[Virus] Ai je enfin réussi à les éliminer ?

Question

Bonsoir.

Depuis quelques jours, j'essaie de me débarasser de ces virus et après différentes opérations faites sur vos conseils, j'en suis arrivé au niveau suivant :

==> Rapport Clean

Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Option 2, executee le 05/02/2007 a 18:28:58.30 

Microsoft Windows XP [version 5.1.2600] 

*** Suppression de fichiers sur C: 
tentative de suppression de C:\unwise.exe 

*** Suppression des fichiers dans C:\WINDOWS\ 
tentative de suppression de C:\WINDOWS\UnGins.exe 

*** Suppression des fichiers dans C:\WINDOWS\system32 
tentative de suppression de C:\WINDOWS\system32\dlh9jkd?q?.exe 
tentative de suppression de C:\WINDOWS\system32\mcrh.tmp 
tentative de suppression de C:\WINDOWS\system32\SpoonUninstall.exe 
tentative de suppression de C:\WINDOWS\system32	est.exe 
tentative de suppression de C:\WINDOWS\impborl.dll 
tentative de suppression de C:\WINDOWS\SYSTEM\MAPI32.DLL 
tentative de suppression de C:\WINDOWS\SYSTEM\INET16.DLL 
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\*_*_*NetInstaller.exe" 
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1" 
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.2" 

tentative de suppression de "C:\Program Files\Dialers\" 
tentative de suppression de "C:\Program Files\Instant Access\" 
tentative de suppression de "C:\Program Files\TClock\" 
tentative de suppression de "C:\Program Files\Viewpoint\" 
tentative de suppression de "C:\Program Files\vmntoolbar\" 
tentative de suppression de "C:\Program Files\VVSN\" 

*** Suppression des clefs du registre effectuee.. 

==> Voici les résultats du HijackThis. 

Logfile of HijackThis v1.99.1 
Scan saved at 19:25:35, on 05/02/2007 
Platform: Windows XP SP1 (WinNT 5.01.2600) 
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) 

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
C:\Program Files\Alwil Software\Avast4\ashServ.exe 
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 
C:\WINDOWS\system32
etdde.exe 
C:\WINDOWS\System32\DRIVERS\WtSrv.exe 
C:\WINDOWS\System32\Fast.exe 
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
C:\WINDOWS\Explorer.EXE 
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE 
C:\Program Files\Microsoft IntelliPoint\point32.exe 
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE 
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe 
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe 
C:\PROGRA~1\MI3AA1~1\wcescomm.exe 
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe 
I:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe 
C:\PROGRA~1\MI3AA1~1apimgr.exe 
C:\Program Files\Logitech1\SetPoint\SetPoint.exe 
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE 
C:\Documents and Settings\Standard\Bureau\HijackThis.exe 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens 
N1 - Netscape 4: user_pref("browser.startup.homepage", ""); (C:\Program Files\Netscape\Users\didier\prefs.js) 
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing) 
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll 
O2 - BHO: (no name) - {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} - C:\WINDOWS\System32\atmjpvcn.dll (file missing) 
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll 
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll 
O2 - BHO: (no name) - {C0AC5542-A167-4748-BF42-9D1B09723A62} - C:\WINDOWS\System32\hgghedc.dll (file missing) 
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - g:\Program Files\Free Download Manager\iefdmcks.dll 
O2 - BHO: (no name) - {E0EF50FD-02E0-496F-A9EA-481073DCCF41} - C:\WINDOWS\System32\mljgh.dll (file missing) 
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx 
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll 
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing) 
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE 
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" 
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500" 
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE" 
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" 
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized 
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe" 
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe 
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "I:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart 
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech1\SetPoint\SetPoint.exe 
O4 - Global Startup: WiziWYG XP Startup.lnk = C:\Program Files\Praxisoft\WiziWYG XP\WiziWYGXP.exe 
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe 
O8 - Extra context menu item: &Agrandir - C:\WINDOWS\web\zoomin.htm 
O8 - Extra context menu item: &Liste des liens - C:\WINDOWS\web\urllist.htm 
O8 - Extra context menu item: &Recherche sur le Web - C:\WINDOWS\web\selsearch.htm 
O8 - Extra context menu item: &Surligner - C:\WINDOWS\web\highlight.htm 
O8 - Extra context menu item: Liste des i&mages - C:\WINDOWS\Web\imglist.htm 
O8 - Extra context menu item: Ouvrir le cadre dans une &nouvelle fenêtre - C:\WINDOWS\web\frm2new.htm 
O8 - Extra context menu item: Ré&duire - C:\WINDOWS\web\zoomout.htm 
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlall.htm 
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dllink.htm 
O8 - Extra context menu item: Télécharger les tous avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlselected.htm 
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll 
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll 
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll 
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll 
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll 
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll 
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll 
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll 
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE 
O9 - Extra button: Dell Home - {533A3F20-D5DA-11D4-AADE-EA3E12D6D942} - http://www.euro.dell.com/countries/fr/fra/gen/default.htm (file missing) (HKCU) 
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab 
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab 
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll 
O20 - Winlogon Notify: hgghedc - hgghedc.dll (file missing) 
O20 - Winlogon Notify: winmyy32 - winmyy32.dll (file missing) 
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe 
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe 
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) 
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) 
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 
O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing) 
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe 
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe 
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe

A votre avis, en suis je arrivé à bout ou dois je faire encore quelques chose.

Autre question, sur le rapport de HijackThis, il y a pas mal de file missing, est ce grave et que dois je en faire?

Merci beaucoup de votre aide.

Bonne soirée.

Utilisateur anonyme · Answer

Si tu veux mon avis, cet ordi n'est pas clean !
Si je te suis tu essayé toi-même de te décontaminer?
Qu'as tu fais comme procédure, et sous les conseils de qui ?
A moins que tu as fait d'autres messages ?

bi_nou · Answer

Je n'ai fais que suivre  les procédures données dans un post précédent :

je n en peux plus j ai besoin de vous

Et je n'ai pas les compétences pour me lancer tout seul dans de telles manips d'oùmon nouvel appel à l'aide.

Merci

Utilisateur anonyme · Answer

C'est bien ce que je pensais en fait.
Tu as eu un helpeur qui t'as donné une procédure à suivre.
Perso , je veux bien tenter de t'aider, si tu du moins tu te sens capable de faire cette procédure pour commencer:
https://leblogdeclaude.blogspot.com/2006/10/informatique-procdure-de-nettoyage.html
Mais avant je vais envoyer un message en MP à Chercheurbis , pour le prévenir de la chose.

je te tiens au courant.

Utilisateur anonyme · Answer

ok, si tu le veux je peux continuer la désinfection.

Utilisateur anonyme · Answer

Helpeur= celui qui aide
Helpé= toi en l'occurence
-------------------------------------------
je vais te demander de faire cei dans l'ordre, même si tu as déjà fait certaines choses.
Je reprends tout dès le début.
https://leblogdeclaude.blogspot.com/2006/10/informatique-procdure-de-nettoyage.html

bi_nou · Answer

Bonsoir.

J'ai suivi ta demande et je viens de refaire la procédure en entier.

Voici les résultats :

SmitFraudFix v2.141

Rapport fait à 21:12:48.36, 09/02/2007
Executé à partir de C:\Documents and Settings\Standard\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Standard


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Standard\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~2\STANDARD\FAVORIS


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

et 

Logfile of HijackThis v1.99.1
Scan saved at 00:00:48, on 10/02/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32
etdde.exe
C:\WINDOWS\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\System32\Fast.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\Program Files\Logitech1\SetPoint\SetPoint.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Maxthon\Maxthon.exe
C:\Documents and Settings\Standard\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N1 - Netscape 4: user_pref("browser.startup.homepage", ""); (C:\Program Files\Netscape\Users\didier\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: (no name) - {C0AC5542-A167-4748-BF42-9D1B09723A62} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - g:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: (no name) - {E0EF50FD-02E0-496F-A9EA-481073DCCF41} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "I:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech1\SetPoint\SetPoint.exe
O4 - Global Startup: WiziWYG XP Startup.lnk = C:\Program Files\Praxisoft\WiziWYG XP\WiziWYGXP.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Agrandir - C:\WINDOWS\web\zoomin.htm
O8 - Extra context menu item: &Liste des liens - C:\WINDOWS\web\urllist.htm
O8 - Extra context menu item: &Recherche sur le Web - C:\WINDOWS\web\selsearch.htm
O8 - Extra context menu item: &Surligner - C:\WINDOWS\web\highlight.htm
O8 - Extra context menu item: Liste des i&mages - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Ouvrir le cadre dans une &nouvelle fenêtre - C:\WINDOWS\web\frm2new.htm
O8 - Extra context menu item: Ré&duire - C:\WINDOWS\web\zoomout.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger les tous avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlselected.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Dell Home - {533A3F20-D5DA-11D4-AADE-EA3E12D6D942} - http://www.euro.dell.com/countries/fr/fra/gen/default.htm (file missing) (HKCU)
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: hgghedc - hgghedc.dll (file missing)
O20 - Winlogon Notify: winmyy32 - winmyy32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe

Voila, alors, ai je bien fait ?

Merci de ton aide

Utilisateur anonyme · Answer

Salut à toi:
première constatation, je n'ai pas demandé à ce stade de log Hijackthis ?

Tu la fait, c'est pas mortel, mais c'était le stade suivant, regarde ici avec attention et fait ce qui est demandé.
Merci d'avance.
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

bi_nou · Answer

Bonjour.

Je viens de faire la procédure à la lettre que tu m'as donnée.

Par contre, il était demandé de "n'oubliez pas de tuer tous les processus qui ne servent à rien dans le gestionnaire des tâches."

Mais comme je ne savais pas lesquels tuer, je les ai laissés.

Comme demandé, je te joins le rapport et j'ai arrété là !

Logfile of HijackThis v1.99.1
Scan saved at 10:47:11, on 10/02/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32
etdde.exe
C:\WINDOWS\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\System32\Fast.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Logitech1\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\hijackthis\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N1 - Netscape 4: user_pref("browser.startup.homepage", ""); (C:\Program Files\Netscape\Users\didier\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: (no name) - {C0AC5542-A167-4748-BF42-9D1B09723A62} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - g:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: (no name) - {E0EF50FD-02E0-496F-A9EA-481073DCCF41} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "I:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech1\SetPoint\SetPoint.exe
O4 - Global Startup: WiziWYG XP Startup.lnk = C:\Program Files\Praxisoft\WiziWYG XP\WiziWYGXP.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Agrandir - C:\WINDOWS\web\zoomin.htm
O8 - Extra context menu item: &Liste des liens - C:\WINDOWS\web\urllist.htm
O8 - Extra context menu item: &Recherche sur le Web - C:\WINDOWS\web\selsearch.htm
O8 - Extra context menu item: &Surligner - C:\WINDOWS\web\highlight.htm
O8 - Extra context menu item: Liste des i&mages - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Ouvrir le cadre dans une &nouvelle fenêtre - C:\WINDOWS\web\frm2new.htm
O8 - Extra context menu item: Ré&duire - C:\WINDOWS\web\zoomout.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger les tous avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlselected.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Dell Home - {533A3F20-D5DA-11D4-AADE-EA3E12D6D942} - http://www.euro.dell.com/countries/fr/fra/gen/default.htm (file missing) (HKCU)
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: hgghedc - hgghedc.dll (file missing)
O20 - Winlogon Notify: winmyy32 - winmyy32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe

Merci de ton aide.

Utilisateur anonyme · Answer

Mais comme je ne savais pas lesquels tuer, je les ai laissés.
tu as bien fait !
dans le doute vaut mieux s'abstenir !
Ceci dit as-tu fait la sauvegarde de la base de registre ?
Avant d'aller plus loin ?

bi_nou · Answer

Oui, c'est fait par regedit puis exportation.

Utilisateur anonyme · Answer

télécharges ceci:
http://lop.com/toolbar_uninstall.exe
Déconnecte ton pc du net quitte Internet explorer
Désactive la restauration systéme
donnes un coup de CCleaner
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html


 et utilise toolbar_uninstall.exe ceci fait redémarre ton PC
----------------------------------------------------------------------
coches + fixer dans HJT
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file) 
O2 - BHO: (no name) - {68D5CF1D-EC5C-4bdd-A9EF-F0E517565D50} - (no file) 
O2 - BHO: (no name) - {C0AC5542-A167-4748-BF42-9D1B09723A62} - (no file) 
O2 - BHO: (no name) - {E0EF50FD-02E0-496F-A9EA-481073DCCF41} - (no file) 
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file) 
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE" 
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "I:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart 
O4 - Global Startup: WiziWYG XP Startup.lnk = C:\Program Files\Praxisoft\WiziWYG XP\WiziWYGXP.exe 
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe 
O8 - Extra context menu item: &Agrandir - C:\WINDOWS\web\zoomin.htm
O8 - Extra context menu item: &Liste des liens - C:\WINDOWS\web\urllist.htm
O8 - Extra context menu item: &Recherche sur le Web - C:\WINDOWS\web\selsearch.htm
O8 - Extra context menu item: &Surligner - C:\WINDOWS\web\highlight.htm
O8 - Extra context menu item: Liste des i&mages - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Ouvrir le cadre dans une &nouvelle fenêtre - C:\WINDOWS\web\frm2new.htm
O8 - Extra context menu item: Ré&duire - C:\WINDOWS\web\zoomout.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://g:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger les tous avec Free Download Manager - file://g:\Program Files\Free Download Manager\dlselected.htm 
O20 - Winlogon Notify: hgghedc - hgghedc.dll (file missing)
O20 - Winlogon Notify: winmyy32 - winmyy32.dll (file missing) 
O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing)

bi_nou · Answer

Les opérations ont toutes été effectuées sauf que toolbar_uninstall.exe n'a fait que fermer et relancer explorer mais pas le micro...

Tu ne me l'as pas demandé, mais je me permets de te mettre le log HTJ .

Logfile of HijackThis v1.99.1
Scan saved at 15:45:57, on 10/02/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32
etdde.exe
C:\WINDOWS\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\System32\Fast.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Logitech1\SetPoint\SetPoint.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\hijackthis\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N1 - Netscape 4: user_pref("browser.startup.homepage", ""); (C:\Program Files\Netscape\Users\didier\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - g:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech1\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Dell Home - {533A3F20-D5DA-11D4-AADE-EA3E12D6D942} - http://www.euro.dell.com/countries/fr/fra/gen/default.htm (file missing) (HKCU)
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe

 Merci

Utilisateur anonyme · Answer

essayes de le lancer en mode sans échec.

bi_nou · Answer

Bonsoir.

Je viens de le faire en mode sans echec, mais comme tout à l'heure, çà ferme et relance le bureau mais c'est tout. Par contre j'ai bien eu le message Uninstall complete for all users.

Et maintenant ....? c'est tout bon  ?

Merci d'avance

Utilisateur anonyme · Answer

fais ceci:
coches+fixer


O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab 
O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 
------------------------------------------------------------------
comment se comporte ton PC ?

bi_nou · Answer

Bonsoir

Ok c'est fait.

Et bien, pour le PC , çà a l'air d'aller bien mieux, et pour le proprio aussi ;-)

Merci

Utilisateur anonyme · Answer

fais ceci pour finir:
donnes un coup de ccleaner
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
----------------------------------------------------------
fais un scan en ligne avec ceci: (avec Iexplorer)
https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/

bi_nou · Answer

Et voila, opération terminée, donc si j'ai bien compris, çà devrait être fini ?

Merci encore de ton aide.

Utilisateur anonyme · Answer

je voudrais voir le rapport du scan de Panda.
merci

bi_nou · Answer

Bonjour.

Voici le rapport PANDA que je viens de faire:


Incident                                                                        Status                        Location                                                                                                                                                                                                                                                        

Dialer:dialer.bb                                                                Not disinfected               c:\windows\system32\DKTIBS.EXE                                                                                                                                                                                                                                  
Adware:adware/cws.searchmeup                                                    Not disinfected               c:\windows\system32\SYSTIME.EXE                                                                                                                                                                                                                                 
Dialer:dialer.xc                                                                Not disinfected               c:\windows\system32\PAYDIAL.EXE                                                                                                                                                                                                                                 
Dialer:dialer.b                                                                 Not disinfected               c:\windows\downloaded program files\EGAUTH.INF                                                                                                                                                                                                                  
Adware:adware/wupd                                                              Not disinfected               Windows Registry                                                                                                                                                                                                                                                
Spyware:spyware/media-motor                                                     Not disinfected               Windows Registry                                                                                                                                                                                                                                                
Dialer:dialer.ags                                                               Not disinfected               HKEY_CLASSES_ROOT\Interface\{C7EFC431-CB29-435F-8BCD-D24B77530649}                                                                                                                                                                                              
Adware:Adware/WinAntivirus2006                                                  Not disinfected               C:\WINDOWS\SYSTEM32\DYXRACOW.DLL                                                                                                                                                                                                                                
Adware:Adware/WinAntivirus2006                                                  Not disinfected               C:\WINDOWS\SYSTEM32\QALPTBBM.DLL                                                                                                                                                                                                                                
Adware:Adware/WinAntivirus2006                                                  Not disinfected               C:\WINDOWS\SYSTEM32\SUDFLJAR.DLL                                                                                                                                                                                                                                
Virus:Bck/Haxdoor.MU                                                            Disinfected                   C:\WINDOWS\JTHHRLN.EXE                                                                                                                                                                                                                                          
Virus:W32/Mydoom.A.worm                                                         Disinfected                   C:\sitepersoeptimania_com\Mailbox[document.zip][document.doc                                                                      .exe]                                                                                                                       
Virus:W32/Netsky.D.worm                                                         Disinfected                   C:\sitepersoeptimania_com\Mailbox[yours.pif]                                                                                                                                                                                                                  
Potentially unwanted tool:Application/Pskill.K                                  Not disinfected               C:\Downloads\CLEAN.ZIP[clean/pskill.exe]                                                                                                                                                                                                                        
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\Downloads\Nouveau dossier\SmitfraudFix.zip[SmitfraudFix/Process.exe]                                                                                                                                                                                         
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\Downloads\SDFix.exe[SDFix\apps\Process.exe]                                                                                                                                                                                                                  
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\Downloads\SmitfraudFix.zip[SmitfraudFix/Process.exe]                                                                                                                                                                                                         
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\Downloads\SmitfraudFix\SmitfraudFix\Process.exe                                                                                                                                                                                                              
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\SDFix\APPS\Process.exe                                                                                                                                                                                                                                       
Spyware:Cookie/Xiti                                                             Not disinfected               C:\configs.tbz[C:\configs.tbz][/home/knoppix/.mozilla/firefox/3d4ef4xp.default/cookies.txt][.xiti.com/]                                                                                                                                                         
Spyware:Cookie/Weborama                                                         Not disinfected               C:\configs.tbz[C:\configs.tbz][/home/knoppix/.mozilla/firefox/3d4ef4xp.default/cookies.txt][.weborama.fr/]                                                                                                                                                      
Spyware:Cookie/Advertising                                                      Not disinfected               C:\configs.tbz[C:\configs.tbz][/home/knoppix/.mozilla/firefox/3d4ef4xp.default/cookies.txt][.advertising.com/]                                                                                                                                                  
Spyware:Spyware/Virtumonde                                                      Not disinfected               C:\VundoFix Backups\ovsgehvq.dll1.bad                                                                                                                                                                                                                           
Spyware:Spyware/Virtumonde                                                      Not disinfected               C:\VundoFix Backups	kjhocku.dll.bad                                                                                                                                                                                                                            
Adware:Adware Program                                                           Not disinfected               C:\Documents and Settings\All Users\Bureau\Système\BACKUPS\backup-20070203-182432-578.inf                                                                                                                                                                       
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\Documents and Settings\All Users\Bureau\Système\SmitfraudFix\Process.exe                                                                                                                                                                                     
Potentially unwanted tool:Application/Pskill.K                                  Not disinfected               C:\Documents and Settings\All Users\Bureau\Système\CLEAN\PSKILL.EXE                                                                                                                                                                                             
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@xiti[1].txt                                                                                                                                                                                                 
Spyware:Cookie/Com.com                                                          Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@com[1].txt                                                                                                                                                                                                  
Spyware:Cookie/Cgi-bin                                                          Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@cgi-bin[1].txt                                                                                                                                                                                              
Spyware:Cookie/Weborama                                                         Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@weborama[2].txt                                                                                                                                                                                             
Spyware:Cookie/Atlas DMT                                                        Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@atdmt[2].txt                                                                                                                                                                                                
Spyware:Cookie/Comclick                                                         Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@fl01.ct2.comclick[1].txt                                                                                                                                                                                    
Spyware:Cookie/Bluestreak                                                       Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@bluestreak[2].txt                                                                                                                                                                                           
Spyware:Cookie/Tradedoubler                                                     Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@tradedoubler[2].txt                                                                                                                                                                                         
Spyware:Cookie/Doubleclick                                                      Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@doubleclick[1].txt                                                                                                                                                                                          
Spyware:Cookie/Adtech                                                           Not disinfected               C:\Documents and Settings\Standard\Cookies\standard@adtech[2].txt                                                                                                                                                                                               
Spyware:Cookie/Atwola                                                           Not disinfected               C:\Documents and Settings\Standard\Application Data\Mozilla\Profiles\DIDIER\NZD8XA9U.SLT\COOKIES.TXT[.atwola.com/]                                                                                                                                              
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\Standard\Application Data\Mozilla\Profiles\Utilisateur par défaut\UWYZLL22.SLT\COOKIES.TXT[.xiti.com/]                                                                                                                                
Spyware:Cookie/Atwola                                                           Not disinfected               C:\Documents and Settings\Standard\Application Data\Mozilla\Profiles\Utilisateur par défaut\UWYZLL22.SLT\COOKIES.TXT[.atwola.com/]                                                                                                                              
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\Standard\Application Data\Mozilla\Firefox\Profiles\e3fz4um5.Papa\COOKIES.TXT[.xiti.com/]                                                                                                                                              
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\DIDIER\Application Data\Mozilla\Firefox\Profiles\cw505kzq.default\COOKIES.TXT[.xiti.com/]                                                                                                                                             
Spyware:Cookie/Xiti                                                             Not disinfected               F:\configs.tbz[F:\configs.tbz][/home/knoppix/.mozilla/firefox/3d4ef4xp.default/cookies.txt][.xiti.com/]                                                                                                                                                         
Spyware:Cookie/Weborama                                                         Not disinfected               F:\configs.tbz[F:\configs.tbz][/home/knoppix/.mozilla/firefox/3d4ef4xp.default/cookies.txt][.weborama.fr/]                                                                                                                                                      
Spyware:Cookie/Advertising                                                      Not disinfected               F:\configs.tbz[F:\configs.tbz][/home/knoppix/.mozilla/firefox/3d4ef4xp.default/cookies.txt][.advertising.com/]                                                                                                                                                  
Hacktool:Exploit/iFrame                                                         Not disinfected               Dossiers locaux\Boîte de réception\free\Mail Delivery (failure dponce@free.fr)                                                                                                                                                                                  
Hacktool:Exploit/iFrame                                                         Not disinfected               Dossiers locaux\Éléments envoyés\Re: Honey                                                                                                                                                                                                                      
Hacktool:Exploit/iFrame                                                         Not disinfected               Dossiers locaux\Éléments envoyés\Re: Please try again                                                                                                                                                                                                           
Hacktool:Exploit/iFrame                                                         Not disinfected               Dossiers locaux\Éléments envoyés\Re: A  IE 6.0 patch                                                                                                                                                                                                            
Hacktool:Exploit/iFrame                                                         Not disinfected               Dossiers locaux\Éléments envoyés\Re: Www . ECRANDEFOND . com                                                                                                                                                                                                    
Hacktool:Exploit/iFrame                                                         Not disinfected               Dossiers locaux\Éléments envoyés\Re: Eager to see you                                                                                                                                                                                                           
Hacktool:Exploit/iFrame                                                         Not disinfected               Dossiers locaux\Éléments envoyés\Re: Re:dponce,welcome to my hometown                                                                                                                                                                                           
Je ne comprends plus, il y en a toujours. Juste une question :
J'utilise Maxthon browser comme navigateur, est ce que çà peut venir de là ?

Merci

Utilisateur anonyme · Answer

Panda n'a pas su désinfecter ta machine....
as-tu coché la désinfection automatique ?
-------------------------------------------------------------
refaits un scan avec 
http://www.bitdefender.fr/bd/site/search.php#

download Mozilla-firefox pour aller sur le Net:
http://mozilla.mirrors.tds.net/pub/mozilla.org/firefox/releases/2.0/win32/fr/Firefox%20Setup%202.0.exe

bi_nou · Answer

Voici le rapport de bitdefender.

BitDefender Online Scanner
  
  
 
Scan report generated at: Sun, Feb 11, 2007 - 19:37:59
 
 
  
  
 
Scan path: A:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;
  
  
 
 
  
  
 
Statistics
 
Time
 02:29:45
 
Files
 441883
 
Folders
 13249
 
Boot Sectors
 7
 
Archives
 14947
 
Packed Files
 33982
 
  
  
 
Results
 
Identified Viruses 
 11
 
Infected Files 
 23
 
Suspect Files 
 7
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 30
 
  
  
 
Engines Info
 
Virus Definitions
 420002
 
Engine build
 AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)
 
Scan plugins
 14
 
Archive plugins
 38
 
Unpack plugins
 6
 
E-mail plugins
 6
 
System plugins
 1
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\WINDOWS\SYSTEM32\dyxracow.dll
 Infected with: Trojan.Spy.VBStat.B
 
C:\WINDOWS\SYSTEM32\dyxracow.dll
 Deleted
 
C:\WINDOWS\SYSTEM32\fcywu.dll
 Infected with: Trojan.Vundo.W
 
C:\WINDOWS\SYSTEM32\fcywu.dll
 Disinfection failed
 
C:\WINDOWS\SYSTEM32\fcywu.dll
 Deleted
 
C:\WINDOWS\SYSTEM32\qalptbbm.dll
 Infected with: Trojan.Spy.VBStat.B
 
C:\WINDOWS\SYSTEM32\qalptbbm.dll
 Deleted
 
C:\WINDOWS\SYSTEM32\sudfljar.dll
 Infected with: Trojan.Spy.VBStat.B
 
C:\WINDOWS\SYSTEM32\sudfljar.dll
 Deleted
 
C:\Downloads\Nouveau dossier	oolbar_uninstall.exe
 Infected with: Trojan.FatObfus.Gen
 
C:\Downloads\Nouveau dossier	oolbar_uninstall.exe
 Disinfection failed
 
C:\Downloads\Nouveau dossier	oolbar_uninstall.exe
 Deleted
 
C:\VundoFix Backups\atmjpvcn.dll.bad
 Infected with: Trojan.Juan.E
 
C:\VundoFix Backups\atmjpvcn.dll.bad
 Disinfection failed
 
C:\VundoFix Backups\atmjpvcn.dll.bad
 Deleted
 
C:\VundoFix Backups\byxuvvw.dll.bad
 Infected with: DeepScan:Generic.Malware.SYddldg.3BB0ED6E
 
C:\VundoFix Backups\byxuvvw.dll.bad
 Disinfection failed
 
C:\VundoFix Backups\byxuvvw.dll.bad
 Deleted
 
C:\VundoFix Backups\mljgh.dll.bad
 Infected with: Trojan.Vundo.W
 
C:\VundoFix Backups\mljgh.dll.bad
 Disinfection failed
 
C:\VundoFix Backups\mljgh.dll.bad
 Deleted
 
C:\VundoFix Backups\ovsgehvq.dll1.bad
 Infected with: Trojan.Virtumod.EB
 
C:\VundoFix Backups\ovsgehvq.dll1.bad
 Disinfection failed
 
C:\VundoFix Backups\ovsgehvq.dll1.bad
 Deleted
 
C:\VundoFix Backups	kjhocku.dll.bad
 Infected with: Trojan.Virtumod.EB
 
C:\VundoFix Backups	kjhocku.dll.bad
 Disinfection failed
 
C:\VundoFix Backups	kjhocku.dll.bad
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 610)=>[Subject: Re: annonce][Date: Mon, 15 Mar 2004 20:52:36 +0100]=>(MIME part)=>(message body)=>(JAVASCRIPT 1)
 Infected with: Trojan.Js.Relink.B
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 610)=>[Subject: Re: annonce][Date: Mon, 15 Mar 2004 20:52:36 +0100]=>(MIME part)=>(message body)=>(JAVASCRIPT 1)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 610)=>[Subject: Re: annonce][Date: Mon, 15 Mar 2004 20:52:36 +0100]=>(MIME part)=>(message body)=>(JAVASCRIPT 1)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 610)=>[Subject: Re: annonce][Date: Mon, 15 Mar 2004 20:52:36 +0100]=>(MIME part)=>(message body)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 610)=>[Subject: Re: annonce][Date: Mon, 15 Mar 2004 20:52:36 +0100]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 610)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1237)=>[Subject: Re: Congratulations][Date: Tue, 21 Jan 2003 22:03:08 +0100]=>(MIME part)=>(message body)
 Suspected of: Exploit.Iframe.Vulnerability
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1237)=>[Subject: Re: Congratulations][Date: Tue, 21 Jan 2003 22:03:08 +0100]=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1237)=>[Subject: Re: Congratulations][Date: Tue, 21 Jan 2003 22:03:08 +0100]=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1237)=>[Subject: Re: Congratulations][Date: Tue, 21 Jan 2003 22:03:08 +0100]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1237)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1370)=>[Subject: Re: Re:dponce,welcome to my hometown][Date: Thu, 27 Jun 2002 14:09:27 +0200]=>(MIME part)=>(message body)
 Suspected of: Exploit.Iframe.Vulnerability
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1370)=>[Subject: Re: Re:dponce,welcome to my hometown][Date: Thu, 27 Jun 2002 14:09:27 +0200]=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1370)=>[Subject: Re: Re:dponce,welcome to my hometown][Date: Thu, 27 Jun 2002 14:09:27 +0200]=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1370)=>[Subject: Re: Re:dponce,welcome to my hometown][Date: Thu, 27 Jun 2002 14:09:27 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1370)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1371)=>[Subject: Re: Eager to see you][Date: Thu, 27 Jun 2002 14:09:13 +0200]=>(MIME part)=>(message body)
 Suspected of: Exploit.Iframe.Vulnerability
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1371)=>[Subject: Re: Eager to see you][Date: Thu, 27 Jun 2002 14:09:13 +0200]=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1371)=>[Subject: Re: Eager to see you][Date: Thu, 27 Jun 2002 14:09:13 +0200]=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1371)=>[Subject: Re: Eager to see you][Date: Thu, 27 Jun 2002 14:09:13 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1371)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1373)=>[Subject: Re: Www . ECRANDEFOND . com][Date: Thu, 27 Jun 2002 14:08:31 +0200]=>(MIME part)=>(message body)
 Suspected of: Exploit.Iframe.Vulnerability
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1373)=>[Subject: Re: Www . ECRANDEFOND . com][Date: Thu, 27 Jun 2002 14:08:31 +0200]=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1373)=>[Subject: Re: Www . ECRANDEFOND . com][Date: Thu, 27 Jun 2002 14:08:31 +0200]=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1373)=>[Subject: Re: Www . ECRANDEFOND . com][Date: Thu, 27 Jun 2002 14:08:31 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1373)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1374)=>[Subject: Re: A IE 6.0 patch][Date: Thu, 27 Jun 2002 14:08:12 +0200]=>(MIME part)=>(message body)
 Suspected of: Exploit.Iframe.Vulnerability
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1374)=>[Subject: Re: A IE 6.0 patch][Date: Thu, 27 Jun 2002 14:08:12 +0200]=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1374)=>[Subject: Re: A IE 6.0 patch][Date: Thu, 27 Jun 2002 14:08:12 +0200]=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1374)=>[Subject: Re: A IE 6.0 patch][Date: Thu, 27 Jun 2002 14:08:12 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1374)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1375)=>[Subject: Re: Please try again][Date: Thu, 27 Jun 2002 14:07:51 +0200]=>(MIME part)=>(message body)
 Suspected of: Exploit.Iframe.Vulnerability
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1375)=>[Subject: Re: Please try again][Date: Thu, 27 Jun 2002 14:07:51 +0200]=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1375)=>[Subject: Re: Please try again][Date: Thu, 27 Jun 2002 14:07:51 +0200]=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1375)=>[Subject: Re: Please try again][Date: Thu, 27 Jun 2002 14:07:51 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1375)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1438)=>[Subject: Re: Honey][Date: Sun, 14 Apr 2002 20:00:36 +0200]=>(MIME part)=>(message body)
 Suspected of: Exploit.Iframe.Vulnerability
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1438)=>[Subject: Re: Honey][Date: Sun, 14 Apr 2002 20:00:36 +0200]=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1438)=>[Subject: Re: Honey][Date: Sun, 14 Apr 2002 20:00:36 +0200]=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1438)=>[Subject: Re: Honey][Date: Sun, 14 Apr 2002 20:00:36 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx=>(message 1438)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\Éléments envoyés.dbx
 Update failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\free.dbx=>(message 498)=>[Subject: Mail Delivery (failure dponce@free.fr)][Date: Wed, 21 Apr 2004 15:14:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infected with: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\free.dbx=>(message 498)=>[Subject: Mail Delivery (failure dponce@free.fr)][Date: Wed, 21 Apr 2004 15:14:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\free.dbx=>(message 498)=>[Subject: Mail Delivery (failure dponce@free.fr)][Date: Wed, 21 Apr 2004 15:14:22 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\free.dbx=>(message 498)=>[Subject: Mail Delivery (failure dponce@free.fr)][Date: Wed, 21 Apr 2004 15:14:22 +0200]=>(MIME part)=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\free.dbx=>(message 498)=>[Subject: Mail Delivery (failure dponce@free.fr)][Date: Wed, 21 Apr 2004 15:14:22 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\free.dbx=>(message 498)
 Updated
 
C:\Documents and Settings\Standard\Application Data\Identities\{EE436240-D5D9-11D4-AADE-FE1A31E1A62E}\Microsoft\Outlook Express\free.dbx
 Update failed
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 4)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Fri, 26 Aug 2005 09:44:21 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infected with: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 4)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Fri, 26 Aug 2005 09:44:21 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 4)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Fri, 26 Aug 2005 09:44:21 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 4)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Fri, 26 Aug 2005 09:44:21 +0200]=>(MIME part)=>(MIME part)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 4)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Fri, 26 Aug 2005 09:44:21 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 4)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Update failed
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 11)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 09:21:55 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infected with: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 11)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 09:21:55 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 11)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 09:21:55 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 11)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 09:21:55 +0200]=>(MIME part)=>(MIME part)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 11)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 09:21:55 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 11)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Update failed
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 13)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 11:31:40 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Infected with: Exploit.Iframe.Vulnerability.B
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 13)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 11:31:40 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Disinfection failed
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 13)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 11:31:40 +0200]=>(MIME part)=>(MIME part)=>(message body)
 Deleted
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 13)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 11:31:40 +0200]=>(MIME part)=>(MIME part)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 13)=>[Subject: [avast! - INFECTED] Mail Delivery (f][Date: Sat, 27 Aug 2005 11:31:40 +0200]=>(MIME part)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx=>(message 13)
 Updated
 
C:\Documents and Settings\Maman\Local Settings\Application Data\Identities\{79A226F4-573C-435B-9703-5C5BDABDAFD7}\Microsoft\Outlook Express\Éléments supprimés.dbx
 Update failed
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162760.EXE
 Infected with: Generic.Malware.dld!!.291A6184
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162760.EXE
 Disinfection failed
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162760.EXE
 Deleted
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162767.dll
 Infected with: Trojan.Spy.VBStat.B
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162767.dll
 Deleted
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162768.dll
 Infected with: Trojan.Vundo.W
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162768.dll
 Disinfection failed
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162768.dll
 Deleted
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162769.dll
 Infected with: Trojan.Spy.VBStat.B
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162769.dll
 Deleted
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162770.dll
 Infected with: Trojan.Spy.VBStat.B
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162770.dll
 Deleted
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162808.exe
 Infected with: Trojan.FatObfus.Gen
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162808.exe
 Disinfection failed
 
C:\System Volume Information\_restore{8F4229C7-7350-47BA-BDD3-8B1172CC5BCD}\RP467\A0162808.exe
 Deleted
 
 maxthon abandonné, mozilla firefox adopté.

Merci

Utilisateur anonyme · Answer

Ben, dis-moi....ça vaut la peine que tu t'es donné !
Quelques petites infections ......
Il emploie la manière forte !
même dans le backup de vundofix !
Perso je referai un scan AVG
http://www.grisoft.com/doc/downloads-results/lng/fr/tpl/tpl01?prd=triasw

bi_nou · Answer

Bonsoir

Je viens de refaire un scan et voici le résultat :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	22:26:36 11/02/2007

 + Résultat de l'analyse:	



HKU\S-1-5-19\Software\Aureate -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-19\Software\Aureate\Advertising -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-19\Software\Aureate\Advertising\Demographics -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-19\Software\Aureate\V3 -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-19\Software\Aureate\V3\Cookies -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-20\Software\Aureate -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-20\Software\Aureate\Advertising -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-20\Software\Aureate\Advertising\Demographics -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-20\Software\Aureate\V3 -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-20\Software\Aureate\V3\Cookies -> Adware.Aureate : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\BubbleMsg -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\BubbleMsg\Group -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\BubbleMsg\Group\General -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\BubbleMsg\Item -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\BubbleMsg\Item\http://* -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\BubbleMsg\Item\http://*\004016 -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\MultiUrl -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\UserInfo -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\Hotbar\hotbar\options -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\BubbleMsg -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\BubbleMsg\Group -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\BubbleMsg\Group\General -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\BubbleMsg\Item -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\BubbleMsg\Item\http://* -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\BubbleMsg\Item\http://*\004016 -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\MultiUrl -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\UserInfo -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-20\Software\Hotbar\hotbar\options -> Adware.HotBar : Aucune action entreprise.
HKU\S-1-5-19\Software\CarpeDiemVars -> Dialer.Generic : Aucune action entreprise.
HKU\S-1-5-19\Software\CarpeDiemVars\Kit -> Dialer.Generic : Aucune action entreprise.
HKU\S-1-5-19\Software\CarpeDiemVars\Kit\UserId -> Dialer.Generic : Aucune action entreprise.
HKU\S-1-5-20\Software\CarpeDiemVars -> Dialer.Generic : Aucune action entreprise.
HKU\S-1-5-20\Software\CarpeDiemVars\Kit -> Dialer.Generic : Aucune action entreprise.
HKU\S-1-5-20\Software\CarpeDiemVars\Kit\UserId -> Dialer.Generic : Aucune action entreprise.
:mozilla.13:C:\Documents and Settings\Standard\Application Data\Mozilla\Firefox\Profiles\e3fz4um5.Papa\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
C:\Documents and Settings\didier\Cookies\didier@247realmedia[1].txt -> TrackingCookie.247realmedia : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@adtech[2].txt -> TrackingCookie.Adtech : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@com[1].txt -> TrackingCookie.Com : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\Standard\Cookies\standard@weborama[2].txt -> TrackingCookie.Weborama : Aucune action entreprise.


Fin du rapport

Arriverons nous à en venir à bout ?

Merci de ta patience et de ton aide.

Utilisateur anonyme · Answer

quelque chose cloche:
" Aucune action"
tu as mal configuré avg.
J'ai repréciser la config de AVG dans le lien.
http://bp3.blogger.com/...
On va y arriver....
Gardons le moral !

bi_nou · Answer

Bonjour 

Oups, j'ai oublier dans mon message que j'avais tout supprimer après le scan. Jai pris ligne par ligne et j'ai fait clic droit et supprimer, donc TOUT à bien été effacé je te rassure ( et moi par la même ocassion! )

Pour le moral, il y a des hauts et pas mal de bas, mais comme tu dis, gardons le moral !

Motivé, motivé, restons motivé...

Alors Docteur  ??

Utilisateur anonyme · Answer

Alors, comment va le PC ?
Tu remarques encore des bizarettés?

refaits un log HJT

bi_nou · Answer

Bonjour Docteur.

Et bien le PC, il a l'air de pas mal tourné, et le proprio n'a plus le moral dans les chaussettes. Il en a profité pour employer les grands moyens :
 - Utilisation de FIREFOX pour le web.
 - Mise en place de DropMyRights ( Merci CCM )
 - Etre plus prudent

Pour le log, je te le mets en ligne ce soir en rentrant.

Merci encore.

Utilisateur anonyme · Answer

je rajouterai ceci:
Après chaque session Internet, utiliser ATF cleaner, onglet Main+Firefox
Perso je l'utilise au moins 5 fois par jour.
http://www.atribune.org/ccount/click.php?id=1

" Si vous ne pouvez être des saints de la connaissance, soyez en au moins
les guerriers .                           Friedrich Nietzsche"

bi_nou · Answer

Merci du tuyau, je viens de le mettre sur le bureau.

Voici le log que tu m'as demandé :
Logfile of HijackThis v1.99.1
Scan saved at 19:34:11, on 13/02/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32
etdde.exe
C:\WINDOWS\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Fast.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\Program Files\Logitech1\SetPoint\SetPoint.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
C:\hijackthis\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N1 - Netscape 4: user_pref("browser.startup.homepage", ""); (C:\Program Files\Netscape\Users\didier\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - g:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: PrivBar - {300BC64A-BF32-4cc8-8917-91148CEFE700} - c:\windows\PrivBar.dll
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech1\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Dell Home - {533A3F20-D5DA-11D4-AADE-EA3E12D6D942} - http://www.euro.dell.com/countries/fr/fra/gen/default.htm (file missing) (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe

Alors, ton avis ?

Merci

Utilisateur anonyme · Answer

coches+fix


O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - (no file) 
O3 - Toolbar: PrivBar - {300BC64A-BF32-4cc8-8917-91148CEFE700} - c:\windows\PrivBar.dll 
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab 
Inconnu
	O23 - Service: Avx Init Serv (AvxIni) - Unknown owner - C:\Program Files\SOFTWIN\BDProf\avxinit.exe (file missing)

bi_nou · Answer

Et voila c'est fait. Alors à ton avis, c'est bon ou pas ?

Cordialement

Utilisateur anonyme · Answer

A toi de me dire si ce PC tourne sans soucis ?

bi_nou · Answer

Bonsoir.

Pour le PC, il tourne bien, plus de problème. Donc je crois que l'on peut dire que c'est  grace à toi que tout est rentré dans l'ordre.

je voudrais sincèrement te remercier de ton aide, de ta patience aussi .

Merci aussi au site CMM que j'ai découvert et que je conseille maintenant.

Donc, chat échaudé craint l'eau froide, je vais être beaucoup plus prudent.

Donc pour conclure :

ENCORE MERCI

Utilisateur anonyme · Answer

pas de soucis.
message bien reçu
bonne journée

[Virus] Ai je enfin réussi à les éliminer ?

35 réponses

Discussions similaires

Newsletters