\WINNT\system32\logon.exe
C:\WINNT\system32\wunupdsr.exe
C:\exo32.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\system32\drwtsn32.exe
C:\WINNT\Explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe msejavaupdt32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msejavaupdt32.exe
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe
O4 - HKLM\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe
O4 - HKLM\..\Run: [Windows APCI Verifier] dev.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINNT\system32\logon.exe
O4 - HKLM\..\Run: [Connection Managers] wunupdsr.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\exo32.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [newname] C:\nwnmff_e21.exe
O4 - HKLM\..\Run: [defender] C:\dfndrff_e21.exe
O4 - HKLM\..\Run: [keyboard] C:\kybrdff_e21.exe
O4 - HKLM\..\RunServices: [Connection Managers] wunupdsr.exe
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe
O4 - HKCU\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O18 - Protocol: bw+0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

Séb08 · Answer

Ensuite télécharges smitfraudfix :
 
En image : 
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu le décompresses tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 1 
cela vas générer un rapport.
Si tu vois des lignes avec PRESENT! Continue la manip qui suit.

Redémarres le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou F5 ) et tu choisis le mode sans échec) 

- Ouvre le dossier "SmitfraudFix" et double clic sur "Smitfraudfix.cmd", choisit l’option 2 et tu réponds oui à tout. 

Copie/colle le rapport sur le forum stp.


a+

Claire · Answer

je l'ai déjà fait  comme tu me l'as demandé et le rapport se trouve un peu plus haut

Séb08 · Answer

désolé mais à force ... ;-)

il faut que tu installe un parefeu avec Avast! car il n'en as pas et celui de Windows ne sert à rien  donc :

Kério (pare feu): 
www.01net.com 
lire le tuto: pour configurer et comprendre Kerio 
https://kerio.probb.fr/


=============================================

Ensuite :



¤Télécharge ces logiciels (si tu ne les as pas) mais que tu n‘utilises pas tout de suite:

(Les mettre à jour avant de les lancer). Pour ça voir les démos.

Antispywares et autres :

1/ Ad-Aware (gratuit) 
Téléchargement : 
telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/11643.html 
Le patch en Français pour Ad-Aware (gratuit) : 
telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/25543.html
Tuto :
perso.orange.fr/entraide-hijackthis/AdAware/AdAware.htm


2/ Spybot (gratuit) :
 voir demo d utilisation (merci Balltrap)
pageperso.aol.fr/Balltrap34/demo%20spybot.htm
Téléchargement :
telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/26157.html 


3/ ewido (dowload) 
Téléchargement :
www.ewido.net/en/download/
Lorsqu'il est installer tu l'ouvres clique sur « update » fais les mise à jour
Tuto pour la version 4 d’Ewido :
www.malekal.com/tutorial_ewidoV4.html

Nettoyeurs (de fichiers inutiles) et autres :

4/ ccleaner (gratuit)
Tutorial là :
 www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
Téléchargement :
 www.01net.com

*****************************************************
Affiches tous les fichiers et dossiers : 
cliques sur démarrer/panneau de configuration (en affichage classique)/option des dossiers/affichage 
Cocher « afficher les dossiers et fichiers cachés »

Décoches la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décoches « masquer les extensions dont le type est connu » 
Puis fais «Ok» pour valider les changements. 

Et « appliquer »

****************************************************
¤Relance HijackThis cliques sur « scanner seulement » ou (« do a scan only »),
 coche les cases devant ces lignes et ensuite clique sur « fixer objets » (ou « fix checked »):

R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe msejavaupdt32.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,msejavaupdt32.exe 

O4 - HKLM\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe
O4 - HKLM\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe
O4 - HKLM\..\Run: [Windows APCI Verifier] dev.exe 
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINNT\system32\logon.exe
O4 - HKLM\..\Run: [Connection Managers] wunupdsr.exe 
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\exo32.exe
O4 - HKLM\..\Run: [newname] C:\nwnmff_e21.exe
O4 - HKLM\..\Run: [defender] C:\dfndrff_e21.exe
O4 - HKLM\..\Run: [keyboard] C:\kybrdff_e21.exe
O4 - HKLM\..\RunServices: [Connection Managers] wunupdsr.exe
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe 
O4 - HKCU\..\Run: [Ms Update WinServices NT/XP] winservnt32.exe
O4 - HKCU\..\Run: [Ms Java Update For Windows NT/XP] msejavaupdt32.exe 

O18 - Protocol: bw+0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {36A4CCE1-1C42-4153-A4B5-6FEA9FB00351} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll 

O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

************************************************
¤Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec
 puis tape « entrée ». 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5).  

**********************************************
¤Recherche et supprime ceci: 
attention seulement les fichiers  (si présents).


C:\WINNT\system32\logon.exe
C:\exo32.exe
C:\nwnmff_e21.exe
C:\dfndrff_e21.exe
C:\kybrdff_e21.exe
C:\WINNT\csrss.exe
msejavaupdt32.exe
winservnt32.exe
dev.exe 
wunupdsr.exe

************************************************
¤ Lancer Ewido pour un scan complet (clique sur « scanner » puis sur « complete scan system ») « delete » tout ce qu’il te trouve 
et copie/colle le rapport en forum.
************************************************
¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
************************************************
¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
***********************************************
¤ Lance CCleaner.

Suppression des fichiers temporaires 

Va dans la section "Options" situé dans la marge gauche. Va dans "Avancé" et décoche "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Retourne ensuite dans la section "Nettoyeur" 
Fais bien attention de cocher toutes les cases dans la marge gauche (Internet Explorer/Windows Explorer/Système/Avancé) 
• Clique sur Analyse 
• Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois. 
• Une fois le scan terminé, clique sur Lancer le Nettoyage 

Suppression des incohérence du registre 

• Clique sur l'icône Erreurs situés dans la marge à gauche. 
• Puis clique sur Analyser les erreurs 
• Patiente pendant que CCleaner scan ton registre. 
• Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée. 
• Tu peux cliquer ensuite sur Corriger les erreurs. 

Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement.

*************************************************
¤ Vide ta Corbeille.
*************************************************
¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

Dis moi ou en sont tes probs dans ta prochaine réponse.

Je coupe.

A+

Claire · Answer

Bonsoir ou bonjour (selon l'heure),

voici les rapports :

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

 + Created at:	23:36:54 04/10/2006

 + Scan result:	



HKLM\SOFTWARE\SurfSideKick3 -> Adware.SurfSide : Cleaned with backup (quarantined).
HKLM\SOFTWARE\SurfSideKick3\Internet Explorer -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\WINNT\system32\TFTP4608 -> Backdoor.IRCBot.qu : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\LZM2AZMT\MTE3NDI6ODoxNg[1].exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrateur\Cookies\administrateur@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@c.goclick[2].txt -> TrackingCookie.Goclick : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.
C:\Documents and Settings\Administrateur\Cookies\administrateur@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.


::Report end
*******************************
Logfile of HijackThis v1.99.1
Scan saved at 00:03:00, on 05/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

***************************

Il y a plein de choses en mieux :
internet  va plus vite 
plus de project 1 (enfin jusqu'à maintenant)
des chevaux (de troie) en moins
je peux maintenant installer spybot et je l'ai lancé

mais encore un cheval de troie

merci pour cette grande avancée

peux tu nous aider à en finir complétement ?

merci 

A bientôt

Claire

Claire · Answer

Encore un truc : les mises à jour ne marche pas, 
on arrive sur ça :

  


[Numéro d'erreur : 0x8DDD0018] 
  Le site ne peut pas continuer, car un ou plusieurs des services Windows suivants ne sont pas exécutés :

Mises à jour automatiques (permet au site de rechercher, de télécharger et d'installer les mises à jour prioritaires destinées à votre ordinateur) 
Service de transfert intelligent en arrière-plan (BITS) (accélère le téléchargement et résout les problèmes liés aux éventuelles interruptions du processus) 
Journal des événements (conserve l'historique des opérations de mise à jour pour faciliter la résolution des problèmes le cas échéant) 
Pour vérifier que ces services sont exécutés :
1. Cliquez sur Démarrer, puis sur Exécuter.
2. Entrez services.msc, puis cliquez sur OK.
3. Dans la liste de services, double-cliquez sur Mises à jour automatiques, puis cliquez sur Propriétés.
4. Dans la liste Type de démarrage, sélectionnez Automatique et cliquez sur Appliquer.
5. Vérifiez que l'état associé au service est Démarré. Si le service est arrêté, cliquez sur le bouton Démarrer.
6. Dans la liste de services, double-cliquez sur Service de transfert intelligent en arrière-plan et cliquez sur Propriétés.
7. Dans la liste Type de démarrage, sélectionnez Manuel et cliquez sur Appliquer.
8. Vérifiez que l'état associé au service est Démarré. Si le service est arrêté, cliquez sur le bouton Démarrer.
9. Dans la liste de services, double-cliquez sur Journal des événements et cliquez sur Propriétés.
10. Dans la liste Type de démarrage, sélectionnez Automatique et cliquez sur Appliquer.
11. Vérifiez que l'état du service est Démarré. Si le service est arrêté, cliquez sur le bouton Démarrer. 
 
Mais on ne trouve pas les services demandés dans la liste

Merci encore de ton aide.

Claire

Séb08 · Answer

Fais un clic droit sur l'outil HijackThis! -> "Renommer", puis renomme-le en scan.exe 

Lance HijackThis! (double clique scan.exe) puis clique "Do a system scan and save a logfile", puis poste le rapport ici. STP

a+

Claire · Answer

Salut,

voici le rapport
là hijackthis ne plante plus

Logfile of HijackThis v1.99.1
Scan saved at 19:20:29, on 05/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\mobsync.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\msiexec.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\WINNT\system32\92861357.dll
O2 - BHO: (no name) - {302429F1-62BC-40EE-9FC0-CD8D6EB743AD} - C:\WINNT\system32\gebyy.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\msqgbcal.dll
O2 - BHO: (no name) - {D12CF65C-9EF6-44F2-A475-B727085FD7CC} - C:\WINNT\system32\pmnlmjh.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: gebyy - C:\WINNT\system32\gebyy.dll
O20 - Winlogon Notify: pmnlmjh - C:\WINNT\SYSTEM32\pmnlmjh.dll
O20 - Winlogon Notify: Run - C:\WINNT\system32\enj0l11m1.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

Merci de ton aide

une question : que nous recommandes-tu comme firewall ?

Bonne soirée

Séb08 · Answer

On verra pour les question + tard si tu veux bien ....

L'infection (Vundo) était bien cachée ! :)

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
Double-clique VundoFix.exe afin de le lancer.
Coche Run VundoFix as a task.
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok
Clique sur le bouton Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
Démarre ton PC à nouveau.
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.


a+

Claire · Answer

Salut,
un petit mot du boulot pour te dire qu'on ne te répondra pas ce we car nous ne sommes pas là.
Nous ferons ce que tu as écris sans doute lundi soir.

Bon we.

A bientôt

Claire

Séb08 · Answer

Ok je serai encore là ! lol

Bon we.

A+

Claire · Answer

Salut,

bon we j'espère 

voici le rapport de Vundo (je l'ai lancé 2 fois) :


VundoFix V6.2.1

Checking Java version...

Sun Java not detected
Scan started at 20:42:41 09/10/2006

Listing files found while scanning....

C:\WINNT\system32\ffulilkk.dll
C:\WINNT\system32\gebyy.dll
C:\WINNT\system32\yybeg.ini
C:\WINNT\system32\yybeg.bak1
C:\WINNT\system32\yybeg.bak2
C:\WINNT\system32\hhwutdwv.dll
C:\WINNT\system32\qoxoneqg.dll
C:\WINNT\system32	vsgkipe.dll
C:\WINNT\system32\umbembxy.dll
C:\WINNT\system32\yqlpeygw.exe
C:\WINNT\system32\gebyy.dll
C:\WINNT\system32\yybeg.ini
C:\WINNT\system32\yybeg.bak1
C:\WINNT\system32\yybeg.bak2
C:\WINNT\system32\yybeg.ini
C:\WINNT\system32\yybeg.bak1
C:\WINNT\system32\yybeg.bak2

Beginning removal...

 Attempting to delete C:\WINNT\system32\ffulilkk.dll
C:\WINNT\system32\ffulilkk.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\gebyy.dll
C:\WINNT\system32\gebyy.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\yybeg.ini
C:\WINNT\system32\yybeg.ini Has been deleted!

 Attempting to delete C:\WINNT\system32\yybeg.bak1
C:\WINNT\system32\yybeg.bak1 Has been deleted!

 Attempting to delete C:\WINNT\system32\yybeg.bak2
C:\WINNT\system32\yybeg.bak2 Has been deleted!

 Attempting to delete C:\WINNT\system32\hhwutdwv.dll
C:\WINNT\system32\hhwutdwv.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\qoxoneqg.dll
C:\WINNT\system32\qoxoneqg.dll Has been deleted!

 Attempting to delete C:\WINNT\system32	vsgkipe.dll
C:\WINNT\system32	vsgkipe.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\umbembxy.dll
C:\WINNT\system32\umbembxy.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\yqlpeygw.exe
C:\WINNT\system32\yqlpeygw.exe Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.2.1

Checking Java version...

Sun Java not detected
Scan started at 20:48:03 09/10/2006

Listing files found while scanning....

No infected files were found.


Beginning removal...


Celui de HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 20:56:00, on 09/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32egsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Incredimail\bin\IncMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\WINNT\system32\92861357.dll (file missing)
O2 - BHO: (no name) - {35D719C4-7879-4BF1-A73B-AF222DD16C30} - C:\WINNT\system32\gebyy.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\msqgbcal.dll (file missing)
O2 - BHO: (no name) - {D12CF65C-9EF6-44F2-A475-B727085FD7CC} - C:\WINNT\system32\pmnlmjh.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: pmnlmjh - C:\WINNT\SYSTEM32\pmnlmjh.dll
O20 - Winlogon Notify: Run - C:\WINNT\system32\enj0l11m1.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

Bonne soirée

Claire

Claire-et-Tof · Answer

Salut,

j'espère que tu ne nous as pas oublié car il reste encore quelques chevaux.
Merci de ton aide.

(Le message est passé en résolu : est-ce normal ?)

Bonne journée.

Séb08 · Answer

Désolé ...

Je ne sais pas qui a coché .

remet un log Hijack 

a+

Claire-et-Tof · Answer

voilà

Logfile of HijackThis v1.99.1
Scan saved at 19:59:38, on 14/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {14D1A72D-8705-11D8-B120-0040F46CB696} - (no file)
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\ikfnipus.dll
O2 - BHO: (no name) - {35D719C4-7879-4BF1-A73B-AF222DD16C30} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BC0FA29E-09DF-453C-A610-32109430EFDC} - C:\WINNT\system32\ssqpm.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: Run - C:\WINNT\system32\enj0l11m1.dll (file missing)
O20 - Winlogon Notify: ssqpm - C:\WINNT\system32\ssqpm.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

Merci

Bonne soirée

Séb08 · Answer

Vundo est encore présent refait la manip cité + haut avec Vundofix STP

a+

Claire-et-Tof · Answer

Voici le rapport mais juste avant de demander de rebooter il me dit qu'il est impossible d'ouvrir Vundo....reg.

(je l'ai fait 3 fois)

Sun Java not detected
Scan started at 20:15:52 14/10/2006

Listing files found while scanning....

C:\WINNT\system32\ssqpm.dll
C:\WINNT\system32\mpqss.ini
C:\WINNT\system32\mpqss.bak1
C:\WINNT\system32\mpqss.bak2

Beginning removal...

 Attempting to delete C:\WINNT\system32\ssqpm.dll
C:\WINNT\system32\ssqpm.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\mpqss.ini
C:\WINNT\system32\mpqss.ini Has been deleted!

 Attempting to delete C:\WINNT\system32\mpqss.bak1
C:\WINNT\system32\mpqss.bak1 Has been deleted!

 Attempting to delete C:\WINNT\system32\mpqss.bak2
C:\WINNT\system32\mpqss.bak2 Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.2.2

Checking Java version...

Sun Java not detected
Scan started at 20:21:36 14/10/2006

Listing files found while scanning....

C:\WINNT\system32\byxxxvv.dll
C:\WINNT\system32\cbxvuro.dll
C:\WINNT\system32\cbxwwtu.dll
C:\WINNT\system32\ddccyxv.dll
C:\WINNT\system32\efcawwu.dll
C:\WINNT\system32\efccdaa.dll
C:\WINNT\system32\efcdded.dll
C:\WINNT\system32\efcywxx.dll
C:\WINNT\system32\gebbccd.dll
C:\WINNT\system32\hggddee.dll
C:\WINNT\system32\hggeedc.dll
C:\WINNT\system32\hggfeee.dll
C:\WINNT\system32\hgggdab.dll
C:\WINNT\system32\iifdeff.dll
C:\WINNT\system32\ikfnipus.dll
C:\WINNT\system32\jkkkkkl.dll
C:\WINNT\system32\khfcayx.dll
C:\WINNT\system32\khffdby.dll
C:\WINNT\system32\khfgfda.dll
C:\WINNT\system32\ljjihed.dll
C:\WINNT\system32\ljjklii.dll
C:\WINNT\system32
nnkjij.dll
C:\WINNT\system32
nnomnk.dll
C:\WINNT\system32\opnkkll.dll
C:\WINNT\system32\opnljjh.dll
C:\WINNT\system32\opnllml.dll
C:\WINNT\system32\pmnkhee.dll
C:\WINNT\system32\pmnlmjh.dll
C:\WINNT\system32\pmnmmli.dll
C:\WINNT\system32\qomklmn.dll
C:\WINNT\system32\qommjjh.dll
C:\WINNT\system32qrpmli.dll
C:\WINNT\system32qrqnnn.dll
C:\WINNT\system32\ssqrqpq.dll
C:\WINNT\system32	uvuspo.dll
C:\WINNT\system32\urqolmm.dll
C:\WINNT\system32\vtutstt.dll
C:\WINNT\system32\wvurqpo.dll
C:\WINNT\system32\xxyxuvu.dll
C:\WINNT\system32\yayaxvw.dll
C:\WINNT\system32\yayvvwt.dll

Beginning removal...

 Attempting to delete C:\WINNT\system32\byxxxvv.dll
C:\WINNT\system32\byxxxvv.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\cbxvuro.dll
C:\WINNT\system32\cbxvuro.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\cbxwwtu.dll
C:\WINNT\system32\cbxwwtu.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\ddccyxv.dll
C:\WINNT\system32\ddccyxv.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\efcawwu.dll
C:\WINNT\system32\efcawwu.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\efccdaa.dll
C:\WINNT\system32\efccdaa.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\efcdded.dll
C:\WINNT\system32\efcdded.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\efcywxx.dll
C:\WINNT\system32\efcywxx.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\gebbccd.dll
C:\WINNT\system32\gebbccd.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\hggddee.dll
C:\WINNT\system32\hggddee.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\hggeedc.dll
C:\WINNT\system32\hggeedc.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\hggfeee.dll
C:\WINNT\system32\hggfeee.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\hgggdab.dll
C:\WINNT\system32\hgggdab.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\iifdeff.dll
C:\WINNT\system32\iifdeff.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\ikfnipus.dll
C:\WINNT\system32\ikfnipus.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\jkkkkkl.dll
C:\WINNT\system32\jkkkkkl.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\khfcayx.dll
C:\WINNT\system32\khfcayx.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\khffdby.dll
C:\WINNT\system32\khffdby.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\khfgfda.dll
C:\WINNT\system32\khfgfda.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\ljjihed.dll
C:\WINNT\system32\ljjihed.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\ljjklii.dll
C:\WINNT\system32\ljjklii.dll Has been deleted!

 Attempting to delete C:\WINNT\system32
nnkjij.dll
C:\WINNT\system32
nnkjij.dll Has been deleted!

 Attempting to delete C:\WINNT\system32
nnomnk.dll
C:\WINNT\system32
nnomnk.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\opnkkll.dll
C:\WINNT\system32\opnkkll.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\opnljjh.dll
C:\WINNT\system32\opnljjh.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\opnllml.dll
C:\WINNT\system32\opnllml.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\pmnkhee.dll
C:\WINNT\system32\pmnkhee.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\pmnlmjh.dll
C:\WINNT\system32\pmnlmjh.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\pmnmmli.dll
C:\WINNT\system32\pmnmmli.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\qomklmn.dll
C:\WINNT\system32\qomklmn.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\qommjjh.dll
C:\WINNT\system32\qommjjh.dll Has been deleted!

 Attempting to delete C:\WINNT\system32qrpmli.dll
C:\WINNT\system32qrpmli.dll Has been deleted!

 Attempting to delete C:\WINNT\system32qrqnnn.dll
C:\WINNT\system32qrqnnn.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\ssqrqpq.dll
C:\WINNT\system32\ssqrqpq.dll Has been deleted!

 Attempting to delete C:\WINNT\system32	uvuspo.dll
C:\WINNT\system32	uvuspo.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\urqolmm.dll
C:\WINNT\system32\urqolmm.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\vtutstt.dll
C:\WINNT\system32\vtutstt.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\wvurqpo.dll
C:\WINNT\system32\wvurqpo.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\xxyxuvu.dll
C:\WINNT\system32\xxyxuvu.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\yayaxvw.dll
C:\WINNT\system32\yayaxvw.dll Has been deleted!

 Attempting to delete C:\WINNT\system32\yayvvwt.dll
C:\WINNT\system32\yayvvwt.dll Has been deleted!

Performing Repairs to the registry.
Done!


Sun Java not detected
Scan started at 20:27:55 14/10/2006

Listing files found while scanning....

No infected files were found.

Séb08 · Answer

Remet un log Hijack STP

Claire-et-Tof · Answer

Logfile of HijackThis v1.99.1
Scan saved at 00:23:21, on 15/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {14D1A72D-8705-11D8-B120-0040F46CB696} - (no file)
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\ikfnipus.dll (file missing)
O2 - BHO: (no name) - {35D719C4-7879-4BF1-A73B-AF222DD16C30} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BC0FA29E-09DF-453C-A610-32109430EFDC} - C:\WINNT\system32\ssqpm.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: Run - C:\WINNT\system32\enj0l11m1.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

Séb08 · Answer

Relance Hijack , choisi « do a scan only » coches ces lignes :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm 

O2 - BHO: (no name) - {14D1A72D-8705-11D8-B120-0040F46CB696} - (no file)
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\ikfnipus.dll (file missing)
O2 - BHO: (no name) - {35D719C4-7879-4BF1-A73B-AF222DD16C30} - (no file) 
O2 - BHO: (no name) - {BC0FA29E-09DF-453C-A610-32109430EFDC} - C:\WINNT\system32\ssqpm.dll (file missing) 

O4 - HKLM\..\RunServices: [Windows APCI Verifier] dev.exe

O20 - Winlogon Notify: Run - C:\WINNT\system32\enj0l11m1.dll (file missing) 

O23 - Service: Microsoft Languages Service (Windows Languages Service) - Unknown owner - C:\WINNT\csrss.exe (file missing)

Ensuite cliques sur « fix checked ».

=====================================
recherche et supprime si présent ces fichiers en gras :

C:\WINNT\system32\ikfnipus.dll
C:\WINNT\system32\ssqpm.dll
C:\WINNT\system32\enj0l11m1.dll
C:\WINNT\csrss.exe
dev.exe

====================================

Arrête ce service Microsoft Languages Service   pour ça fais cette manip :
Démarrer -> executer tape services.msc  clic droit sur le service cité - > propriétés et dans "type de démarrage" et mets le sur « arrêté «  et « désactivé ».

et met celui là ewido anti-spyware 4.0 guard sur "manuel".

Vide ta corbeille, redémarre ton PC installe ce parefeu :

Kério (pare feu): 
www.01net.com 
lire le tuto: pour configurer et comprendre Kerio 
https://kerio.probb.fr/

Renomme Hijack comme à l'origine et dis moi ou en sont tes probs.

a+

Claire-et-Tof · Answer

On a trois fois un message de Trojan Scanner au démarrage  concernant : "sockspy.dll"
dans hkey_local_machine\software\microsoft\windowsNT\currentVersion\Windows\"Applnit_DLLs"
 
Et le rapport Hijack :

Logfile of HijackThis v1.99.1
Scan saved at 15:38:49, on 15/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\system32\mobsync.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Incredimail\bin\IncMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Séb08 · Answer

Apparemment tu n'as plus Bitdefender donc tu peux supprimer la dll qui en fait partie c'est à dire sockspy.dll

Donc relance Hijack et fixe cette ligne : 

O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll 

recherche et supprimes la dll (sockspy.dll ) et ça devrait le faire .

Vide ta poubelle , redémarre tono PC et dis moi ou en sont tes probs.

a+

Claire-et-Tof · Answer

Salut,

plus de cheval à l'horizon

voici log hijack

Logfile of HijackThis v1.99.1
Scan saved at 19:42:41, on 16/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\mobsync.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Hijackthis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - update.microsoft.com
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Encore une question : comment remettre les mises à jour automatiques (Windows) car tous dans la fenêtre est masquée.

Merci encore.

Bonne soirée.

Séb08 · Answer

Ok bien ça m'a l'air clean :)

Mets ce service: 

ewido anti-spyware 4.0 guard 

sur "manuel" pour ça fais ceci : 

Démarrer ->executer ->tape service.msc fais un clic droit sur le service cité -> propriété et dans type de démarrage mets le sur "manuel".

Encore une question : comment remettre les mises à jour automatiques (Windows) car tous dans la fenêtre est masquée.

Quelle fenêtres ?

Démarrer - > panneau de config (en affichage classique) -> mise à jour automatiques et là tu choisis le choix que tu veux.

A lire pour en savoir + ;-)  :

support.microsoft.com/kb/327850/

a+

Claire-et-Tof · Answer

Salut,

désolée de ne pas avoir répondu plus tot.

Merci pour tes conseils

Concernant les mises à jour automatique, le pb est justement que ce dont tu me parles est tout grisé donc pas de choix possible.
D'aiileurs ce service est absent de services.msc.

Bon fin de we.

Claire

Séb08 · Answer

tu es bien connecté a ton PC en tant qu'administrateur ?

Claire-et-Tof · Answer

Oui

Séb08 · Answer

fais cette vérif :

Démarrer -> panneau de config (en affichage classique) -> Outils d'administration > Services > Mise A Jour automatique > l'état est bien "démarré" et type de démarrage sur "automatique"..

a+

Claire-et-Tof · Answer

En fait c'est ce que j'avais dit, mise à jour n'est pas présent dans services.

Séb08 · Answer

Fais ceci pour vérif dans ta base de registre : démarrer -> executer -> tape regedit Suis la branche de la base (BDR) : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv Modifier la valeur DWORD : Start Valeur : 4 <--- mise à jour désactivé Valeur : 3 <--- mise à jour en manuel Valeur : 2 <--- mise à jour en auto Si la valeur chez toi est sur 4 mets la sur 2 (ou 3 comme tu veux) et redémarre ton PC pour que la modif prenne effet. a +

Claire-et-Tof · Answer

Elle est déjà sur 2

Séb08 · Answer

je pense que ton PC ne te reconnait pas en tant qu'administrateur...

Fais ceci :

démarrer -> paneau de config (en affichage par catégories) - > centre de securité clique sur "vérifier les paramètres" est ce que tu as accès à "activer les mises à jour automatiques" ?

Si "oui" clique dessus

Si "non" on verra + tard .

bonne soirée. :)

a+

Claire-et-Tof · Answer

je ne trouve pas l' affichage par catégories donc ni centre de sécurité

Séb08 · Answer

c'est normal tu es sous Windows 2000...

j'avais oublié ! lol

Je coupe.

a+

lea · Answer

Au secours s'il vous plait!!!

J'écris à la suite de ce message car il m'est IMPOSSIBLE d'ouvrir mon propre sujet, la fenetre se ferme automatiquement a chaque fois, et j'ai vraiment un gros soucis.
J'ai attrapé un cheval de troie il y a de cela 4 mois, j'ai essayé par tous les moyens de le supprimer, rien n'y faisait. J'ai donc reformater mon pc, mais en le redemarrant, le virus s'est de suite déclanché. Je pense que c'est à cause de mon 2eme disque dur ki été branché lorsque le virus était apparu et qui n'a pas été formaté car il contenait tous mes dossiers.
Je n'arrive plus à ouvrir une seule fenetre, que se soit pour aller sur internet ou ouvrir un simple dossier. Elle s'ouvre 1 seconde et disparait de suite. Le seul moyen que j'ai trouvé c'est de faire executer C: et la fenetre s'ouvre et reste.
J'ai essayer d'ouvrir ediwo, la fenetre se referme, idem pr HijackThis. Je ne peux ouvrir aucun programme.
J'ai un 2eme PC, et le virus s'est installé egalement. Il commence a faire pareil que mon 1 PC. Seule la fenetre internet arrive a s'ouvrir, mais elle se ferme quelque fois, comme par exemple pour poster un nouveau msg sur ce forum. J'ai réussi cependant à utiliser HijackThis mais non ediwo.
Voilà ce que cela me donne:

Logfile of HijackThis v1.99.1
Scan saved at 23:04:44, on 11/11/2006
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\bootini.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\atwtusb.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\mhosts.exe
C:\Program Files\SAGEM\SAGEM F@st800\dslmon.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
D:\DA\docs\wrapper.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\DA\docs\jre\bin\java.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\LA4771~1\LOCALS~1\Temp\Rar$EX00.938\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe mhosts.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,mhosts.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [Microsoft Security SP2 Update] "%SystemRoot%\securityupdate.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\FR\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=122105 serial=DR12WEX-1504397-KTY lang=FR
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ms Java for Windows NT] mhosts.exe
O4 - HKLM\..\Run: [Microsoft Windows] bootini.exe
O4 - HKCU\..\Run: [Ms Java for Windows NT] mhosts.exe
O4 - HKCU\..\Run: [Microsoft Windows] bootini.exe
O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - 
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC6EA352-50D0-4D43-98BE-C85BE5FA4F0A}: NameServer = 80.10.246.130 80.10.246.3
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: dllmgr64 - Unknown owner - C:\WINDOWS\dllmgr64.exe (file missing)
O23 - Service: Local Security Authority Subsystem Service (lsass) - Unknown owner - C:\WINDOWS\lsass.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maya 6.5 Documentation Server (maya65docserver) - Unknown owner - D:\DA\docs\wrapper.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: sysmgr64 - Unknown owner - C:\WINDOWS\sysmgr64.exe (file missing)

S'il vous plait, pouvez-vous me dire ce que je dois faire, car là je suis a bout. Mes 2 pc ne fonctionnent plus du tout et j'en ai vraiment besoin. Merci infiniment pour vos réponses, que j'attend avec impatience.
lea

Séb08 · Answer

slt,

c'est bien parce que tu ne peux pas créer de post ...

Relance Hijack,choisi « do a scan only » ou « scanner seulement » coches ces lignes :

F2 - REG:system.ini: Shell=Explorer.exe mhosts.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,mhosts.exe 

O4 - HKLM\..\Run: [Ms Java for Windows NT] mhosts.exe
O4 - HKLM\..\Run: [Microsoft Windows] bootini.exe
O4 - HKCU\..\Run: [Ms Java for Windows NT] mhosts.exe
O4 - HKCU\..\Run: [Microsoft Windows] bootini.exe 


Ferme toutes les fenêtres actives autres que HijackThis!, navigateur inclus, puis clique « Fix checked » ou « fixer objet ». Ferme HijackThis!

================================

Arrête ce service

dllmgr64

Local Security Authority Subsystem Service

Maya 6.5 Documentation Server

sysmgr64

pour ça fais cette manip :

Démarrer -> executer tape services.msc  clic droit sur le service cité - > propriétés et dans "type de démarrage" et mets le sur « arrêté »  et « désactivé ».

================================

recherche et supprime ces fichiers en gras (si présents ) :

C:\WINDOWS\dllmgr64.exe
C:\WINDOWS\lsass.exe<--- pour celui là attention c'est bien dans C:\WINDOWS

D:\DA\docs\wrapper.exe

mhosts.exe
bootini.exe

Regarde bien et applique ce qui est indiqué en gras 


Télécharge et installe ce log :

ewido (gratuit même après la période d’essai) 
Téléchargement :
ewido
Cliques sur « update » fais les mise à jour ensuite clique sur « scanner » puis sur « complete scan system ».
Tuto pour la version 4 d’Ewido :
https://www.malekal.com/tutorial-et-guide-ewido-v4/

Met le à jour comme indiqué, lance le « delete » (supprime) tout ce qu’il te trouve et copie/colle moi le rapport.

A+

lea · Answer

Bonsoir,

Merci infiniment pour votre aide, j'ai fait tout ce que vous m'avez dit, j'espere que je ne me suis pas trompé. Voilà le rapport d'ewido :

Résultat de l'analyse:	

C:\WINDOWS\system32\&#1109;&#1088;oolsv.exe -> Adware.PurityScan : Ignoré.
C:\Documents and Settings\léa\Local Settings\Temp	emp.frF55D\up.dat -> Adware.WinAntiVirus : Ignoré.
C:\System Volume Information\_restore{CFFB184F-5D17-4596-A213-B5DD534DB57D}\RP283\A0051448.exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{CFFB184F-5D17-4596-A213-B5DD534DB57D}\RP283\A0051450.exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\02734_netapi.exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\20248_netapi.exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\bootini.exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\4HE3O1AJ\70432_netapi[1].exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FTMFWXE3\03213_netapi[1].exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\VY8QKQTS\05752_netapi[1].exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\VY8QKQTS\58634_netapi[1].exe -> Backdoor.PcClient.qf : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Fichiers communs\fifi\fifid\vocabulary -> Downloader.TSUpdate.j : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\léa\Local Settings\Temporary Internet Files\Content.IE5\EBEJELAF\send_ocx_sof[1].html -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Ignoré.
D:\disc\3DAliens Glu3D v1.3.02 for Maya 5-6 incl Patch-Bazuka.rar/3DAliens Glu3D v1.3.02 for Maya 5-6\glu3Dv1.3.02_M5.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Ignoré.
D:\disc\3DAliens Glu3D v1.3.02 for Maya 5-6 incl Patch-Bazuka.rar/3DAliens Glu3D v1.3.02 for Maya 5-6\glu3Dv1.3.02_M6.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Ignoré.
D:\disc\Turtle 1.1.5 - Maya 6.0-6.5 Patch - Bazuka.rar/Turtle_E_M6_1151.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Ignoré.
D:\emule\do\3DAliens Glu3D v1.3.02 for Maya 5-6 incl Patch-Bazuka.rar/3DAliens Glu3D v1.3.02 for Maya 5-6\glu3Dv1.3.02_M5.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Ignoré.
D:\emule\do\3DAliens Glu3D v1.3.02 for Maya 5-6 incl Patch-Bazuka.rar/3DAliens Glu3D v1.3.02 for Maya 5-6\glu3Dv1.3.02_M6.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Ignoré.
C:\Documents and Settings\léa\Cookies\léa@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\léa\Cookies\léa@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\léa\Cookies\léa@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\léa\Cookies\léa@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\léa\Cookies\léa@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\léa\Cookies\léa@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\léa\Cookies\léa@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.

J'arrive maintenant à ouvrir mes dossier sans que la page se referme. Y a t-il d'autre chose a faire?

Et sinon, qu'est ce que je peux faire pour mon 1er pc? Il m'est impossible d'ouvrir Hijackthis et ediwo. Avez-vous une idee?
merci encore.

Lea

Séb08 · Answer

Refait un scan avec Ewido et supprime (delete) tout ce qu'il te trouve tu as certains element en Ignoré regarde ton rapport...

Donc refait le en supprimant bien tout et colle le rapport.

a+

Séb08 · Answer

Ou en sont tes probs toujours pareil ?

Tu as essayé de lancer Ewido en mode sans echec ?

a+

lea · Answer

J'ai réussi une premiere fois a lancer ediwo en mode sans echec et j'ai supprimé tous les fichiers trouvés (67  au total). Mais je n'ai pas pu copier le rapport, j'ai donc voulu réouvrir ediwo et depuis il ne s'ouvre plus du tout, meme en mode sans echec. Que faire?

Yousstar · Answer

svp mwa jé télécharger une video pas tré catholik et jé u des virus ki son de plus en plus nombreux il me fodré de l'aide c l'ordi a mn grd frer et il rentre lundi svp jsui trés effrayé jvous remercie de me repondre ainsi ke de m'indiké la procédure a suivre pour les suprimer jé osi installer AVG et AVAST veuillez m'aidé

Cheval de Troie : De l'aide !!

50 réponses

Discussions similaires

Newsletters