Virus portugais

fifi -

bonjour voila je pense avoir un virus quand je me connécte sur msn un méssage s affiche (acabei de atualiza meu novo flog, vi ta ae e deixa um comentario!! http://audio.ya.com/topflog)
commen fair pour le suprimer merci

Configuration: Windows XP
Internet Explorer 6.0

Afficher la suite

12 réponses

Réponse 1 / 12
fifi
VOICI LE RAPORT :
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 15:15:18, on 17/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\DriveCleaner 2006 Free\SDRmon.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\udll.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.mes-dialogues.net/zonedial/?dial=sexe&ids=1000000000
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SDR6V_Check] "C:\Program Files\Fichiers communs\DriveCleaner 2006 Free\SDRmon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Flash_Player_Install[1]] C:\WINDOWS\udll.exe
O4 - HKLM\..\Run: [udll] C:\WINDOWS\udll.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
O9 - Extra 'Tools' menuitem: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{385E34D3-4407-4ECC-B3E8-0204D0357AB0}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\..\{A95D482D-0D9E-4D2A-8741-42765C5AC8E3}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD0833F2-FAD8-4355-ADA0-05EF43AC419C}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD03BF62-C57E-4B3E-8657-43E33F955B82}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.237 85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.237 85.255.112.201
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
0
Réponse 2 / 12
Lyonnais92 Contributeur sécurité
Bonjour,

il y a plus ennuyeux que le virus portugais;

Imprime ces instructions car il va y avoir un redémarrage de l'ordinateur.

* Télécharge FixWareout d'un de ces deux sites sur le bureau:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) dans ta prochaine réponse.

Ensuite, Téléchargez MSNFix.zip (de !aur3n7) sur votre bureau:
http://sosvirus.changelog.fr/MSNFix.zip

Décompressez-le (clic droit >> Extraire ici) et double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, exécutez l'option N.
--- Sauvegardez ce rapport puis faites un copier/coller de ce rapport dans la réponse.
Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.

Remets un log Hijackthis.

@+
0
1. FIFI
  
  MERCI DE TON AIDE
  
  Fixwareout Last edited 4/5/2007
  Post this report in the forums please
  ...
  »»»»»Prerun check
  
  »»»»» System restarted
  
  »»»»» Postrun check
  HKLM\SOFTWARE\~\Winlogon\ "System"="lsass.exe"
  ....
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "}017127156284-D02B-BBD4-B7A7-FFC00F0E{" Deleted
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "}09F75566947D-AFEA-DC24-FB72-D847203A{" Deleted
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "gltmd" Deleted
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "1trap" Deleted
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "2trap" Deleted
  ....
  »»»»» Misc files.
  ....
  »»»»» Checking for older varients.
  ....
  
  Search five digit cs, dm, kd, jb, other, files.
  The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection.
  
  Click browse, find the file then click submit.
  http://www.virustotal.com/flash/index_en.html
  Or https://virusscan.jotti.org/
  
  »»»»» Other
  
  »»»»» Current runs
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
  "NeroFilterCheck"="C:\\Program Files\\Fichiers communs\\Ahead\\Lib\\NeroCheck.exe"
  "SDR6V_Check"="\"C:\\Program Files\\Fichiers communs\\DriveCleaner 2006 Free\\SDRmon.exe\""
  "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
  "Flash_Player_Install[1]"="C:\\WINDOWS\\udll.exe"
  "udll"="C:\\WINDOWS\\udll.exe"
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "IncrediMail"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe /c"
  "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
  "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
  "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit"
  "ccleaner"="\"C:\\Program Files\\CCleaner\\ccleaner.exe\" /AUTO"
  "H/PC Connection Agent"="\"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\""
  "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
  "updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1"
  ....
  Hosts file was reset, If you use a custom hosts file please replace it
  »»»»» End report »»»»»
  
  0
2. FIFI
  
  voici le raport Hijackthis
  
  Logfile of Trend Micro HijackThis v2.0.0 (BETA)
  Scan saved at 18:10:00, on 17/04/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\system32\WgaTray.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Fichiers communs\DriveCleaner 2006 Free\SDRmon.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\PROGRA~1\INCRED~1\bin\IMApp.exe
  C:\PROGRA~1\MICROS~4\rapimgr.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\HiJackThis_v2.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.mes-dialogues.net/zonedial/?dial=sexe&ids=1000000000
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
  O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [SDR6V_Check] "C:\Program Files\Fichiers communs\DriveCleaner 2006 Free\SDRmon.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
  O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra 'Tools' menuitem: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{385E34D3-4407-4ECC-B3E8-0204D0357AB0}: NameServer = 85.255.115.237,85.255.112.201
  O17 - HKLM\System\CCS\Services\Tcpip\..\{A95D482D-0D9E-4D2A-8741-42765C5AC8E3}: NameServer = 85.255.115.237,85.255.112.201
  O17 - HKLM\System\CCS\Services\Tcpip\..\{DD0833F2-FAD8-4355-ADA0-05EF43AC419C}: NameServer = 85.255.115.237,85.255.112.201
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FD03BF62-C57E-4B3E-8657-43E33F955B82}: NameServer = 85.255.115.237,85.255.112.201
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.237 85.255.112.201
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.237 85.255.112.201
  O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
  O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
  O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
  O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
  O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
  O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
  O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
  O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
  O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
  
  0
Réponse 3 / 12
Lyonnais92 Contributeur sécurité
Re,

il manque le rapport de MSNFix (que tu as fait passer).

Relance Hijackthis, choisis do a scan only.
Coche la case devant les lignes :

O2 - BHO: (no name) - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{385E34D3-4407-4ECC-B3E8-0204D0357AB0}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\..\{A95D482D-0D9E-4D2A-8741-42765C5AC8E3}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD0833F2-FAD8-4355-ADA0-05EF43AC419C}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD03BF62-C57E-4B3E-8657-43E33F955B82}: NameServer = 85.255.115.237,85.255.112.201
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.237 85.255.112.201
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.237 85.255.112.201

ferme toutes les autres fenêtres actives (y compris le navigateur) et clique sur Fix checked;

ferme Hijackthis.

relance le pour poster un nouveau log.

Il y a encore du travail à faire, mais ce sera un peu plus tard.
@+
0
1. fifi
  
  suite a tes explication voici le dernier rapport Hijackthis.
  
  Logfile of Trend Micro HijackThis v2.0.0 (BETA)
  Scan saved at 19:43:57, on 17/04/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\system32\WgaTray.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Fichiers communs\DriveCleaner 2006 Free\SDRmon.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\PROGRA~1\MICROS~4\rapimgr.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\PROGRA~1\INCRED~1\bin\IMApp.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\HiJackThis_v2.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.mes-dialogues.net/zonedial/?dial=sexe&ids=1000000000
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [SDR6V_Check] "C:\Program Files\Fichiers communs\DriveCleaner 2006 Free\SDRmon.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
  O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra 'Tools' menuitem: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
  O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
  O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
  O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
  O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
  O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
  O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
  O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
  O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
  O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
  
  0
Réponse 4 / 12
Lyonnais92 Contributeur sécurité
Bonsoir,

il semble que tu n'as pas de parefeu.

rends toi sur ce lien etg télécharge puis configure kerio (gratuit même aprçs 30 jours) :
http://kerio.probb.fr/Systemesd-exploitation-c1/Logiciels-et-tutoriels-gratuits-tries-par-categorie-f6/Tutoriel-pour-Kerio-4-version-gratuite-t201.htm

@+
0
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 12
Lyonnais92 Contributeur sécurité
Re,

Télécharge Brute Force Uninstaller (de Merijn) ici: http://www.merijn.org/files/bfu.zip
Créé un nouveau dossier directement à la racine de ton disque dur ou l'endroit qui te convient, nomme ce dossier BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (par exemple C:\BFU)
Ensuite, télécharge Winsoftware.bfu (de lazzzy) :
Fais un clik droit ici : : http://www.alt-shift-return.org/Info/Fichiers/Winsoftware.bfu
et choisis "Enregistrer la cible sous..." afin de télécharger Winsoftware.bfu (delazzzy).
Sauvegarde dans le dossier créé (C:\BFU).
**Note : si tu utilises Internet Explorer ; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers".

Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : Winsoftware.bfu et BFU.exe (très important).

-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

Tu as une démo animée ici (merci balltrap34):
http://perso.orange.fr/rginformatique/section%20virus/bfu%20demo.htm
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
Lance "Brute Force Uninstaller" en double-cliquant BFU.exe (Dans le dossier C:\BFU)
- Clique sur le petit dossier jaune, et clique sur : Winsoftware.bfu
- Coches la case Show log after scrïpt ends
- Clique sur Execute pour que le fix fasse son boulot :-) Attends que le message Complete scrïpt execution apparaîsse et clique sur OK.
Un rapport va s'afficher dans la fenetre du programme, copie et colle dans le bloc-notes, puis sauvegardes le, tu le posteras plus tard sur le forum.
Clique Exit pour fermer le programme BFU.

Remets un log Hijackthis.

@+
0
1. fifi
  
  BONJOUR voila comme tu me l a demandé j'ai instalé un parfeu, puis j'ai téléchargé BFU voici le rapport
  
  BFU v1.00.9
  Windows XP SP2 (WinNT 5.01.2600 SP2)
  Script started at 17:02:16, on 19/04/2007
  
  Option Unload Explorer: Yes
  Warning: unknown command '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">' on line #1
  Warning: unknown command '' on line #2
  Warning: unknown command '<HTML><HEAD>' on line #3
  Warning: unknown command '<META http-equiv=Content-Type content="text/html; charset=windows-1252">' on line #4
  Warning: unknown command '<META content="MSHTML 6.00.2900.3059" name=GENERATOR></HEAD>' on line #5
  Warning: unknown command '<BODY><PRE># Winsoftware.bfu' on line #6
  Failed: ServiceStop FWSvc (service not found)
  Failed: ServiceDisable FWSvc (service not found)
  Failed: ServiceDelete FWSvc (service not found)
  Failed: DllUnregister C:\Program Files\DriveCleaner 2006 Free\UDCPChk.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\DriveCleaner 2006 Free\UDCShell.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\df_fixer.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\df_proxy.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\ecc.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\esSPCheck.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\FFWraper.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\FixCore.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\FiFxr5.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\FTRec.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\MMFix.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\ErrorSafe\StrRes.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\compclr.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\df_fixer.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\df_proxy.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\FFWrapr.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\flfxr10.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\FTRec.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\FxCore.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\MMFx.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SysProtect\StrRes.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\SystemDoctor 2006 Free\order.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006\AsAgents.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006\shellext.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\AsAgents.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\shellext.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\uwas6chk.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiSpyware 2006 Scanner\was6chk.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\avkernel.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\IEFWBHO.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\libfn.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\rpt.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinAntiVirus Pro 2006\winpgi.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\compcln.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\df_fixer.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\df_proxy.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\ffCom.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\FFWraper.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\FileTypeRecognizer.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\FixCore.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\MMFix.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\OEDrop.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\WinFixer 2005\StrRes.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\Common Files\Companion Wizard\WapCHK.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\Common Files\WinAntiSpyware 2006\was6chk.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\Common Files\WinAntiVirus Pro 2006\WapCHK.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\Common Files\WinSoftware\CrXML.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\Common Files\WinSoftware\PCheck.dll|1 (file not found)
  Failed: DllUnregister C:\Program Files\Fichiers communs\WinFixer 2005\uwappchk.dll|1 (file not found)
  Failed: DllUnregister C:\WINDOWS\system32\SpOrder.dll|1 (file not found)
  Failed: DllUnregister C:\WINDOWS\syst32.dll|1 (file not found)
  Failed: FileDelete C:\Program Files\Common Files\Companion Wizard\WapCHK{*}.dll (operation failed)
  Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.1\U*_*_*NetInstaller.exe (operation failed)
  Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.2\U*_*_*NetInstaller.exe (operation failed)
  Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.3\U*_*_*NetInstaller.exe (operation failed)
  Failed: FileDelete C:\WINDOWS\Downloaded Program Files\CONFLICT.4\U*_*_*NetInstaller.exe (operation failed)
  Failed: FolderDelete C:\Documents and Settings\Martin\Application Data\systemdoctor 2006 free (folder not found)
  Failed: FolderDelete C:\Documents and Settings\Martin\Application Data\WinAntiVirus Pro 2006 (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Application Data\WinAntiVirus Corp (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006 (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\DriveCleaner 2006 Free (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ErrorSafe (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\SystemDoctor 2006 Unregistered Version (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinAntiSpyware 2006 (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinAntiSpyware 2006 Scanner (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinAntiVirus Pro 2006 (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinFixer 2005 (folder not found)
  Failed: FolderDelete C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\SysProtect (folder not found)
  Failed: FolderDelete C:\Program Files\DriveCleaner 2006 Free (folder not found)
  Failed: FolderDelete C:\Program Files\erroguard (folder not found)
  Failed: FolderDelete C:\Program Files\Error Safe (folder not found)
  Failed: FolderDelete C:\Program Files\Error Safe Free (folder not found)
  Failed: FolderDelete C:\Program Files\ErrorSafe (folder not found)
  Failed: FolderDelete C:\Program Files\errorsafe free (folder not found)
  Failed: FolderDelete C:\Program Files\SysProtect Free (folder not found)
  Failed: FolderDelete C:\Program Files\SystemDoctor 2006 Free (folder not found)
  Failed: FolderDelete C:\Program Files\WinAntiSpyware 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\WinAntiSpyware 2006 Free (folder not found)
  Failed: FolderDelete C:\Program Files\WinAntiSpyware 2006 Scanner (folder not found)
  Failed: FolderDelete C:\Program Files\WinAntiVirus 2005 (folder not found)
  Failed: FolderDelete C:\Program Files\WinAntiVirus Pro 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\WinFixer 2005 (folder not found)
  Failed: FolderDelete C:\Program Files\WinPopupGuard 2005 (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\DriveCleaner 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\DriveCleaner 2006 Free (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\DriveCleaner Free (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\Error Safe (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\erroguard (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\errorguard (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\ErrorSafe (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\SystemDoctor 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\WinAntiSpyware 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\WinAntiVirus Pro 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\WinFixer 2005 (folder not found)
  Failed: FolderDelete C:\Program Files\Archivos comunes\WinSoftware (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\DriveCleaner 2006 Free (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\erroguard (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\errorguard (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\ErrorSafe (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\SysProtect (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\SystemDoctor 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\WinAntiSpyware 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\WinAntiVirus Pro 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\WinFixer 2005 (folder not found)
  Failed: FolderDelete C:\Program Files\Common Files\WinSoftware (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\DriveCleaner 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\DriveCleaner 2006 Free (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\DriveCleaner Free (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\Error Safe (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\erroguard (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\errorguard (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\ErrorSafe (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\SystemDoctor 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\WinAntiSpyware 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\WinAntiVirus Pro 2006 (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\WinAntivirus Pro 2007 (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\WinFixer 2005 (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\WinFixer 2005 (folder not found)
  Failed: FolderDelete C:\Program Files\Fichiers communs\WinSoftware (folder not found)
  Failed: FolderDelete C:\WinAntiVirus Pro 2006 (folder not found)
  Failed: FileDelete %USERPROFILE%\Cookies\*@*drivecleaner*.txt (operation failed)
  Failed: FileDelete %USERPROFILE%\Cookies\*@*errorsafe*.txt (operation failed)
  Failed: FileDelete %USERPROFILE%\Cookies\*@*systemdoctor*.txt (operation failed)
  Failed: FileDelete %USERPROFILE%\Cookies\*@*WinAntiSpyware*.txt (operation failed)
  Failed: FileDelete %USERPROFILE%\Cookies\*@*winantivirus*.txt (operation failed)
  Failed: FileDelete %USERPROFILE%\Cookies\*@*winfixer*.txt (operation failed)
  Failed: FileDelete %USERPROFILE%\Cookies\*@*yieldmanager*.txt (operation failed)
  Failed: FileDelete C:\DOCUME~1\Martin\LOCALS~1\Temp\MFPL7014.DLL (operation failed)
  Failed: FileDelete C:\DOCUME~1\Martin\LOCALS~1\Temp\WCESLog.log (operation failed)
  Failed: FileDelete C:\DOCUME~1\Martin\LOCALS~1\Temp\~DF8148.tmp (operation failed)
  Failed: FileDelete C:\DOCUME~1\Martin\LOCALS~1\Temp\~DF81FA.tmp (operation failed)
  Failed: FileDelete C:\DOCUME~1\Martin\LOCALS~1\Temp\~DF8BB8.tmp (operation failed)
  Failed: FileDelete C:\WINDOWS\Temp\Perflib_Perfdata_228.dat (operation failed)
  Failed: FolderDelete C:\WINDOWS\Temp\_avast4_ (operation failed)
  Script completed.
  
  autre rapport Hijackthis.
  
  Logfile of Trend Micro HijackThis v2.0.0 (BETA)
  Scan saved at 17:09:35, on 19/04/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\PROGRA~1\INCRED~1\bin\IMApp.exe
  C:\PROGRA~1\MICROS~4\rapimgr.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
  C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
  C:\WINDOWS\system32\WgaTray.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\HiJackThis_v2.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.mes-dialogues.net/zonedial/?dial=sexe&ids=1000000000
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
  O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra 'Tools' menuitem: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
  O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
  O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
  O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
  O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
  O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
  O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
  O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
  O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
  O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
  O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
  
  0
Réponse 6 / 12
Lyonnais92 Contributeur sécurité
Bonjour,

exit Drive Cleaner.

La suite :

Télécharge sur ton bureau : http://www.malekal.com/download/clean.zip
Une fois sur le bureau, tu fais un clic droit sur ton fichier clean.zip et dans le menu déroulant, tu clics sur extrait tout ou extraire ici.
Cela va créer un dossier clean.
Double-clic sur ce dossier clean, tu y trouveras dedans plusieurs fichiers.
Double-clic sur clean. Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 en appuyant sur la touche 1 de ton clavier.
Clean va travailler.
Un rapport Va etre généré, colle le contenu entier ici.

@+
0
1. fifi
  
  re bonjour merci encor pour ton aide voici le rapport suite au téléchargement de clean:
  
  21/04/2007 a 13:46:20,62
  
  *** Recherche des fichiers dans C:
  
  *** Recherche des fichiers dans C:\WINDOWS\
  C:\WINDOWS\UnGins.exe FOUND
  
  *** Recherche des fichiers dans C:\WINDOWS\system32
  C:\WINDOWS\system32\i FOUND
  "C:\Documents and Settings\Martin\Application Data\ezpinst.exe" FOUND
  
  *** Recherche des fichiers dans C:\Program Files
  "C:\Program Files\Viewpoint\" FOUND
  *** Fin du rapport !
  
  0
Réponse 7 / 12
Lyonnais92 Contributeur sécurité
Bonjour,

•- Redémarre en mode sans échec. ( note bien ce que tu as à faire ).

Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).

•- Ouvre le dossier « clean » qui se trouve sur ton bureau.
•- Double-clic sur « clean.cmd ».
Une fenêtre noire va apparaître, choisis l’option 2.

Clean va travailler.
•- Redémarre normalement
•- Poste qui se trouve ici C:\rapport_clean.txt.

Remets aussi un log Hijackthis.

@+
0
1. fifi
  
  voici le rapport:
  
  Script execute en mode sans echec
  Rapport clean par Malekal_morte - http://www.malekal.com
  Script execute en mode sans echec 21/04/2007 a 17:04:18,53
  
  Microsoft Windows XP [version 5.1.2600]
  
  *** Suppression des fichiers dans C:
  
  *** Suppression des fichiers dans C:\WINDOWS\
  tentative de suppression de C:\WINDOWS\UnGins.exe
  
  *** Suppression des fichiers dans C:\WINDOWS\system32
  tentative de suppression de C:\WINDOWS\system32\i
  tentative de suppression de "C:\Documents and Settings\Martin\Application Data\ezpinst.exe"
  
  *** Suppression des fichiers dans C:\Program Files
  tentative de suppression de "C:\Program Files\Viewpoint\"
  
  *** Suppression des clefs du registre effectuee..
  *** Fin du rapport !
  
  rapport Hijackthis :
  Logfile of Trend Micro HijackThis v2.0.0 (BETA)
  Scan saved at 17:09:13, on 21/04/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  Boot mode: Safe mode
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\HiJackThis_v2.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.mes-dialogues.net/zonedial/?dial=sexe&ids=1000000000
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
  O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra 'Tools' menuitem: Allocam Multi Vision - {2D6B57BF-71FA-41A3-BDC5-3B5A25813D2E} - C:\PROGRA~1\ALLOCA~1\allocam.exe (file missing)
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
  O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
  O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
  O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
  O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
  O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
  O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
  O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
  O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
  O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
  O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
  O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
  
  0
Réponse 8 / 12
Utilisateur anonyme
(pour suivre)
salut Le lyonnais et fifi,
pour mon info, tu as fait télécharger ceci:
Ensuite, Téléchargez MSNFix.zip (de !aur3n7) sur votre bureau:
http://sosvirus.changelog.fr/MSNFix.zip
Par rapport à quelle ligne du log HJT ?
Quel est le but de ce script ?
merci d'avance ?
;-)

*****Dans chaque église, il y a toujours quelque chose qui cloche******
Je n'ai pas la prétention de résoudre les problèmes, j'essaie simplement de rendre service ;-)
0
Réponse 9 / 12
Lyonnais92 Contributeur sécurité
Bonjour,

une réponse complète à ta question sur SOS Virus.

Le fix vise à réparer les infections passant pas MSN.

Ici, cest l'information initiale de fifi qui me fait utiliser le fix.

Les lignes dans le log sont :
O4 - HKLM\..\Run: [Flash_Player_Install[1]] C:\WINDOWS\udll.exe
O4 - HKLM\..\Run: [udll] C:\WINDOWS\udll.exe

mais les infections traitées par le fix ont des modalités très diverses.
@+
0
Réponse 10 / 12
Utilisateur anonyme
merci de ton info.
;-)
0
Réponse 11 / 12
Utilisateur anonyme
salut fifi,
attends les instructions du Lyonnais.
en tous cas le script a fait son travail.
repostes un log Hijackthis.
0
Réponse 12 / 12
Lyonnais92 Contributeur sécurité
Re,

fif, où en es tu de tes soucis ?
@+
0

Virus portugais

12 réponses

Discussions similaires

Newsletters