Bonjour, j'ai des virus dans mon ordi.Trojan vundo,Trojan Nebuler,Idialer...et tout a l'heure il est apparu pleins de trucs sur mon ecran et ca disait que le message que j'essayait d'envoyer ne pouvait pas etre envoyé et ca n'était pas moi qui avait écrit ca.Tout s'est mis a défiler a une vitesse folle...J'ai utilisé sybot,ad-aware,avg antispyware...et rien n'y fait.Et je l'ai fait en mode ss échecs et en ayant désativer la restauration du systeme commequelqu'un m'a dit. Je ne sais plus quoi faire...Quelqu'un peut me guider?Je crois que je ne me suis pas bien pris... Merci!

Trojan Vundo,Trojan Nébuler,Idialer...

Réponse 41 / 59

Séb08 Messages postés 16503 Date d'inscription dimanche 13 novembre 2005 Statut Contributeur Dernière intervention 17 février 2023 1 430
17 janv. 2007 à 22:06

slt vous 2,

désolé de m'incruster ...

la version de Smitfraudfix est périmée.

Nancy est ce que tu as encore ces dll ?

C:\WINDOWS\system32\ighquajs.dll
C:\WINDOWS\system32\iuwiglbw.dll

Elle n'ont pas été supprimées durant le scan en ligne Bitdefender.

Si oui supprime les, vide ta poubelle , redémarre ton PC et dis nous ou en sont tes probs.

Ensuite refait un scan en ligne ...

scanne ton PC avec cet antivirus en ligne (sous IE et accepte l’activX) :
http://www.bitdefender.fr/bd/site/search.php#
Clique sur « Bitdefender scan on line » suis les instructions.
Démo (merci à balltrap pour cette démo) :
http://pageperso.aol.fr/rginformatique/mapage/defender.htm

Et colle le rapport.

je retourne voir le match ! :)

A+

Nancy
19 janv. 2007 à 06:12

Ca me dit que je suis toujours infecté...Et depuis que j'ai commencé ces manoeuvres,norton a detecté:
-Trojan Adclicker
-Infostealer
-Adaware Purity Scan

BitDefender Online Scanner

Rapport d'analyse généré à: Thu, Jan 18, 2007 - 23:43:05

Voie d'analyse: C:\;D:\;E:\;

Statistiques

Temps
01:20:27

Fichiers
320994

Directoires
4778

Secteurs de boot
4

Archives
10252

Paquets programmes
13745

Résultats

Virus identifiés
9

Fichiers infectés
69

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
112

Info sur les moteurs

Définition virus
381234

Version des moteurs
AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)

Analyse des plugins
14

Archive des plugins
38

Unpack des plugins
6

E-mail plugins
6

Système plugins
1

Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
*;

Excludez les extensions

Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui

Fichier analysé
Statut

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\036E7822.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\036E7822.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\036E7822.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0D410278.000=>(Quarantine-2)
Infecté par: Trojan.Downloader.PurityScan.BP

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0D410278.000=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0D410278.000=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0FE04AB0.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0FE04AB0.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0FE04AB0.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10326456.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10326456.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10326456.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10456041.dll=>(Quarantine-2)
Infecté par: Trojan.Juan.D

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10456041.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10456041.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\105C0628.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\105C0628.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\105C0628.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\195165C1.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\195165C1.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\195165C1.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21181C08.dll=>(Quarantine-2)
Infecté par: Trojan.Juan.D

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21181C08.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21181C08.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\212543F9.dll=>(Quarantine-2)
Infecté par: Trojan.Juan.D

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\212543F9.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\212543F9.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\273D60BD.exe=>(Quarantine-2)
Détecté avec: Dialer.Porn.Y

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\273D60BD.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\273D60BD.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29B63204.exe=>(Quarantine-2)
Détecté avec: Dialer.Porn.Y

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29B63204.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29B63204.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35156B37.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35156B37.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35156B37.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\385B3C72.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\385B3C72.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\385B3C72.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38653A67.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38653A67.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\38653A67.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40370141.exe=>(Quarantine-2)
Détecté avec: Dialer.Porn.Y

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40370141.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40370141.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49A13805.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49A13805.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49A13805.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A5B1138.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A5B1138.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A5B1138.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4AE0560E.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4AE0560E.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4AE0560E.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B1B49CD.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B1B49CD.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B1B49CD.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B2F45B8.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B2F45B8.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B2F45B8.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5B837B37.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5B837B37.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5B837B37.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5C3A2A6D.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5C3A2A6D.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5C3A2A6D.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5FFD0C49.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5FFD0C49.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5FFD0C49.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6035560C.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6035560C.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6035560C.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\616C258A.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\616C258A.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\616C258A.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61E86102.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61E86102.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61E86102.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61FF06E8.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61FF06E8.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61FF06E8.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73D20829.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73D20829.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\73D20829.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74826367.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74826367.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74826367.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74900B58.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74900B58.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74900B58.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74EB5014.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74EB5014.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74EB5014.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74FC2202.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74FC2202.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74FC2202.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7574593C.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7574593C.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7574593C.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75C672E2.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75C672E2.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75C672E2.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\784F1617.exe=>(Quarantine-2)
Détecté avec: Dialer.Porn.Y

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\784F1617.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\784F1617.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B2D332E.dll=>(Quarantine-2)
Infecté par: Trojan.Juan.D

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B2D332E.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B2D332E.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B3A5B20.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B3A5B20.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B3A5B20.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B6152F5.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B6152F5.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B6152F5.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B7B4C48.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B7B4C48.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B7B4C48.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BD339E7.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BD339E7.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BD339E7.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BEA5FCD.dll=>(Quarantine-2)
Infecté par: MemScan:Trojan.Virtumod.EB

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BEA5FCD.dll=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BEA5FCD.dll=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BEF2A1B.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BEF2A1B.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BEF2A1B.exe=>(Quarantine-2)
Supprimé

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7C683B96.exe=>(Quarantine-2)
Infecté par: Trojan.Agent.ACL

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7C683B96.exe=>(Quarantine-2)
Echec de la désinfection

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7C683B96.exe=>(Quarantine-2)
Supprimé

C:\Program Files\Plus!\Themes\noelourson\cmas_eve.exe=>wise0018
Détecté avec: Application.Adware.NewDotNet.B.Dropper

C:\Program Files\Plus!\Themes\noelourson\cmas_eve.exe=>wise0018
Supprimé

C:\Program Files\Plus!\Themes\noelourson\cmas_eve.exe
Echec de la mise à jour

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026563.dll
Infecté par: MemScan:Trojan.Downloader.ConHook.J

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026563.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026563.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026564.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026564.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026564.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026565.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026565.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026565.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026566.dll
Infecté par: MemScan:Trojan.Downloader.ConHook.J

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026566.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026566.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026567.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026567.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026567.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026568.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026568.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026568.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026569.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026569.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026569.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026570.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026570.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026570.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026571.dll
Infecté par: MemScan:Trojan.Downloader.ConHook.J

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026571.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026571.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026572.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026572.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026572.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026573.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026573.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026573.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026574.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026574.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026574.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026575.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026575.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026575.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026576.dll
Infecté par: MemScan:Trojan.Downloader.ConHook.J

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026576.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026576.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026577.dll
Infecté par: Trojan.Spy.VBStat.B

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026577.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP175\A0026577.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP181\A0028730.dll
Infecté par: Trojan.Juan.D

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP181\A0028730.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP181\A0028730.dll
Supprimé

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP181\A0028766.dll
Infecté par: Trojan.Virtumod.DG

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP181\A0028766.dll
Echec de la désinfection

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP181\A0028766.dll
Supprimé

C:\WINDOWS\system32\bcdouvdp.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\bcdouvdp.dll
Echec de la désinfection

C:\WINDOWS\system32\bcdouvdp.dll
Supprimé

C:\WINDOWS\system32\bofalmvy.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\bofalmvy.dll
Echec de la désinfection

C:\WINDOWS\system32\bofalmvy.dll
Supprimé

C:\WINDOWS\system32\hxnrysea.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\hxnrysea.dll
Echec de la désinfection

C:\WINDOWS\system32\hxnrysea.dll
Supprimé

C:\WINDOWS\system32\ibujbtbw.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\ibujbtbw.dll
Echec de la désinfection

C:\WINDOWS\system32\ibujbtbw.dll
Supprimé

C:\WINDOWS\system32\lsjkamlk.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\lsjkamlk.dll
Echec de la désinfection

C:\WINDOWS\system32\lsjkamlk.dll
Supprimé

C:\WINDOWS\system32\pvyshtdk.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\pvyshtdk.dll
Echec de la désinfection

C:\WINDOWS\system32\pvyshtdk.dll
Supprimé

C:\WINDOWS\system32\qpjkdbnm.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\qpjkdbnm.dll
Echec de la désinfection

C:\WINDOWS\system32\qpjkdbnm.dll
Supprimé

C:\WINDOWS\system32\thjvroxq.dll
Infecté par: Trojan.Spy.VBStat.B

C:\WINDOWS\system32\thjvroxq.dll
Echec de la désinfection

C:\WINDOWS\system32\thjvroxq.dll
Supprimé

Réponse 42 / 59

Nancy
19 janv. 2007 à 04:04

Voila pour HijackThis,je vais voir pour ce que tu me dis Sebo8 et je reviens...

Logfile of HijackThis v1.99.1
Scan saved at 22:09:45, on 2007-01-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ProShow\ScsiAccess.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MétéoMédia\WeatherEye.exe
C:\Program Files\Presto Notes\PrestoNotes.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Post it\PsnLite.exe
C:\Program Files\Aide mémoire\TrayIcon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\POSTIT~1\PSNGive.exe
C:\PROGRA~1\INCRED~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\Nancy.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ca/ig/dell?hl=fr&client=dell-row&channel=ca&ibd=3061015
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~2\COPERN~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Clone CD\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [don't see] C:\Program Files\Don't see!\don't see.exe
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\Bearflix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\Bit Torrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MétéoIMédia] C:\Program Files\MétéoMédia\WeatherEye.exe
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [PrestoNotes] C:\Program Files\Presto Notes\PrestoNotes.exe
O4 - Startup: Aide mémoire.lnk = ?
O4 - Startup: wkcalrem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\Post it\PsnLite.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Chercher avec Copernic - C:\Program Files\Copernic 2001 Basic\Search Extension.htm
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE64AF62-15E5-40E1-8716-9F1DA029B2D6}: NameServer = 205.205.154.252 205.205.154.251
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\ProShow\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Réponse 43 / 59

Séb08 Messages postés 16503 Date d'inscription dimanche 13 novembre 2005 Statut Contributeur Dernière intervention 17 février 2023 1 430
19 janv. 2007 à 11:13

Tu as bien fait la manip de Regis aussi ?

a+

Nancy
19 janv. 2007 à 14:10

Oui mais dans la manip avec processxp il y en avait juste un que j'avais sur tout ceux qu'il me disait de détruire.Est-ce normal ou j'aurais dû avoir tout ce qu'il me disait d'effacer?POur les reste j'ai tout fait comme c'est écrit.

A+

Réponse 44 / 59

Regis59 Messages postés 21143 Date d'inscription mardi 27 juin 2006 Statut Contributeur sécurité Dernière intervention 22 juin 2016 1 321
19 janv. 2007 à 14:18

Salut

Retelecharge Smitfraudfix:

Télécharge ceci: (merci a S!RI pour ce programme).
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

A+

Réponse 45 / 59

Nancy
19 janv. 2007 à 14:31

Voila...

SmitFraudFix v2.125

Rapport fait à 8:37:23,43, 2007-01-19
Executé à partir de C:\Documents and Settings\Nancy Lefebvre\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nancy Lefebvre

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nancy Lefebvre\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\NANCYL~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Réponse 46 / 59

Séb08 Messages postés 16503 Date d'inscription dimanche 13 novembre 2005 Statut Contributeur Dernière intervention 17 février 2023 1 430
19 janv. 2007 à 15:30

ta version de smitfraudfix n'est pas bonne .

Donc supprime la et télécharge cele là ;

Télécharges smitfraudfix:(merci a S!RI pour ce programme)

En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu le décompresses tu doubles cliques sur smitfraudfix.cmd et tu choisis l option 1
cela vas générer un rapport,copie/colle le.

a+

Réponse 47 / 59

Regis59 Messages postés 21143 Date d'inscription mardi 27 juin 2006 Statut Contributeur sécurité Dernière intervention 22 juin 2016 1 321
19 janv. 2007 à 15:33

Salut Seb et Nancy ;)

Bha alors Nancy, tu nous ecoutes pas?? :-D

A+

Séb08 Messages postés 16503 Date d'inscription dimanche 13 novembre 2005 Statut Contributeur Dernière intervention 17 février 2023 1 430
19 janv. 2007 à 15:34

slt Quentin,

Prends la suite si t'as le temps, je dois m'absenter.

a+ ;-)

Réponse 48 / 59

Regis59 Messages postés 21143 Date d'inscription mardi 27 juin 2006 Statut Contributeur sécurité Dernière intervention 22 juin 2016 1 321
19 janv. 2007 à 16:31

Toute maniere , on est 2 sur le poste !

Donc on avance a 2 quand on est dispo ;)

A+

Réponse 49 / 59

Nancy
19 janv. 2007 à 16:49

La ca devrait etre le bon...désolé!

SmitFraudFix v2.132

Rapport fait à 10:54:29,95, 2007-01-19
Executé à partir de C:\Documents and Settings\Nancy Lefebvre\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nancy Lefebvre

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nancy Lefebvre\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\NANCYL~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Réponse 50 / 59

Regis59 Messages postés 21143 Date d'inscription mardi 27 juin 2006 Statut Contributeur sécurité Dernière intervention 22 juin 2016 1 321
19 janv. 2007 à 18:15

Ok,

remet un hijack this

a+

Réponse 51 / 59

Nancy
19 janv. 2007 à 20:01

Logfile of HijackThis v1.99.1
Scan saved at 14:06:56, on 2007-01-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\MétéoMédia\WeatherEye.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Post it\PsnLite.exe
C:\Program Files\Aide mémoire\TrayIcon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
C:\PROGRA~1\POSTIT~1\PSNGive.exe
C:\PROGRA~1\INCRED~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Hijackthis\nancy.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ca/ig/dell?hl=fr&client=dell-row&channel=ca&ibd=3061015
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~2\COPERN~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Clone CD\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [don't see] C:\Program Files\Don't see!\don't see.exe
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\Bearflix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\Bit Torrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\Incredimail\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MétéoIMédia] C:\Program Files\MétéoMédia\WeatherEye.exe
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - Startup: Aide mémoire.lnk = ?
O4 - Startup: wkcalrem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\Post it\PsnLite.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Chercher avec Copernic - C:\Program Files\Copernic 2001 Basic\Search Extension.htm
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE64AF62-15E5-40E1-8716-9F1DA029B2D6}: NameServer = 205.205.154.252 205.205.154.251
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Réponse 52 / 59

Regis59 Messages postés 21143 Date d'inscription mardi 27 juin 2006 Statut Contributeur sécurité Dernière intervention 22 juin 2016 1 321
19 janv. 2007 à 21:04

ok et un silent runner stp

Réponse 53 / 59

Nancy
20 janv. 2007 à 00:06

Silent Runners.vbs", revision R50, https://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{B038E637-0A64-1036-0331-060506220002}" = ""C:\Program Files\Fichiers communs\{B038E637-0A64-1036-0331-060506220002}\Update.exe" mc-110-12-0000272" [file not found]

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"MsnMsgr" = ""C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background" [MS]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"BitTorrent" = ""C:\Program Files\Bit Torrent\bittorrent.exe" --force_start_minimized" [file not found]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"]
"IncrediMail" = "C:\Program Files\Incredimail\IncrediMail\bin\IncMail.exe /c" ["IncrediMail, Ltd."]
"MétéoIMédia" = "C:\Program Files\MétéoMédia\WeatherEye.exe" ["MétéoMédia/The Weather Network"]
"Wallpaper" = ""C:\Program Files\Wallpaper\Wallpaper.exe" Starter" [file not found]
"CursorXP" = "C:\Program Files\CursorXP\CursorXP.exe" [" "]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"]
"CTxfiHlp" = "CTXFIHLP.EXE" ["Creative Technology Ltd"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"DMXLauncher" = "C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [null data]
"CTDVDDET" = ""C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"" ["Creative Technology Ltd"]
"VolPanel" = ""C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r" ["Creative Technology Ltd"]
"AudioDrvEmulator" = ""C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"" ["Creative Technology Ltd."]
"UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."]
"DLA" = "C:\WINDOWS\System32\DLA\DLACTRLW.EXE" ["Sonic Solutions"]
"ISUSPM Startup" = "C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"]
"ISUSScheduler" = ""C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
"MSKDetectorExe" = "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall" ["McAfee, Inc."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"CloneCDTray" = ""C:\Program Files\Clone CD\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."]
"don't see" = "C:\Program Files\Don't see!\don't see.exe" [file not found]
"BearFlix" = ""C:\Program Files\Bearflix\BearFlix.exe" /pause" [file not found]
"NeroFilterCheck" = "C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" ["Nero AG"]
"ccApp" = ""C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\Spybot\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{5CA3D70E-1895-11CF-8E15-001234567890}\(Default) = (no title provided)
-> {HKLM...CLSID} = "DriveLetterAccess"
\InProcServer32\(Default) = "C:\WINDOWS\System32\DLA\DLASHX_W.DLL" ["Sonic Solutions"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]
{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Windows Live Sign-in Helper"
\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS]
{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}\(Default) = "NAV Helper"
-> {HKLM...CLSID} = "CNavExtBho Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
{CA6319C0-31B7-401E-A518-A07C3DB8F777}\(Default) = (no title provided)
-> {HKLM...CLSID} = "CBrowserHelperObject Object"
\InProcServer32\(Default) = "C:\Program Files\BAE\BAE.dll" ["Dell Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"
-> {HKLM...CLSID} = "DriveLetterAccess"
\InProcServer32\(Default) = "C:\WINDOWS\System32\DLA\DLASHX_W.DLL" ["Sonic Solutions"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Mes dossiers de partage"
\InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.0.0812.00.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{ABC70703-32AF-11d4-90C4-D483A70F4825}" = "CMenuExtender"
-> {HKLM...CLSID} = "CMenuExtender"
\InProcServer32\(Default) = "C:\Program Files\iColorFolder\CMExt.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{93994DE8-8239-4655-B1D1-5F4E91300429}" = (no title provided)
-> {HKLM...CLSID} = "DVDIdleShell Class"
\InProcServer32\(Default) = "C:\PROGRA~1\DVDCSS~1\DVDREG~1\DVDShell.dll" ["Fengtao Software Inc."]
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> winhld32\DLLName = "winhld32.dll" [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
-> {HKLM...CLSID} = "IEContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
CMenuExtender\(Default) = "{ABC70703-32AF-11d4-90C4-D483A70F4825}"
-> {HKLM...CLSID} = "CMenuExtender"
\InProcServer32\(Default) = "C:\Program Files\iColorFolder\CMExt.dll" [file not found]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
-> {HKLM...CLSID} = "IEContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"]

Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoCDBurning" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{Prevent access to registry editing tools}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Nancy Lefebvre\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "Nancy Lefebvre" & "All Users" startup folders:
----------------------------------------------------------------

C:\Documents and Settings\Nancy Lefebvre\Menu Démarrer\Programmes\Démarrage
"Aide mémoire" -> shortcut to: "C:\Program Files\Aide mémoire\TrayIcon.exe" [null data]
"wkcalrem" -> shortcut to: "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe" ["Microsoft® Corporation"]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Digital Line Detect" -> shortcut to: "C:\Program Files\Digital Line Detect\DLG.exe" ["BVRP Software"]
"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Post-it® Software Notes Lite" -> shortcut to: "C:\Program Files\Post it\PsnLite.exe -RegRun" ["3M"]

Enabled Scheduled Tasks:
------------------------

"Norton AntiVirus - Effectuer une analyse complète du système - Nancy Lefebvre" -> launches: "C:\PROGRA~1\NORTON~1\Navw32.exe /TASK:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 16 - 17

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{C4069E3A-68F1-403E-B40E-20066696354B}"
-> {HKLM...CLSID} = "Norton AntiVirus"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}"
-> {HKLM...CLSID} = "Copernic Agent"
\InProcServer32\(Default) = "C:\Program Files\Copernic Agent\CopernicAgentExt.dll" ["Copernic Technologies Inc."]
"{C4069E3A-68F1-403E-B40E-20066696354B}"
-> {HKLM...CLSID} = "Norton AntiVirus"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
"{F2CF5485-4E02-4F68-819C-B92DE9277049}"
-> {HKLM...CLSID} = "&Links"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}" = (no title provided)
-> {HKLM...CLSID} = "Copernic Agent"
\InProcServer32\(Default) = "C:\Program Files\Copernic Agent\CopernicAgentExt.dll" ["Copernic Technologies Inc."]
"{C4069E3A-68F1-403E-B40E-20066696354B}" = "Norton AntiVirus"
-> {HKLM...CLSID} = "Norton AntiVirus"
\InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{6F480F82-C3A6-4D35-96F7-B297AD49FBE8}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Résultats de Copernic Agent"
\InProcServer32\(Default) = "C:\Program Files\Copernic Agent\CopernicAgentExt.dll" ["Copernic Technologies Inc."]
{F2E259E8-0FC8-438C-A6E0-342DD80FA53E}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Copernic Agent"
\InProcServer32\(Default) = "C:\Program Files\Copernic Agent\CopernicAgentExt.dll" ["Copernic Technologies Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Console Java (Sun)"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.5.0_10"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_10"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."]

{193B17B0-7C9F-4D5B-AEAB-8D3605EFC084}\
"MenuText" = "Démarrer Copernic Agent"
"Exec" = "C:\PROGRA~1\COPERN~2\COPERN~1.EXE" ["Copernic Technologies Inc."]

{688DC797-DC11-46A7-9F1B-445F4F58CE6E}\
"ButtonText" = "Copernic Agent"
"Exec" = "C:\PROGRA~1\COPERN~2\COPERN~1.EXE" ["Copernic Technologies Inc."]

{85D1F590-48F4-11D9-9669-0800200C9A66}\
"MenuText" = "Uninstall BitDefender Online Scanner v8"
"Exec" = "%windir%\bdoscandel.exe" [null data]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{BE89472C-B803-4D1D-9A9A-0A63660E0FE3}" = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\COPERN~2\COPERN~1.DLL" ["Copernic Technologies Inc."]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Documents and Settings\Nancy Lefebvre\Bureau\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."]
Norton AntiVirus Firewall Monitor Service, NPFMntor, ""C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe"" ["Symantec Corporation"]
Norton Protection Center Service, NSCService, ""C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE"" ["Symantec Corporation"]
Planificateur LiveUpdate automatique, Planificateur LiveUpdate automatique, ""C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"]
Service Messenger Sharing USN Journal Reader, usnsvc, "C:\WINDOWS\system32\svchost.exe -k usnsvc" {"C:\Program Files\MSN Messenger\usnsvc.dll" [MS]}
Service Norton AntiVirus Auto-Protect, navapsvc, ""C:\Program Files\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
SPBBCSvc, SPBBCSvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Symantec Corporation"]
Symantec Core LC, Symantec Core LC, ""C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Network Drivers Service, SNDSrvc, ""C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]}

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]

----------
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 59 seconds, including 6 seconds for message boxes)

Réponse 54 / 59

Séb08 Messages postés 16503 Date d'inscription dimanche 13 novembre 2005 Statut Contributeur Dernière intervention 17 février 2023 1 430
20 janv. 2007 à 00:47

Ok bien :-)

Désactive ta restauration système (uniquement si tu es sous XP):
Clic droit sur poste de travail puis,
propriété, tu cliques sur onglet restauration système
tu coches la case « désactiver la restauration » et applique.

===========================

Supprime Vundofix, les quarantaines de Norton ainsi que ces fichiers en gras :

C:\Program Files\Fichiers communs\{B038E637-0A64-1036-0331-060506220002} <-- pour celui là jepense qu'il doit y avoir ces 2 fichiers à l'intérieur Update.exe et system.dll

C:\WINDOWS\SYSTEM32\winhld32.dll

vide ta poubelle et redémarre ton PC.

============================

- > Pour vérifier, scanne ton PC avec cet antivirus en ligne (sous IE et accepte l’activX) :
http://www.bitdefender.fr/bd/site/search.php#
Clique sur « Bitdefender scan on line » suis les instructions.
Démo (merci à balltrap pour cette démo) :
http://pageperso.aol.fr/rginformatique/mapage/defender.htm

Et colle le rapport.

a+

Réponse 55 / 59

Maniac25 Messages postés 1 Date d'inscription mardi 24 avril 2007 Statut Membre Dernière intervention 24 avril 2007
24 avril 2007 à 08:09

Bonjour moi aussi j'ai pogner ce virus de merde. J'ai combattu plusieur virus et spyware les plus chiant.

J'ai combattu en mode sans echec (I love you et les autre virus et spyware les plus chiant de internet avec les logiciel suivant :
Xoftspy, avg pro, A2, spybot et adaware et les fixtool de symantec. Et mon pc étais désinfecter de toute ses virus qui font chier tlm, mais la Vundo est le plus dur virus que j'ai jamais pogner.
J'ai envoyer des mail au compagnie de spyware et antivirus que j'utilise. Me reste a envoyer un mail a AVG et Avast.
Le probleme de Vundo trojan ses de savoir quelle exe il rajoute et quelle clé de registre on doit deleter et sa a null par ses ecrits.
Entk si un tech en info a la procedure qui marche a 100% sans inscrire tout les rapport de tout les logiciels existant, alors svp
site le a tlm qui a pogner cette charogne et envoyer des mails au compagnie qui créé des antivirus afin qu'un mise a jour soit créé pour contrer ce virus de merde qui est extremement chiant.

Voici ce que sa me fais a moi Vundo :

Dans windows fenetre de runddl32 : erreur dans c:\windows\systeme32\xvkepovx.dll et ce dll est meme pas la.
En plus je naie pu de menu rechercher un fichier dans demarer.
Quand je clique pour faire une recherche jai juste le chien jaune en bas et un rectangle bleu a gauche et page blanche a droite.

Donc je vais tout faire pour ne pas reformater mon pc pour cette charogne de virus.
Sur ce cher internaute !!
A++

P.s.: Si vous voulez me parler voici mon email : dguert@hotmail.com
Chow

.

Réponse 56 / 59

khairo
29 avril 2007 à 13:17

Salut C khairo, Idem pour ma machine attaqué par trojan voici mon log file pourriez vous m'aider??

Logfile of HijackThis v1.99.1
Scan saved at 08:13:33, on 29/04/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\HPZipm12.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic Agent\Web\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 193.95.78.254:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 192.160.103.245 CT-MFG
O2 - BHO: (no name) - {0309638F-93F8-44D3-84CF-240EB1AB7F1F} - C:\WINNT\System32\efccdab.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINNT\MXOaldr.exe
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Chercher avec Copernic Agent - C:\Program Files\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\Bittorent\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA8D4B8F-131C-4682-ADFF-C7939A08CCAC}: NameServer = 193.95.78.2,193.95.78.3
O20 - Winlogon Notify: efccdab - C:\WINNT\SYSTEM32\efccdab.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O20 - Winlogon Notify: winzzd32 - C:\WINNT\SYSTEM32\winzzd32.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: MGE Service module - Unknown owner - C:\WINNT\system32\MGE\RunSC.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\rthlpsvc.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe (file missing)
O23 - Service: TapeWare - Unknown owner - C:\Program Files\TapeWare\TWWINSDR.EXE
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\WINNT\Pointdev\VNC\WinVNC.exe" -service (file missing)

Réponse 57 / 59

harry
3 juin 2007 à 19:50

Bonjour j'ai été infecté comme de nombreuses personnes par trojan.nebuler. Norton system works 2004 le détecte mais n'arrive pas à le supprimer. La dll infectée est C:\WINDOWS\system32\winmbj32.dll . Pouvez vous m'aider ? Je vous donne le lod de hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 19:46:32, on 03/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\petites appli telechargées\Appli Cd pc solution 5\Firewall Plus\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
D:\petites appli telechargées\Folder size\FolderSizeSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\windows\system32\rlvknlg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Multimedia Combo Set\MouseDrv.exe
C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
D:\petites appli telechargées\Appli Cd pc solution 5\Firewall Plus\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Aqua Dock\Aqua Dock.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\ypwfkzup.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
C:\Program Files\Cegetel\C-BOX\Wizard\Agent_WiFi.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
D:\mes thémes perso\Ensemble Thémes XP 3D\CursorXP\CursorXP.exe
D:\Doc marc\mes dossiers\Logiciel anti virus\Spybot\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
D:\Pilotes HP psc 1210\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Windows Desktop Search\WindowsSearchIndexer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Doc marc\mes dossiers\Logiciel anti virus\Spybot\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Windows Desktop Search\WindowsSearchFilter.exe
C:\Program Files\Fichiers communs\Symantec Shared\NMain.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccLgView.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://outlook.live.com/owa/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Soltek] C:\WINDOWS\System32\autorun.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WireLessMouse ] C:\Program Files\Multimedia Combo Set\MouseDrv.exe
O4 - HKLM\..\Run: [WireLessKeyboard ] C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RelevantKnowledge] c:\windows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [00PCTFW] "D:\petites appli telechargées\Appli Cd pc solution 5\Firewall Plus\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [Aqua Dock] C:\Program Files\Aqua Dock\Aqua Dock.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [ypwfkzup.exe] C:\Documents and Settings\All Users.WINDOWS\Application Data\ypwfkzup.exe
O4 - HKLM\..\Run: [Genuine] rundll32.exe "C:\WINDOWS\system32\ckaismbc.dll",realset
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Norton SystemWorks] C:\Program Files\Fichiers communs\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - HKCU\..\Run: [Configuration de la C-BOX] C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\Cegetel\C-BOX\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [CursorXP] D:\mes thémes perso\Ensemble Thémes XP 3D\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Meteo Fusion] "D:\petites appli telechargées\Appli Cd pc solution 5\MeteoFusion\Meteo Fusion\Meteo Fusion.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Doc marc\mes dossiers\Logiciel anti virus\Spybot\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\OFFICE~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: S'abonner avec RSS Bandit - C:\Documents and Settings\Marc Society.RENGER-QBXLEAXR\Application Data\RssBandit\iecontext_subscribebandit.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\OFFICE~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://harryandmarc.wordpress.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: wbsys.dll; apitrap.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Folder Size (FolderSize) - Brio - D:\petites appli telechargées\Folder size\FolderSizeSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - D:\petites appli telechargées\Appli Cd pc solution 5\Firewall Plus\PC Tools Firewall Plus\FWService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

Réponse 58 / 59

Regis59 Messages postés 21143 Date d'inscription mardi 27 juin 2006 Statut Contributeur sécurité Dernière intervention 22 juin 2016 1 321
3 juin 2007 à 19:51

Salut

Crée ton propre sujet

a+

harry
3 juin 2007 à 20:16

euh je voudrais bien ... Mias comment puis-je faire ? DSL c'est un peu nouveau pour moi

Réponse 59 / 59

Regis59 Messages postés 21143 Date d'inscription mardi 27 juin 2006 Statut Contributeur sécurité Dernière intervention 22 juin 2016 1 321
3 juin 2007 à 22:54

Re,

Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt

Trojan Vundo,Trojan Nébuler,Idialer...

59 réponses

Discussions similaires

Newsletters