A voir également:
- [VIRUS] Multiples infections... Que faire?
- Virus mcafee - Accueil - Piratage
- Virus facebook demande d'amis - Accueil - Facebook
- Undisclosed-recipients virus - Guide
- Panda anti virus gratuit - Télécharger - Antivirus & Antimalwares
- Altruistic virus ✓ - Forum Antivirus
17 réponses
bonjour,
je doute que ce soit avast qui lui supprimes toutes ses m....
* Télécharge VundoFix.exe (par Atribune) sur ton Bureau
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".
je doute que ce soit avast qui lui supprimes toutes ses m....
* Télécharge VundoFix.exe (par Atribune) sur ton Bureau
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".
bonsoir,
rien du tout contre avast, néanmoins y a déjà un antivirus, donc pas la peine d'en rajouter un autre. Il sera tjs temps d'en changer ensuite pour le moment c'est nettoyer qu'il faut faire, et avast ne supprimera pas vundo, sinon....cela se saurait !
rien du tout contre avast, néanmoins y a déjà un antivirus, donc pas la peine d'en rajouter un autre. Il sera tjs temps d'en changer ensuite pour le moment c'est nettoyer qu'il faut faire, et avast ne supprimera pas vundo, sinon....cela se saurait !
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
re
Oui,je connais Google et Vundo c'est un virus et un anti-virus,tu ne savais pas qu'Avast supprimait les adwares?Vundo en est un
pour la dernière fois, parce que franchement tu me fatigues. Si avast supprimait vundo, tout ceux qui ont avast ne serait pas infecté par vundo. Point barre
bonne nuit
Oui,je connais Google et Vundo c'est un virus et un anti-virus,tu ne savais pas qu'Avast supprimait les adwares?Vundo en est un
pour la dernière fois, parce que franchement tu me fatigues. Si avast supprimait vundo, tout ceux qui ont avast ne serait pas infecté par vundo. Point barre
bonne nuit
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 10:53:00 04/04/2007
Listing files found while scanning....
C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\system32\agipsoal.dll
C:\WINDOWS\system32\bylafiiv.dll
C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.tmp
Beginning removal...
Attempting to delete C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\Program Files\VSAdd-in\VSAdd-in.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\dcwxjnmn.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\system32\feclmfjr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\System32\gebyy.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\hggibqpa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\luleeorf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\urkikhpy.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\xerojupa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\system32\yphkikru.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\System32\yybeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.tmp
C:\WINDOWS\system32\yybeg.tmp Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 12:18:44 04/04/2007
Listing files found while scanning....
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:14:33 04/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:11:41 14/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 10:53:00 04/04/2007
Listing files found while scanning....
C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\system32\agipsoal.dll
C:\WINDOWS\system32\bylafiiv.dll
C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.tmp
Beginning removal...
Attempting to delete C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\Program Files\VSAdd-in\VSAdd-in.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\dcwxjnmn.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\system32\feclmfjr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\System32\gebyy.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\hggibqpa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\luleeorf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\urkikhpy.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\xerojupa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\system32\yphkikru.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\System32\yybeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.tmp
C:\WINDOWS\system32\yybeg.tmp Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 12:18:44 04/04/2007
Listing files found while scanning....
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:14:33 04/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:11:41 14/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:31:15, on 14/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {532C4FBA-D9D1-4C4E-8478-A23463C1C3Ed} - C:\WINDOWS\system32\sattrxqr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O2 - BHO: (no name) - {BF5314D5-FF0A-4F05-9033-0AACEAB76C9A} - C:\WINDOWS\System32\gebyy.dll (file missing)
O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
O3 - Toolbar: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Microsft Security Monitor Process] cmh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\yphkikru.dll",setvm
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] cmh.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
Scan saved at 22:31:15, on 14/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {532C4FBA-D9D1-4C4E-8478-A23463C1C3Ed} - C:\WINDOWS\system32\sattrxqr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O2 - BHO: (no name) - {BF5314D5-FF0A-4F05-9033-0AACEAB76C9A} - C:\WINDOWS\System32\gebyy.dll (file missing)
O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
O3 - Toolbar: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Microsft Security Monitor Process] cmh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\yphkikru.dll",setvm
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] cmh.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
bonsoir,
* Télécharge Pocket KillBox sur ton bureau.
http://www.downloads.subratam.org/KillBox.exe
puis
* Relance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :
C:\WINDOWS\system32\sattrxqr.dll
C:\WINDOWS\system32\yphkikru.dll
* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix
puis
* lance hijackthis pour un "scan seulement" puis coche ces lignes :
O2 - BHO: (no name) - {532C4FBA-D9D1-4C4E-8478-A23463C1C3Ed} - C:\WINDOWS\system32\sattrxqr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {BF5314D5-FF0A-4F05-9033-0AACEAB76C9A} - C:\WINDOWS\System32\gebyy.dll (file missing)
O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
O3 - Toolbar: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O4 - HKLM\..\Run: [Microsft Security Monitor Process] cmh.exe
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\yphkikru.dll",setvm
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] cmh.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
* ferme toutes les applications ouvertes y compris Internet Explorer et clique sur "fixer objet"
1- Double-clic sur KillBox.exe
2- Selectionne "Delete on Reboot"
3 - Dans "Full Path of File to Delete"
copie et colle:
c:\windows\system32\cmh.exe
5- clic sur le rond rouge
6- une fenetre va apparaitre pour confirmation clic sur OUI
7- une seconde fenetre te demande si tu veux redemarrer clic sur OUI
* fait une recherche avec windows pour supprimer ceci :
NULL
reposte un nouveau rapport hijackthis stp ainsi que celui de vundo
* Télécharge Pocket KillBox sur ton bureau.
http://www.downloads.subratam.org/KillBox.exe
puis
* Relance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :
C:\WINDOWS\system32\sattrxqr.dll
C:\WINDOWS\system32\yphkikru.dll
* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix
puis
* lance hijackthis pour un "scan seulement" puis coche ces lignes :
O2 - BHO: (no name) - {532C4FBA-D9D1-4C4E-8478-A23463C1C3Ed} - C:\WINDOWS\system32\sattrxqr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {BF5314D5-FF0A-4F05-9033-0AACEAB76C9A} - C:\WINDOWS\System32\gebyy.dll (file missing)
O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file)
O3 - Toolbar: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O4 - HKLM\..\Run: [Microsft Security Monitor Process] cmh.exe
O4 - HKLM\..\Run: [farstone] NULL
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\yphkikru.dll",setvm
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] cmh.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
* ferme toutes les applications ouvertes y compris Internet Explorer et clique sur "fixer objet"
1- Double-clic sur KillBox.exe
2- Selectionne "Delete on Reboot"
3 - Dans "Full Path of File to Delete"
copie et colle:
c:\windows\system32\cmh.exe
5- clic sur le rond rouge
6- une fenetre va apparaitre pour confirmation clic sur OUI
7- une seconde fenetre te demande si tu veux redemarrer clic sur OUI
* fait une recherche avec windows pour supprimer ceci :
NULL
reposte un nouveau rapport hijackthis stp ainsi que celui de vundo
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 10:53:00 04/04/2007
Listing files found while scanning....
C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\system32\agipsoal.dll
C:\WINDOWS\system32\bylafiiv.dll
C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.tmp
Beginning removal...
Attempting to delete C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\Program Files\VSAdd-in\VSAdd-in.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\dcwxjnmn.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\system32\feclmfjr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\System32\gebyy.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\hggibqpa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\luleeorf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\urkikhpy.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\xerojupa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\system32\yphkikru.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\System32\yybeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.tmp
C:\WINDOWS\system32\yybeg.tmp Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 12:18:44 04/04/2007
Listing files found while scanning....
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:14:33 04/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:11:41 14/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
Beginning removal...
Attempting to delete C:\WINDOWS\system32\sattrxqr.dll
C:\WINDOWS\system32\sattrxqr.dll Has been deleted!
Performing Repairs to the registry.
Done!
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 10:53:00 04/04/2007
Listing files found while scanning....
C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\system32\agipsoal.dll
C:\WINDOWS\system32\bylafiiv.dll
C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.tmp
Beginning removal...
Attempting to delete C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\Program Files\VSAdd-in\VSAdd-in.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\dcwxjnmn.dll
C:\WINDOWS\system32\dcwxjnmn.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\feclmfjr.dll
C:\WINDOWS\system32\feclmfjr.dll Could not be deleted.
Attempting to delete C:\WINDOWS\System32\gebyy.dll
C:\WINDOWS\System32\gebyy.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hggibqpa.dll
C:\WINDOWS\system32\hggibqpa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\luleeorf.dll
C:\WINDOWS\system32\luleeorf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\urkikhpy.ini
C:\WINDOWS\system32\urkikhpy.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\xerojupa.dll
C:\WINDOWS\system32\xerojupa.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\yphkikru.dll
C:\WINDOWS\system32\yphkikru.dll Has been deleted!
Attempting to delete C:\WINDOWS\System32\yybeg.bak1
C:\WINDOWS\System32\yybeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini
C:\WINDOWS\system32\yybeg.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.ini2
C:\WINDOWS\system32\yybeg.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\yybeg.tmp
C:\WINDOWS\system32\yybeg.tmp Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 12:18:44 04/04/2007
Listing files found while scanning....
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:14:33 04/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.
Scan started at 21:11:41 14/04/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
Beginning removal...
Attempting to delete C:\WINDOWS\system32\sattrxqr.dll
C:\WINDOWS\system32\sattrxqr.dll Has been deleted!
Performing Repairs to the registry.
Done!
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 06:13:16, on 15/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\Nicolas\Bureau\VundoFix.exe
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
Scan saved at 06:13:16, on 15/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\Nicolas\Bureau\VundoFix.exe
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
bonjour,
pas mal, ton pc devrait mieux respirer maintenant non ?
* Fait un scan antivirus en ligne
https://www.bitdefender.fr/
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
* Dans la nouvelle fenêtre, clique sur I agree
* La fenêtre change encore, clique sur Click here to scan
* Les signatures se chargent, etc.
tuto en image
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
pas mal, ton pc devrait mieux respirer maintenant non ?
* Fait un scan antivirus en ligne
https://www.bitdefender.fr/
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
* Dans la nouvelle fenêtre, clique sur I agree
* La fenêtre change encore, clique sur Click here to scan
* Les signatures se chargent, etc.
tuto en image
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
Rapport d'analyse généré à: Sun, Apr 15, 2007 - 16:08:59
Voie d'analyse: A:\;C:\;D:\;E:\;
Statistiques
Temps
02:42:22
Fichiers
487267
Directoires
7507
Secteurs de boot
2
Archives
3879
Paquets programmes
35100
Résultats
Virus identifiés
8
Fichiers infectés
20
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
20
Info sur les moteurs
Définition virus
486039
Version des moteurs
AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
6
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class
Infecté par: Java.Trojan.Exploit.Bytverify
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class
Infecté par: Java.Trojan.Exploit.Bytverify.C
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class
Infecté par: Java.Trojan.Exploit.Bytverify
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class
Infecté par: Java.Trojan.Exploit.Bytverify.C
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Infecté par: Trojan.Bat.Hdkill.A
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Echec de la désinfection
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Supprimé
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar
Echec de la mise à jour
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Infecté par: Trojan.Bat.Hdkill.A
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Echec de la désinfection
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Supprimé
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar
Echec de la mise à jour
C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll
Infecté par: Trojan.BHO.AR
C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll
Echec de la désinfection
C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll
Supprimé
C:\VundoFix Backups\luleeorf.dll.bad
Infecté par: Trojan.BHO.G
C:\VundoFix Backups\luleeorf.dll.bad
Echec de la désinfection
C:\VundoFix Backups\luleeorf.dll.bad
Supprimé
C:\VundoFix Backups\sattrxqr.dll.bad
Infecté par: Trojan.BHO.AR
C:\VundoFix Backups\sattrxqr.dll.bad
Echec de la désinfection
C:\VundoFix Backups\sattrxqr.dll.bad
Supprimé
C:\VundoFix Backups\yphkikru.dll.bad
Infecté par: Trojan.Virtumod.JB
C:\VundoFix Backups\yphkikru.dll.bad
Echec de la désinfection
C:\VundoFix Backups\yphkikru.dll.bad
Supprimé
C:\WINDOWS\system32\eynehkxm.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\eynehkxm.dll
Echec de la désinfection
C:\WINDOWS\system32\eynehkxm.dll
Supprimé
C:\WINDOWS\system32\hbaapplg.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\hbaapplg.dll
Echec de la désinfection
C:\WINDOWS\system32\hbaapplg.dll
Supprimé
C:\WINDOWS\system32\jklhglcd.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\jklhglcd.dll
Echec de la désinfection
C:\WINDOWS\system32\jklhglcd.dll
Supprimé
C:\WINDOWS\system32\mbfxpfrl.dll
Infecté par: Trojan.BHO.AL
C:\WINDOWS\system32\mbfxpfrl.dll
Echec de la désinfection
C:\WINDOWS\system32\mbfxpfrl.dll
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002
Détecté avec: Adware.Softomate.D
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002
Echec de la désinfection
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)
Echec de la mise à jour
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006
Détecté avec: Adware.Softomate.D
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006
Echec de la désinfection
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)
Echec de la mise à jour
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002
Détecté avec: Adware.Softomate.D
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002
Echec de la désinfection
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)
Echec de la mise à jour
C:\WINDOWS\system32\sccbeqet.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\sccbeqet.dll
Echec de la désinfection
C:\WINDOWS\system32\sccbeqet.dll
Supprimé
C:\WINDOWS\system32\ttoobyyv.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\ttoobyyv.dll
Echec de la désinfection
C:\WINDOWS\system32\ttoobyyv.dll
Supprimé
C:\WINDOWS\system32\ylvsiyqq.dll
Infecté par: Trojan.BHO.AL
C:\WINDOWS\system32\ylvsiyqq.dll
Echec de la désinfection
C:\WINDOWS\system32\ylvsiyqq.dll
Supprimé
Voie d'analyse: A:\;C:\;D:\;E:\;
Statistiques
Temps
02:42:22
Fichiers
487267
Directoires
7507
Secteurs de boot
2
Archives
3879
Paquets programmes
35100
Résultats
Virus identifiés
8
Fichiers infectés
20
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
20
Info sur les moteurs
Définition virus
486039
Version des moteurs
AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
6
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class
Infecté par: Java.Trojan.Exploit.Bytverify
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>BlackBox.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class
Infecté par: Java.Trojan.Exploit.Bytverify.C
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>VerifierBug.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class
Infecté par: Java.Trojan.Exploit.Bytverify
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Dummy.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class
Infecté par: Java.Trojan.Exploit.Bytverify.C
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class
Echec de la désinfection
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip=>Beyond.class
Supprimé
C:\Documents and Settings\Nicolas\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-580b77d2-363d7d15.zip
Mis à jour
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Infecté par: Trojan.Bat.Hdkill.A
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Echec de la désinfection
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Supprimé
C:\Documents and Settings\Nicolas\Mes documents\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar
Echec de la mise à jour
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Infecté par: Trojan.Bat.Hdkill.A
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Echec de la désinfection
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar=>The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com\The_Sims_2_University_Language_Changer.ShadowCast.www!Osiolek!com.exe
Supprimé
C:\Program Files\eMule\Incoming\[PC Gioco ITA] The Sims 2 University + The Sims 2 Nightlife.rar=>The Sims 2 University + The Sims 2 Nightlife\The Sims 2 University + Keygen + Daemon Tools + Istruzioni per farlo partire - by Seth[Ita]\The Sims 2 University Languages.rar
Echec de la mise à jour
C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll
Infecté par: Trojan.BHO.AR
C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll
Echec de la désinfection
C:\System Volume Information\_restore{802BC397-3A29-4728-9FB6-55837C1B1EAC}\RP88\A0062961.dll
Supprimé
C:\VundoFix Backups\luleeorf.dll.bad
Infecté par: Trojan.BHO.G
C:\VundoFix Backups\luleeorf.dll.bad
Echec de la désinfection
C:\VundoFix Backups\luleeorf.dll.bad
Supprimé
C:\VundoFix Backups\sattrxqr.dll.bad
Infecté par: Trojan.BHO.AR
C:\VundoFix Backups\sattrxqr.dll.bad
Echec de la désinfection
C:\VundoFix Backups\sattrxqr.dll.bad
Supprimé
C:\VundoFix Backups\yphkikru.dll.bad
Infecté par: Trojan.Virtumod.JB
C:\VundoFix Backups\yphkikru.dll.bad
Echec de la désinfection
C:\VundoFix Backups\yphkikru.dll.bad
Supprimé
C:\WINDOWS\system32\eynehkxm.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\eynehkxm.dll
Echec de la désinfection
C:\WINDOWS\system32\eynehkxm.dll
Supprimé
C:\WINDOWS\system32\hbaapplg.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\hbaapplg.dll
Echec de la désinfection
C:\WINDOWS\system32\hbaapplg.dll
Supprimé
C:\WINDOWS\system32\jklhglcd.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\jklhglcd.dll
Echec de la désinfection
C:\WINDOWS\system32\jklhglcd.dll
Supprimé
C:\WINDOWS\system32\mbfxpfrl.dll
Infecté par: Trojan.BHO.AL
C:\WINDOWS\system32\mbfxpfrl.dll
Echec de la désinfection
C:\WINDOWS\system32\mbfxpfrl.dll
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002
Détecté avec: Adware.Softomate.D
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002
Echec de la désinfection
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0002
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)
Echec de la mise à jour
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006
Détecté avec: Adware.Softomate.D
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006
Echec de la désinfection
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0006
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)
Echec de la mise à jour
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002
Détecté avec: Adware.Softomate.D
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002
Echec de la désinfection
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)=>lzma_solid_nsis0002
Supprimé
C:\WINDOWS\system32\mc-110-12-0000144.exe=>(NSIS o)=>lzma_solid_nsis0008=>(NSIS g)
Echec de la mise à jour
C:\WINDOWS\system32\sccbeqet.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\sccbeqet.dll
Echec de la désinfection
C:\WINDOWS\system32\sccbeqet.dll
Supprimé
C:\WINDOWS\system32\ttoobyyv.dll
Infecté par: Trojan.BHO.AR
C:\WINDOWS\system32\ttoobyyv.dll
Echec de la désinfection
C:\WINDOWS\system32\ttoobyyv.dll
Supprimé
C:\WINDOWS\system32\ylvsiyqq.dll
Infecté par: Trojan.BHO.AL
C:\WINDOWS\system32\ylvsiyqq.dll
Echec de la désinfection
C:\WINDOWS\system32\ylvsiyqq.dll
Supprimé
re
visiblement il a terminé le ménage. Encore des problèmes ?
mais les téléchargements.....
pas bon !!!
visiblement il a terminé le ménage. Encore des problèmes ?
mais les téléchargements.....
The Sims 2 University
pas bon !!!
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:40:30, on 15/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
Scan saved at 22:40:30, on 15/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Nicolas\Bureau\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [{907B25B4-0AE9-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE9-1036-0828-030312240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{907B25B4-0AE8-1036-0828-030312240021}] "C:\Program Files\Fichiers communs\{907B25B4-0AE8-1036-0828-030312240021}\Update.exe" mc-110-12-0000144 (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F344238C-1679-4029-8F24-3B1D97F4E6F7}: NameServer = 212.27.32.5,212.27.32.176
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender9\vsserv.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
Je ne sais pas, pour le moment non :)
Je pensais qu'un rapport vous suffisez à me dire s'il me reste des merdes ^^
MErci infiniment!
Je pensais qu'un rapport vous suffisez à me dire s'il me reste des merdes ^^
MErci infiniment!
re
non on ne voit pas tout dans un rapport Hijackthis, ceci dit, je pense que si tu n'as plus de problème apparents après tout le ménage qu'on a fait, ce devrait être bon
* Tu peux supprimer tous les logiciels que nous avons utilisés
qui traitent des infections spécifiques et qui sont mis à jour réguliérement.
* démarrer-----------panneau de configuration------------système----------
onglet Restauration système-----------coche la case (Désactiver la restauration système)--------------
redémarre l'ordinateur
réactive la ensuite
* Pour améliorer la sécurité de ton PC prend quelques instants pour lire
CECI
* Dénonce ton infection pour faire condamner les auteurs.
Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :
- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"
Tu as alors sous forme de liste un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).
La tienne = ******
---> https://malwarecomplaints.info/
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections
conforme au règle du forum (age, ville, département etc..)
Indique aussi le nom du Forum qui t'a aidé, <grad>CommentCaMarche</gras>
* met ton sujet en RESOLU stp, merci.
non on ne voit pas tout dans un rapport Hijackthis, ceci dit, je pense que si tu n'as plus de problème apparents après tout le ménage qu'on a fait, ce devrait être bon
* Tu peux supprimer tous les logiciels que nous avons utilisés
qui traitent des infections spécifiques et qui sont mis à jour réguliérement.
* démarrer-----------panneau de configuration------------système----------
onglet Restauration système-----------coche la case (Désactiver la restauration système)--------------
redémarre l'ordinateur
réactive la ensuite
* Pour améliorer la sécurité de ton PC prend quelques instants pour lire
CECI
* Dénonce ton infection pour faire condamner les auteurs.
Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :
- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"
Tu as alors sous forme de liste un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).
La tienne = ******
---> https://malwarecomplaints.info/
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections
conforme au règle du forum (age, ville, département etc..)
Indique aussi le nom du Forum qui t'a aidé, <grad>CommentCaMarche</gras>
* met ton sujet en RESOLU stp, merci.