Trop de pub + systeme lourd Résolu/Fermé

Question

Bonjour tout le monde. Mon systeme est trooooop lourd depuis un bout de temps. je recois bcp de pub, ainsi que mon systeme est alourdi.
j'ai installe Avg antispy + Avg anti virus, spybot search and destroy, et Zone alarm Pare feu.
Voici le rapport de Hijacthis, je suis sur qu'il ya trp de chose a enelever.
Merci en avance pour votre aide.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 6:17:13 PM, on 29/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\DOCUME~1\moe6\APPLIC~1\SCURIT~1\javaw.exe
C:\Program Files\?ssembly
?tepad.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0A923B17-AEC9-4DBC-95B0-84751BB05A0b} - C:\WINDOWS\system32\lrvmpshk.dll (file missing)
O2 - BHO: (no name) - {36DBC179-A19F-48F2-B16A-6A3E19B42A87} - C:\WINDOWS\system32\ipv6monl.dll
O2 - BHO: (no name) - {6693A040-1580-3B54-A349-66E348E3FC9A} - C:\WINDOWS\system32\qpslo.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C71ECA6E-88B7-44C7-BEC1-ECEF1275267D} - C:\WINDOWS\system32\yayaa.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32	dcydywx.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\quydclst.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Utab] "C:\DOCUME~1\moe6\APPLIC~1\SCURIT~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKCU\..\Run: [Fhhfldu] "C:\Program Files\?ssembly
?tepad.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: yayaa - C:\WINDOWS\system32\yayaa.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

raleuboleu · Answer

bonsoir 

je te conseilles vivement de cocher cette ligne via hijack dans 1 premier temps : car Troj/Cimuz-AS

- O2 - BHO: (no name) - {36DBC179-A19F-48F2-B16A-6A3E19B42A87}  C:\WINDOWS\system32\ipv6monl.dll

oui pleins de choses a faire !!

bizoux

raleuboleu · Answer

re

ensuite :
 Télécharge Blacklight

https://europe.f-secure.com/exclude/blacklight/index.shtml
(de F-Secure)
(le premier de la page)

Clique sur "I ACCEPT" au bas de la page. Sauvegarde le sur ton Bureau.
Double-clique blbeta.exe et accepte la licence;
clique Scan puis Next

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport,
sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

Copie et colle le contenu de ce rapport dans ta prochaine réponse.
NE PAS choisir l'option "Rename" de suite : nous devons analyser le rapport 

a+

mido · Answer

Salut,
 - j'ai fixé le fichier nommé cidessus avec hijackthis.
 - j'ai loadé le blacklight, scané. mais il ne fait pas l'etape deux cleaning, est ce que c'est normal !!!
 en tout cas je vais joindre le rapport ainsi qu'un autre rapport de hijackthis.
Merci
a+

Blacklight
=========
04/30/07 19:14:52 [Info]: BlackLight Engine 1.0.61 initialized
04/30/07 19:14:52 [Info]: OS: 5.1 build 2600 (Service Pack 2)
04/30/07 19:14:52 [Note]: 7019 4
04/30/07 19:14:52 [Note]: 7005 0
04/30/07 19:14:54 [Note]: 7006 0
04/30/07 19:14:54 [Note]: 7011 1144
04/30/07 19:14:54 [Note]: 7026 0
04/30/07 19:14:55 [Note]: 7026 0
04/30/07 19:14:59 [Note]: FSRAW library version 1.7.1021
04/30/07 19:17:55 [Note]: 7006 0
04/30/07 19:17:55 [Note]: 7011 1144
04/30/07 19:17:56 [Note]: 7026 0
04/30/07 19:17:56 [Note]: 7026 0
04/30/07 19:18:00 [Note]: FSRAW library version 1.7.1021
04/30/07 19:20:22 [Note]: 7007 0



=========



Hijackthis
=======
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 7:22:05 PM, on 30/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\DOCUME~1\moe6\APPLIC~1\SCURIT~1\javaw.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\?ssembly
?tepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0A923B17-AEC9-4DBC-95B0-84751BB05A0b} - C:\WINDOWS\system32\lrvmpshk.dll (file missing)
O2 - BHO: (no name) - {6496F114-41D3-6A5F-A349-66E348E3A99C} - C:\WINDOWS\system32\fnwxke.dll
O2 - BHO: (no name) - {691E0FD1-F8F8-46AB-8879-4443D73B0307} - C:\WINDOWS\system32\yayaa.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32	dcydywx.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\quydclst.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Utab] "C:\DOCUME~1\moe6\APPLIC~1\SCURIT~1\javaw.exe" -vt yazb
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKCU\..\Run: [Fhhfldu] "C:\Program Files\?ssembly
?tepad.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: yayaa - C:\WINDOWS\system32\yayaa.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

raleuboleu · Answer

salut

sur hijack coche ces lignes stp :

-O4 - HKCU\..\Run: [Utab] C:\DOCUME~1\moe6\APPLIC~1\SCURIT~1\javaw.exe" -vt yazb
	
-O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe

et click sur fixer objet

biz

raleuboleu · Answer

re

as tu fais 1 scan avec spybot?

a+

mido · Answer

salut
spybot. j'ai fais un scan la semaine passé, je vais le faire une autre fois aujourdhui  ainsi que  le hijackthis car je suis au travail maintenant.

a+

raleuboleu · Answer

ok

ben dis donc tu bosses !!! bon courage alors

a+

mido · Answer

Salut
alors, j'ai fais un scan 7 fix avec Spybot.
par lasuite j'ai enlevé les lignes suivantes du jijackthis

-O4 - HKCU\..\Run: [Utab] C:\DOCUME~1\moe6\APPLIC~1\SCURIT~1\javaw.exe" -vt yazb

-O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe

voila le rapport de hijackthis:
===============================
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:23:46 PM, on 01/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe 
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\?ssembly
?tepad.exe 
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe 
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe 
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0A923B17-AEC9-4DBC-95B0-84751BB05A0b} - C:\WINDOWS\system32\lrvmpshk.dll (file missing)
O2 - BHO: (no name) - {33A81727-9C81-4A90-B3B4-152CF159C9B9} - C:\WINDOWS\system32\yayaa.dll 
O2 - BHO: (no name) - {6496F114-41D3-6A5F-A349-66E348E3A99C} - C:\WINDOWS\system32\fnwxke.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32	dcydywx.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll 
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\quydclst.dll",realset 
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background 
O4 - HKCU\..\Run: [Fhhfldu] "C:\Program Files\?ssembly
?tepad.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xbttnajdz.dll 
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: yayaa - C:\WINDOWS\system32\yayaa.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll 
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe 
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe 
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

raleuboleu · Answer

re

Télécharge LSPfix ici :
http://www.cexx.org/LSPFix.exe

Lance LSPfix et agrandis la fenêtre qui, par défaut, est trop petite et fait apparaître les ascenseurs horizontaux et verticaux, masquant un bouton.
Déconnecte toi d'Internet et ferme toutes les instances (fenêtres) Internet Explorer.
Coche la case "I know what I'm doing" ("Je sais ce que je fais" ).
Sélectionne toutes les instances de la dll suivantes :

xbttnajdz.dll 
et fais les glisser du panneau de gauche, appelé "keep" au panneau de droite, appelé "Remove".

Clique sur le bouton [Finish].

Redémarre l'ordinateur. Remet un log Hijack stp

Bizz

mido · Answer

Salut,
voila tout est fait, sauf j'ai remarque des prob. lors du demarrage de windows. est ce que c'est normal ???

Remarque : j,ai remarqué des messages de PCDoctor malgré que j,ai deja desinstallé ce logiciel. je ne sais pas si ca fait partie des spams que j'ai.

Hijackthis
=======
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:09:47 PM, on 01/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe 
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\?ssembly
?tepad.exe 
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0A923B17-AEC9-4DBC-95B0-84751BB05A0b} - C:\WINDOWS\system32\lrvmpshk.dll (file missing)
O2 - BHO: (no name) - {6496F114-41D3-6A5F-A349-66E348E3A99C} - C:\WINDOWS\system32\fnwxke.dll 
O2 - BHO: (no name) - {65BBCDDE-4887-4421-9FEB-DBA949ACE017} - C:\WINDOWS\system32\yayaa.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32	dcydywx.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll 
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\quydclst.dll",realset 
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background 
O4 - HKCU\..\Run: [Fhhfldu] "C:\Program Files\?ssembly
?tepad.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: yayaa - C:\WINDOWS\system32\yayaa.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll 
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe 
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe 
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Darkkiller · Answer

Re,

Sous l'accord de raleboleu j'ai pris le relais.
Déjà télécharge la version de hijackthis 1.99 car celle de trend micro ets une version bêta (test)

télécharge HijackThis ici: 
http://telechargement.zebulon.fr/138-hijackthis-1991.html 

Dézippe le dans un dossier prévu à cet effet. 
Par exemple C:\hijackthis < Enregistre le bien dans c : !
 Renomme-le en Scanner.exe
Démo : (Merci a Balltrap34 pour cette réalisation) 
http://pageperso.aol.fr/balltrap34/Hijenr.gif 

Lance le puis: 
clique sur "do a system scan and save logfile" (cf démo) 
faire un copier coller du log entier sur le forum 

Démo : (Merci a Balltrap34 pour cette réalisation) 
http://pageperso.aol.fr/balltrap34/demohijack.htm

carla18 · Answer

excusez moi de cet aparté mais j'ai ceer un post et plus personne ne reponds que faire?
JE LE REMONTE SOUVENT

raleuboleu · Answer

salut

ne t'en fais pas Clara visiblement quelqu'un te suit nan?!

biz

mido · Answer

Salut Darkkiler,
voila mon rapport Hijackthis,
le situation est de plus en plus grave :(

Logfile of HijackThis v1.99.1
Scan saved at 7:28:37 PM, on 02/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\?ssembly
?tepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0A923B17-AEC9-4DBC-95B0-84751BB05A0b} - C:\WINDOWS\system32\lrvmpshk.dll (file missing)
O2 - BHO: (no name) - {6496F114-41D3-6A5F-A349-66E348E3A99C} - C:\WINDOWS\system32\fnwxke.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {856BA81F-9139-4868-BAFD-36A3A5885506} - C:\WINDOWS\system32\yayaa.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32	dcydywx.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\quydclst.dll",realset
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Fhhfldu] "C:\Program Files\?ssembly
?tepad.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: yayaa - C:\WINDOWS\system32\yayaa.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Darkkiller · Answer

Re,

Ouvre Hijackthis et clique sur "Do a system scan only" et coche ces lignes :

C:\Program Files\?ssembly
?tepad.exe

O2 - BHO: (no name) - {0A923B17-AEC9-4DBC-95B0-84751BB05A0b} - C:\WINDOWS\system32\lrvmpshk.dll (file missing)

O2 - BHO: (no name) - {6496F114-41D3-6A5F-A349-66E348E3A99C} - C:\WINDOWS\system32\fnwxke.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {856BA81F-9139-4868-BAFD-36A3A5885506} - C:\WINDOWS\system32\yayaa.dll

O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32	dcydywx.dll

O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\quydclst.dll",realset

O4 - HKCU\..\Run: [Fhhfldu] "C:\Program Files\?ssembly
?tepad.exe"

O20 - Winlogon Notify: yayaa - C:\WINDOWS\system32\yayaa.dll

Puis quand tu as coché ces lignes, clique sur "Fix Checked"

----------------------------------------------------------------------------

Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 
Double-clique VundoFix.exe afin de le lancer. 
Coche Run VundoFix as a task. 
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok 
Clique sur le bouton Scan for Vundo. 
Lorsque le scan est complété, clique sur le bouton Remove Vundo. 
Une invite te demandera si tu veux supprimer les fichiers, clique YES 
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK 
Démarre ton PC à nouveau. 

----------------------------------------------------------------------------

Puis redémarre en mode sans échec tuto : http://forum.telecharger.01net.com/forum/high-tech/SECURITE/Securite/redemarrer-mode-echec-sujet_1526_1.htm

Puis supprime manuellement ce fichier : 

C:\Program Files\?ssembly

----------------------------------------------------------------------------

Puis lance un scan complet AVG Anti-Spyware (fait une misa à jour avant)!

Donc je répète tu vas poster le log Vundo + lo log AVG A-S + un nouveau log Hijackthis.

mido · Answer

Bonjour,

Vundo
================

VundoFix V6.3.21

Checking Java version...

Sun Java not detected
Scan started at 9:32:46 PM 03/05/2007

Listing files found while scanning....

C:\WINDOWS\system32\baygpkeq.dll
C:\WINDOWS\system32\biqhkmps.dll
C:\WINDOWS\system32\kxgryaxu.dll
C:\WINDOWS\system32\lagpihxs.dll
C:\WINDOWS\system32\mulentxx.ini
C:\WINDOWS\system32\qomlllm.dll
C:\WINDOWS\system32\qommjhi.dll 
C:\WINDOWS\system32\quydclst.dll
C:\WINDOWS\system32daoehco.dll
C:\WINDOWS\system32	dcydywx.dll
C:\WINDOWS\system32	gocuoor.dll
C:\WINDOWS\system32	slcdyuq.ini
C:\WINDOWS\system32\wcklfwog.dll
C:\WINDOWS\system32\wonfphug.dll 
C:\WINDOWS\system32\xxtnelum.dll
C:\WINDOWS\system32\yayaa.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\baygpkeq.dll
C:\WINDOWS\system32\baygpkeq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\biqhkmps.dll
C:\WINDOWS\system32\biqhkmps.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\kxgryaxu.dll
C:\WINDOWS\system32\kxgryaxu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\lagpihxs.dll
C:\WINDOWS\system32\lagpihxs.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\mulentxx.ini
C:\WINDOWS\system32\mulentxx.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qomlllm.dll
C:\WINDOWS\system32\qomlllm.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qommjhi.dll
C:\WINDOWS\system32\qommjhi.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\quydclst.dll
C:\WINDOWS\system32\quydclst.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32daoehco.dll
C:\WINDOWS\system32daoehco.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	dcydywx.dll
C:\WINDOWS\system32	dcydywx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	gocuoor.dll
C:\WINDOWS\system32	gocuoor.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	slcdyuq.ini
C:\WINDOWS\system32	slcdyuq.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wcklfwog.dll
C:\WINDOWS\system32\wcklfwog.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wonfphug.dll
C:\WINDOWS\system32\wonfphug.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xxtnelum.dll
C:\WINDOWS\system32\xxtnelum.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\yayaa.dll
C:\WINDOWS\system32\yayaa.dll Has been deleted!

Performing Repairs to the registry.
Done!


================

 


AVG Antispyware
================
desolée pour le rapport
j'ai fait le scan, il detecté plein de trojan, puis il afin j'ai remarqué
comme s'il les a effacé.

En cliquant sur '' Reports '', il m'a rien donné. !!!  No reports

si c'est necessaire je vais le faire la prochaine fois.  
 

================

 


Hijackthis
=================

Logfile of HijackThis v1.99.1
Scan saved at 10:21:25 PM, on 03/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe 
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe 
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hijackthis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {91EF2658-D304-4B78-965F-98E400DE04C1} - C:\WINDOWS\system32\yayaa.dll (file missing) 
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe " /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\xxtnelum.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background 
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll 
O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL 
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe 
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe 
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe 

 

=================

Darkkiller · Answer

Re,


Ouvre Hijackthis et clique sur "Do a system scan only" et coche ces lignes :

O2 - BHO: (no name) - {91EF2658-D304-4B78-965F-98E400DE04C1} - C:\WINDOWS\system32\yayaa.dll (file missing)

O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\xxtnelum.dll",realset

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll

Puis quand tu as coché toutes ces lignes, clique sur "Fix Checked"

PUIS il serait nécessaure de refaire une analyse complete du systeme avec AVG ANTI-SPYWARE et de poster le rapport stp. Merci

mido · Answer

salut,

etvoila les rapports apres un san antispy. en passant j'ai utilise lsp fix afin d,enlever les fichiers  (  O10 - Unknown file in Winsock LSP: c:\windows\system32\molnnavbvcufy.dll )

Hijackthis
==========

Logfile of HijackThis v1.99.1
Scan saved at 12:16:35 AM, on 05/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe 
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe 
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe 
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hijackthis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll 
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" 
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background 
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL 
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe 
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe 
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe 



==========





---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

 + Created at: 12:10:01 AM 05/05/2007

 + Scan result: 

 

C:\WINDOWS\system32\fnwxke.dll -> Adware.PurityScan : No action taken.
C:\WINDOWS\b122.exe -> Adware.Softomate : No action taken.
C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@247realmedia[1].txt -> TrackingCookie.247realmedia : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@2o7 [2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@amazonsearsca.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@buzznet.112.2o7 [1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@partygaming.122.2o7 [1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@rotator.adjuggler [1].txt -> TrackingCookie.Adjuggler : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@adtech[2].txt -> TrackingCookie.Adtech : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@bluestreak[1].txt -> TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@ads.bridgetrack[1].txt -> TrackingCookie.Bridgetrack : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@com[1].txt -> TrackingCookie.Com : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@connextra[1].txt -> TrackingCookie.Connextra : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@enhance[1].txt -> TrackingCookie.Enhance : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@estat[2].txt -> TrackingCookie.Estat : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@findwhat[1].txt -> TrackingCookie.Findwhat : No action taken. 
C:\Documents and Settings\moe6\Cookies\moe6@hit.gemius[2].txt -> TrackingCookie.Gemius : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@linksynergy[1].txt -> TrackingCookie.Linksynergy : No action taken. 
C:\Documents and Settings\moe6\Cookies\moe6@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@overture[1].txt -> TrackingCookie.Overture : No action taken. 
C:\Documents and Settings\moe6\Cookies\moe6@www.paypal[1].txt -> TrackingCookie.Paypal : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@pro-market[2].txt -> TrackingCookie.Pro-market : No action taken. 
C:\Documents and Settings\moe6\Cookies\moe6@real[1].txt -> TrackingCookie.Real : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@realguide.real[1].txt -> TrackingCookie.Real : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@realmedia[2].txt -> TrackingCookie.Realmedia : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : No action taken. 
C:\Documents and Settings\moe6\Cookies\moe6@revsci[2].txt -> TrackingCookie.Revsci : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken. 
C:\Documents and Settings\moe6\Cookies\moe6@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@h.starware[1].txt -> TrackingCookie.Starware : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@try.starware[1].txt -> TrackingCookie.Starware : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\moe6\Cookies\moe6@weborama[1].txt -> TrackingCookie.Weborama : No action taken.
C:\WINDOWS\system32\wnscpsv32.exe -> Trojan.Small : No action taken.
C:\WINDOWS\system32\molnnavbvcufy.dll -> Trojan.Vqten.A : No action taken.


::Report end

Darkkiller · Answer

RE,

Refait une analyse AVG et a la fin en bas il y aura marquer "Actions recommandéesé et tu clique dessus et tu choisis "Supprimer". Puis ensuite tu supprime.

mido · Answer

Salut,
et voila c fait j'ai fais un scan all, puis j'ai supprimer tous les contenus qui ont ete detectes.
J'ai rebooter min systeme par la suite , mais je ne trouve pas le rapport AVG la dedans, je ne sais pas pourquoi !!

Voila j'affiche un autre rapport Hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 6:48:43 PM, on 06/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\Mixer.exe
D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\hijackthis\Scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - D:\Program Files\StopZilla\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - D:\Program Files\StopZilla\ZB2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.sxload.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Darkkiller · Answer

Re,


Ton sytème va mieux ? D'autres problèmes ?

mido · Answer

Merci infiniment Drikkler. je pense que maintenant c beaucoup mieux, pas plus de pub, je suis vraiment content.
Je vous remerci une autre fois.

a +

Darkkiller · Answer

Re,

Ok de rien !

@++ Bonsurf !
N'hésites pas a revenir dans le moindre problème ou de me contacter par messagerie privée

Trop de pub + systeme lourd

23 réponses

Discussions similaires