Infécté par Win32:VBStat-C

Arut -  
Bonjour,

J'ai un problème avec un trojan( Win32:VBStat-C) qui ouvre des pages internet et je ne suis pas capable de m'en défaire. J'aimerais avoir votre aide pour m'en débarasser. J'ai comme antivirus Avast
Merci

Arut
Configuration: Windows XP edition familiale
Firefox 2.0.0.3

27 réponses

Résumé de la discussion

Le fil porte sur une infection trojan Win32:VBStat-C qui redirige le navigateur et échappe aux tentatives de suppression, avec Avast installé sur Windows XP Edition Familiale et Firefox 2.0.0.3. Des outils comme VundoFix et HijackThis ont été employés, avec des rapports montrant suppression ou tentative de suppression de DLL et fichiers système, et des modifications de paramètres réseau. Plusieurs éléments persistants incluaient des fichiers dans system32 (fccbxus.dll, pmkjg.dll, jkhfd.dll), des entrées de démarrage et des serveurs DNS modifiés indiqués dans HijackThis, notamment. En dernier lieu, l'analyse AVG Anti-Spyware a signalé des éléments en restauration et a permis de nettoyer certaines entrées, mais des composants restants incitent à poursuivre le nettoyage.

Bobot (l’IA à votre service)
  1. Arut
    ca y est j'ai posté sur ce forum !
    1
    1. did71 Contributeur sécurité
      bonsoir,

      télécharge HijackThis:

      http://pchelpbordeaux.free.fr/logiciels.html

      Tutorial:

      http://pchelpbordeaux.free.fr/tuto.html

      Démo en image:

      http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

      Fais un scan et poste l'analyse.

      a+
      0
      1. Arut
        Logfile of HijackThis v1.99.1
        Scan saved at 21:37:31, on 08/05/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
        C:\WINDOWS\system32\drivers\CDAC11BA.EXE
        C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\UAService7.exe
        C:\windows\system\hpsysdrv.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
        C:\Program Files\BroadJump\Client Foundation\CFD.exe
        C:\WINDOWS\StopHid.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
        C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
        C:\WINDOWS\SOUNDMAN.EXE
        C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\HP\KBD\KBD.EXE
        C:\WINDOWS\system32\RUNDLL32.EXE
        C:\Program Files\Alt-Tab Thingy v3\attmain.exe
        C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
        C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
        C:\Program Files\LClock\LClock.exe
        C:\Program Files\Styler\Styler.exe
        C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{A6467D54-4E4C-4F35-9971-BAD59FD4C232}\Blaero Start Orb.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\Program Files\PeerGuardian2\pg2.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\WINDOWS\system32\wbem\wmiapsrv.exe
        C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\WINDOWS\system32\ZoneLabs\vsmon.exe
        C:\Program Files\Logitech\SetPoint\SetPoint.exe
        C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
        C:\Program Files\MSN Messenger\usnsvc.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
        O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
        O2 - BHO: (no name) - {B3948DD0-E170-4BE1-AE94-2727896497E7} - C:\WINDOWS\system32\pmkjg.dll
        O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\uaqjsdit.dll (file missing)
        O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll
        O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
        O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
        O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
        O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
        O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
        O4 - HKLM\..\Run: [StopHid] StopHid.exe
        O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
        O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
        O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
        O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
        O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
        O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
        O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
        O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
        O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
        O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
        O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
        O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
        O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
        O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
        O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
        O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
        O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
        O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
        O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
        O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
        O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
        O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
        O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
        O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
        O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
        O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
        O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
        O20 - Winlogon Notify: fccbxus - C:\WINDOWS\SYSTEM32\fccbxus.dll
        O20 - Winlogon Notify: pmkjg - C:\WINDOWS\system32\pmkjg.dll
        O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
        O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
        O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
        O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
        O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
        O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
        O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
        O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
        O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
        O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
        O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
        0
        1. did71 Contributeur sécurité
          re,

          infection courante ces temps ci!

          * Télécharge VundoFix.exe (par Atribune) sur ton Bureau:

          http://www.atribune.org/public-beta/VundoFix.exe

          * Double-clique VundoFix.exe afin de le lancer
          * Clique sur le bouton Scan for Vundo
          * Lorsque le scan est complété, clique sur le bouton Remove Vundo
          * Une invite te demandera si tu veux supprimer les fichiers, clique YES
          * Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
          * Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
          * Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse

          Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

          a+
          0
          2. Arut
            Comme prévu 1 fichier n'a pu être supprimé, au redémarrage, aucun fichier infecté n'a été trouvé. Voici le rapport de VundoFix :

            VundoFix V6.3.21

            Checking Java version...

            Java version is 1.5.0.5
            Old versions of java are exploitable and should be removed.

            Java version is 1.5.0.6
            Old versions of java are exploitable and should be removed.

            Java version is 1.5.0.9
            Old versions of java are exploitable and should be removed.

            Java version is 1.5.0.10

            Java version is 1.5.0.11

            Scan started at 21:47:52 08/05/2007

            Listing files found while scanning....

            C:\WINDOWS\system32\gjkmp.bak1
            C:\WINDOWS\system32\gjkmp.bak2
            C:\WINDOWS\system32\gjkmp.ini
            C:\WINDOWS\system32\pmkjg.dll
            C:\WINDOWS\system32\uaqjsdit.dll

            Beginning removal...

            Attempting to delete C:\WINDOWS\system32\gjkmp.bak1
            C:\WINDOWS\system32\gjkmp.bak1 Has been deleted!

            Attempting to delete C:\WINDOWS\system32\gjkmp.bak2
            C:\WINDOWS\system32\gjkmp.bak2 Has been deleted!

            Attempting to delete C:\WINDOWS\system32\gjkmp.ini
            C:\WINDOWS\system32\gjkmp.ini Has been deleted!

            Attempting to delete C:\WINDOWS\system32\pmkjg.dll
            C:\WINDOWS\system32\pmkjg.dll Could not be deleted.

            Performing Repairs to the registry.
            Done!

            VundoFix V6.3.21

            Checking Java version...

            Java version is 1.5.0.5
            Old versions of java are exploitable and should be removed.

            Java version is 1.5.0.6
            Old versions of java are exploitable and should be removed.

            Java version is 1.5.0.9
            Old versions of java are exploitable and should be removed.

            Java version is 1.5.0.10

            Java version is 1.5.0.11

            Scan started at 21:58:23 08/05/2007

            Listing files found while scanning....

            No infected files were found.

            Beginning removal...

            Et voici le second rapport de HijackThis :

            Logfile of HijackThis v1.99.1
            Scan saved at 22:14:42, on 08/05/2007
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\csrss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
            C:\WINDOWS\system32\drivers\CDAC11BA.EXE
            C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\UAService7.exe
            C:\WINDOWS\system32\ZoneLabs\vsmon.exe
            C:\WINDOWS\system32\SearchIndexer.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\WINDOWS\system32\wbem\wmiapsrv.exe
            C:\WINDOWS\system32\SearchProtocolHost.exe
            C:\windows\system\hpsysdrv.exe
            C:\WINDOWS\system32\rundll32.exe
            C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
            C:\Program Files\BroadJump\Client Foundation\CFD.exe
            C:\WINDOWS\StopHid.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
            C:\WINDOWS\mHotkey.exe
            C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
            C:\WINDOWS\SOUNDMAN.EXE
            C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\HP\KBD\KBD.EXE
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\Alt-Tab Thingy v3\attmain.exe
            C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
            C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
            C:\Program Files\LClock\LClock.exe
            C:\Program Files\Styler\Styler.exe
            C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{0C180175-A0DE-4BAE-AA8C-1DE15E0AFF30}\Blaero Start Orb.exe
            C:\Program Files\PeerGuardian2\pg2.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\DOCUME~1\ALLUSE~1\APPLIC~1\ONLINE~1\BASHLO~1.EXE
            C:\Program Files\JPA\Madotate 3D\madotate.exe
            C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
            C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
            C:\Program Files\Logitech\SetPoint\SetPoint.exe
            C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\WINDOWS\system32\rundll32.exe
            C:\WINDOWS\system32\SearchFilterHost.exe
            C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
            O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
            O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
            O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll
            O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
            O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
            O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll
            O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
            O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
            O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
            O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
            O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
            O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
            O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
            O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
            O4 - HKLM\..\Run: [StopHid] StopHid.exe
            O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
            O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
            O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
            O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
            O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
            O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
            O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
            O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
            O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
            O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
            O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
            O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
            O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
            O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
            O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
            O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
            O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
            O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
            O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
            O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
            O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
            O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
            O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
            O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
            O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
            O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
            O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
            O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
            O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
            O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
            O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
            O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
            O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
            O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
            O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
            O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
            O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
            O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
            O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
            O20 - Winlogon Notify: fccbxus - C:\WINDOWS\SYSTEM32\fccbxus.dll
            O20 - Winlogon Notify: pmkjg - C:\WINDOWS\system32\pmkjg.dll
            O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
            O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
            O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
            O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
            O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
            O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
            O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
            O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
            O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
            O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
            O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
            O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
            O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
            O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
            O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
            O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
            O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
            O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
            O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
            0
            1. did71 Contributeur sécurité
              re,

              * Relance Vundofix
              * Ne clique pas sur "Scan for a vundo"
              * Clique droit au milieu de la fenêtre
              * Clique sur Add more files ?
              * Copie/colle les fichiers ci-dessous ( un par case) :

              C:\WINDOWS\system32\pmkjg.dll
              C:\WINDOWS\system32\fccbxus.dll
              C:\WINDOWS\system32\nnuxjbqe.dll

              * Clique sur Add files
              * Ensuite clique sur Close Windows
              * Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
              * Si l'outils demande un redémarrage, accepte
              * Poste le rapport Vundofix, ainsi qu'un nouveau log hijackthis

              a+
              0
              1. Arut
                J'ai fait ce que tu m'a demandé et le fichier C:\WINDOWS\system32\fccbxus.dll n'a pu être supprimé. Au redémarrage, vundo en trouve 3 que j'ai effacé, voici les nouveaux rapport :

                VundoFix V6.3.21

                Checking Java version...

                Java version is 1.5.0.5
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.6
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.9
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.10

                Java version is 1.5.0.11

                Scan started at 21:47:52 08/05/2007

                Listing files found while scanning....

                C:\WINDOWS\system32\gjkmp.bak1
                C:\WINDOWS\system32\gjkmp.bak2
                C:\WINDOWS\system32\gjkmp.ini
                C:\WINDOWS\system32\pmkjg.dll
                C:\WINDOWS\system32\uaqjsdit.dll

                Beginning removal...

                Attempting to delete C:\WINDOWS\system32\gjkmp.bak1
                C:\WINDOWS\system32\gjkmp.bak1 Has been deleted!

                Attempting to delete C:\WINDOWS\system32\gjkmp.bak2
                C:\WINDOWS\system32\gjkmp.bak2 Has been deleted!

                Attempting to delete C:\WINDOWS\system32\gjkmp.ini
                C:\WINDOWS\system32\gjkmp.ini Has been deleted!

                Attempting to delete C:\WINDOWS\system32\pmkjg.dll
                C:\WINDOWS\system32\pmkjg.dll Could not be deleted.

                Performing Repairs to the registry.
                Done!

                VundoFix V6.3.21

                Checking Java version...

                Java version is 1.5.0.5
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.6
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.9
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.10

                Java version is 1.5.0.11

                Scan started at 21:58:23 08/05/2007

                Listing files found while scanning....

                No infected files were found.

                Beginning removal...

                Beginning removal...

                Attempting to delete C:\WINDOWS\system32\fccbxus.dll
                C:\WINDOWS\system32\fccbxus.dll Could not be deleted.

                Attempting to delete C:\WINDOWS\system32\nnuxjbqe.dll
                C:\WINDOWS\system32\nnuxjbqe.dll Has been deleted!

                Attempting to delete C:\WINDOWS\system32\pmkjg.dll
                C:\WINDOWS\system32\pmkjg.dll Has been deleted!

                Performing Repairs to the registry.
                Done!

                VundoFix V6.3.21

                Checking Java version...

                Java version is 1.5.0.5
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.6
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.9
                Old versions of java are exploitable and should be removed.

                Java version is 1.5.0.10

                Java version is 1.5.0.11

                Scan started at 22:33:13 08/05/2007

                Listing files found while scanning....

                C:\WINDOWS\system32\dfhkj.bak1
                C:\WINDOWS\system32\dfhkj.ini
                C:\WINDOWS\system32\jkhfd.dll

                Beginning removal...

                Attempting to delete C:\WINDOWS\system32\dfhkj.bak1
                C:\WINDOWS\system32\dfhkj.bak1 Has been deleted!

                Attempting to delete C:\WINDOWS\system32\dfhkj.ini
                C:\WINDOWS\system32\dfhkj.ini Has been deleted!

                Attempting to delete C:\WINDOWS\system32\jkhfd.dll
                C:\WINDOWS\system32\jkhfd.dll Has been deleted!

                Performing Repairs to the registry.
                Done!

                Et le rapport de hijackthis :

                Logfile of HijackThis v1.99.1
                Scan saved at 22:50:26, on 08/05/2007
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\csrss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\windows\system\hpsysdrv.exe
                C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                C:\Program Files\BroadJump\Client Foundation\CFD.exe
                C:\WINDOWS\StopHid.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                C:\WINDOWS\mHotkey.exe
                C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                C:\WINDOWS\system32\rundll32.exe
                C:\WINDOWS\SOUNDMAN.EXE
                C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                C:\HP\KBD\KBD.EXE
                C:\WINDOWS\system32\RUNDLL32.EXE
                C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                C:\WINDOWS\system32\UAService7.exe
                C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                C:\Program Files\LClock\LClock.exe
                C:\Program Files\Styler\Styler.exe
                C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{E573F731-D87F-4B08-A667-516812D86E84}\Blaero Start Orb.exe
                C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                C:\Program Files\PeerGuardian2\pg2.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\JPA\Madotate 3D\madotate.exe
                C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                C:\WINDOWS\system32\SearchIndexer.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                C:\Program Files\Logitech\SetPoint\SetPoint.exe
                C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                C:\WINDOWS\system32\wbem\wmiapsrv.exe
                C:\WINDOWS\system32\wbem\wmiprvse.exe
                C:\WINDOWS\system32\SearchProtocolHost.exe
                C:\WINDOWS\system32\SearchFilterHost.exe
                C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
                O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
                O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll
                O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                O4 - HKLM\..\Run: [StopHid] StopHid.exe
                O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
                O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
                O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
                O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                0
                1. did71 Contributeur sécurité
                  re,

                  on va virer le reste!

                  1. Télécharge The Avenger par Swandog46 sur ton Bureau:

                  http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/

                  Click sur Avenger.zip pour ouvrir le fichier
                  Extraire avenger.exe sur votre bureau

                  2. Copie tout le texte en gras ci-dessous : mettre en surbrillance et appuyer sur les touches(Ctrl+C):

                  Files to delete:
                  C:\WINDOWS\system32\fccbxus.dll

                  3. Maintenant, lance The Avenger en cliquant sur son icône du bureau.
                  Sous "Script file to execute" choisir "Input Script Manually".
                  Puis clique sur l'icône en forme de loupe qui va ouvrir une nouvelle fenêtre "View/edit script"
                  Dans cette fenêtre, colle le texte précedemment copié sur le bureau par les touches (Ctrl+V).
                  Cliquer Done
                  ensuite clique sur l'icône en forme de Feu Vert pour démarrer l'exécution du script
                  Réponds "Yes" deux fois quand demandé.

                  4. The Avenger va automatiquement faire ce qui suit:
                  Il va Re-démarrer le système.
                  Pendant le re-démarrage, il apparaitra brièvement une fenêtre de commande de windows noire sur ton bureau, ceci est NORMAL.
                  Après le re-démarrage, il crée un fichier log qui s'ouvrira, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt

                  5. Pour finir copie/colle le contenu du ficher c:\avenger.txt
                  0
                  1. Arut
                    voila :

                    Logfile of The Avenger version 1, by Swandog46
                    Running from registry key:
                    \Registry\Machine\System\CurrentControlSet\Services\sebrntbq

                    *******************

                    Script file located at: \??\C:\Program Files\fkbfgqnj.txt
                    Script file opened successfully.

                    Script file read successfully

                    Backups directory opened successfully at C:\Avenger

                    *******************

                    Beginning to process script file:

                    File C:\WINDOWS\system32\fccbxus.dll deleted successfully.

                    Completed script processing.

                    *******************

                    Finished! Terminate.
                    0
                    1. did71 Contributeur sécurité
                      re,

                      poste un nouvel hijackthis!

                      a+
                      0
                      1. Arut
                        Logfile of HijackThis v1.99.1
                        Scan saved at 23:17:16, on 08/05/2007
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\csrss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        C:\windows\system\hpsysdrv.exe
                        C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                        C:\Program Files\BroadJump\Client Foundation\CFD.exe
                        C:\WINDOWS\StopHid.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                        C:\WINDOWS\mHotkey.exe
                        C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                        C:\WINDOWS\SOUNDMAN.EXE
                        C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        C:\HP\KBD\KBD.EXE
                        C:\WINDOWS\system32\RUNDLL32.EXE
                        C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                        C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                        C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                        C:\WINDOWS\system32\rundll32.exe
                        C:\Program Files\LClock\LClock.exe
                        C:\Program Files\Styler\Styler.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\JPA\Madotate 3D\madotate.exe
                        C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                        C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{3B2F62ED-9FAD-4375-8A5A-ECF827196D3A}\Blaero Start Orb.exe
                        C:\Program Files\Internet Explorer\iexplore.exe
                        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                        C:\Program Files\Logitech\SetPoint\SetPoint.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                        C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                        C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                        C:\WINDOWS\system32\nvsvc32.exe
                        C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\UAService7.exe
                        C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                        C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                        C:\WINDOWS\system32\SearchIndexer.exe
                        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        C:\WINDOWS\system32\wbem\wmiapsrv.exe
                        C:\WINDOWS\system32\wbem\wmiprvse.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\Program Files\Mozilla Thunderbird\thunderbird.exe
                        C:\WINDOWS\system32\SearchProtocolHost.exe
                        C:\WINDOWS\system32\SearchFilterHost.exe
                        C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                        O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                        O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
                        O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                        O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
                        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                        O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
                        O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll (file missing)
                        O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                        O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                        O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                        O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                        O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                        O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                        O4 - HKLM\..\Run: [StopHid] StopHid.exe
                        O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                        O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                        O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                        O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                        O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                        O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                        O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                        O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                        O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                        O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                        O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                        O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                        O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                        O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
                        O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                        O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                        O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                        O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                        O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                        O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                        O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                        O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                        O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                        O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                        O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                        O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                        O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                        O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                        O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                        O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                        O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                        O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                        O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                        O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                        O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                        O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
                        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                        O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
                        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                        O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                        O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                        O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                        O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                        O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                        O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                        O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                        O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                        O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                        O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                        O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                        0
                        1. Arut
                          Pour les manipulations suivante, on verra demain, faut que j'aille dormir, demain j'ai cours, mais merci de m'aider pour ce truc ! je serai sur le forum à partir de 13 heures. à demain !
                          0
                          1. did71 Contributeur sécurité
                            ok!

                            bonne nuit!

                            on a viré le plus néfaste!

                            pour demain:

                            Télécharge clean.zip

                            http://www.malekal.com/download/clean.zip

                            Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.
                            Ouvre le dossier Clean qui se trouve sur ton bureau.
                            Double-clic sur clean.cmd.
                            Une fenêtre noire va apparaître, choisis l'option 1.

                            Poste le rapport qui se trouve ici C:\rapport_clean.txt

                            a+
                            0
                            1. Arut
                              J'ai un problème, au démarage, j'obtien un message d'erreur avec le titre : RUNDLL et le contenu : "Erreur de chargement de C:/WINDOWS/systeme32/nnuxjbqe.dll
                              Le module spécifié est introuvable."
                              Que faire ?

                              voici le rapport de clean :

                              09/05/2007 a 13:27:26,14

                              *** Recherche des fichiers dans C:

                              *** Recherche des fichiers dans C:\WINDOWS\
                              C:\WINDOWS\ALCXMNTR.EXE FOUND

                              *** Recherche des fichiers dans C:\WINDOWS\system32
                              C:\WINDOWS\system32\mcrh.tmp FOUND
                              C:\WINDOWS\system32\SpoonUninstall.exe FOUND
                              C:\WINDOWS\nsreg.dat FOUND

                              *** Recherche des fichiers dans C:\Program Files
                              "C:\Program Files\secure32.html" FOUND
                              "C:\Program Files\Viewpoint\" FOUND
                              *** Fin du rapport !

                              et le rapport de HijackThis :


                              Logfile of HijackThis v1.99.1
                              Scan saved at 13:32:33, on 09/05/2007
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\csrss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashServ.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                              C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                              C:\windows\system\hpsysdrv.exe
                              C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                              C:\Program Files\BroadJump\Client Foundation\CFD.exe
                              C:\WINDOWS\StopHid.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                              C:\WINDOWS\mHotkey.exe
                              C:\WINDOWS\system32\rundll32.exe
                              C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                              C:\WINDOWS\SOUNDMAN.EXE
                              C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                              C:\WINDOWS\system32\nvsvc32.exe
                              C:\HP\KBD\KBD.EXE
                              C:\WINDOWS\system32\RUNDLL32.EXE
                              C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                              C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\UAService7.exe
                              C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                              C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                              C:\Program Files\LClock\LClock.exe
                              C:\Program Files\Styler\Styler.exe
                              C:\Program Files\PeerGuardian2\pg2.exe
                              C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{37FA537F-1648-404B-B850-520141DD2756}\Blaero Start Orb.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\JPA\Madotate 3D\madotate.exe
                              C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              C:\Program Files\Logitech\SetPoint\SetPoint.exe
                              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                              C:\WINDOWS\system32\wbem\wmiapsrv.exe
                              C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                              C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                              C:\Program Files\MSN Messenger\usnsvc.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Mozilla Firefox\firefox.exe
                              C:\WINDOWS\system32\msiexec.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                              O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                              O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                              O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
                              O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                              O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
                              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                              O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
                              O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll (file missing)
                              O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                              O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                              O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                              O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                              O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                              O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                              O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                              O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                              O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                              O4 - HKLM\..\Run: [StopHid] StopHid.exe
                              O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                              O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                              O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                              O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                              O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                              O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                              O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                              O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                              O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                              O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                              O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                              O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                              O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                              O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                              O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
                              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                              O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                              O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
                              O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                              O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                              O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                              O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                              O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                              O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                              O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                              O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                              O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                              O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                              O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                              O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                              O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                              O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                              O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                              O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                              O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                              O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                              O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                              O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                              O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                              O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                              O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                              O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                              O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                              O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                              O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                              O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                              O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
                              O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                              O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
                              O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                              O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                              O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                              O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                              O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                              O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                              O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                              O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                              O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                              O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                              O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                              O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                              O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                              O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                              O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                              O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                              O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                              O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                              0
                              2. did71 Contributeur sécurité
                                Bonjour,

                                je réponds quand je peux, je bosse la journée!!

                                1) relance cleanzip,

                                Choisis cette fois l'option 2!

                                Poste le rapport ensuite

                                2) relance hijackthis, coche les lignes citées ci dessous et fix checked (toutes fenêtres IE fermées) :

                                O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
                                O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
                                O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
                                O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll (file missing)
                                O4 - HKLM\..\Run: [StopHid] StopHid.exe
                                O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                                O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                                O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
                                O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
                                O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
                                O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)

                                3) recherche et supprime le fichiers/dossier en gras ci dessous:

                                C:\Program Files\Blaero Start Orb
                                C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe

                                4) poste un nouvel hijackthis!

                                a+
                                0
                                1. Arut
                                  Ah! désolé ! je ne voulait pas te vexer... excuse moi ! Merci beaucoup pour ton aide ! voila le rapport de cleanzip :

                                  Rapport clean par Malekal_morte - http://www.malekal.com
                                  Script execute en mode sans echec 09/05/2007 a 22:21:36,82

                                  Microsoft Windows XP [version 5.1.2600]

                                  *** Suppression des fichiers dans C:

                                  *** Suppression des fichiers dans C:\WINDOWS\
                                  tentative de suppression de C:\WINDOWS\ALCXMNTR.EXE

                                  *** Suppression des fichiers dans C:\WINDOWS\system32
                                  tentative de suppression de C:\WINDOWS\system32\mcrh.tmp
                                  tentative de suppression de C:\WINDOWS\system32\SpoonUninstall.exe
                                  tentative de suppression de C:\WINDOWS\nsreg.dat

                                  *** Suppression des fichiers dans C:\Program Files
                                  tentative de suppression de "C:\Program Files\secure32.html"
                                  tentative de suppression de "C:\Program Files\Viewpoint\"

                                  *** Suppression des clefs du registre effectuee..
                                  *** Fin du rapport !

                                  le log de hijackthis :

                                  Logfile of HijackThis v1.99.1
                                  Scan saved at 22:32:24, on 09/05/2007
                                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\csrss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  C:\windows\system\hpsysdrv.exe
                                  C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                  C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                  C:\WINDOWS\mHotkey.exe
                                  C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                                  C:\WINDOWS\SOUNDMAN.EXE
                                  C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                  C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                  C:\HP\KBD\KBD.EXE
                                  C:\WINDOWS\system32\RUNDLL32.EXE
                                  C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                                  C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                  C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                                  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                  C:\WINDOWS\system32\nvsvc32.exe
                                  C:\Program Files\LClock\LClock.exe
                                  C:\Program Files\Styler\Styler.exe
                                  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                  C:\Program Files\PeerGuardian2\pg2.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{34A62FE2-6316-4A33-A669-2D5F364F186B}\Blaero Start Orb.exe
                                  C:\WINDOWS\system32\ctfmon.exe
                                  C:\Program Files\JPA\Madotate 3D\madotate.exe
                                  C:\WINDOWS\system32\UAService7.exe
                                  C:\Program Files\Internet Explorer\iexplore.exe
                                  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                  C:\Program Files\eMule\emule.exe
                                  C:\WINDOWS\system32\SearchIndexer.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                  C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                  C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                  C:\WINDOWS\system32\wbem\wmiapsrv.exe
                                  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                  C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
                                  C:\Program Files\TuneUp Utilities 2007\RegistryCleaner.exe
                                  C:\Program Files\Mozilla Firefox\firefox.exe
                                  C:\Program Files\Alwil Software\Avast4\setup\avast.setup
                                  C:\WINDOWS\system32\SearchProtocolHost.exe
                                  C:\WINDOWS\system32\SearchFilterHost.exe
                                  C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                  O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                                  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                  O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                                  O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                                  O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                                  O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                                  O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                  O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                                  O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                                  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                  O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                  O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                                  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                  O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                                  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                                  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                                  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                                  O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                  O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                                  O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                  O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                                  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                  O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                                  O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                                  O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                  O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                                  O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                  O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                  O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                                  O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                                  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                  O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                                  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                                  O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                                  O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                  O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                                  O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                                  O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                                  O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                                  O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                                  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                                  O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                                  O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                  O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                  O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                                  O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                                  O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                                  O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                                  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                                  O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                                  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                                  O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                                  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                                  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                  O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                  O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                                  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                                  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                                  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                  O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                                  O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                                  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                  O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                  O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                                  O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                                  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                  O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                                  O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                                  O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                  O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                  O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                                  O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                                  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                  0
                                  1. did71 Contributeur sécurité
                                    re,

                                    Télécharge SmitfraudFix de S!Ri:

                                    http://siri.urz.free.fr/Fix/SmitfraudFix.zip

                                    Tu le dézippes sur le Bureau.

                                    * Tu ouvres SmitfraudFix, tu double cliques sur SmitfraudFix.cmd et tu choisis l’option 1
                                    Postes le rapport.

                                    a+
                                    0
                                    1. Arut
                                      SmitFraudFix v2.179

                                      Rapport fait à 8:30:03,87, 10/05/2007
                                      Executé à partir de C:\Documents and Settings\HP_Propri‚taire\Bureau\SmitfraudFix\SmitfraudFix
                                      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                      Le type du système de fichiers est NTFS
                                      Fix executé en mode normal

                                      »»»»»»»»»»»»»»»»»»»»»»»» Process

                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\csrss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                      C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                      C:\WINDOWS\system32\nvsvc32.exe
                                      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\UAService7.exe
                                      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                      C:\WINDOWS\system32\SearchIndexer.exe
                                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                      C:\windows\system\hpsysdrv.exe
                                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                      C:\WINDOWS\system32\wbem\wmiapsrv.exe
                                      C:\WINDOWS\system32\rundll32.exe
                                      C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                      C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                      C:\WINDOWS\mHotkey.exe
                                      C:\WINDOWS\system32\SearchProtocolHost.exe
                                      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                                      C:\WINDOWS\SOUNDMAN.EXE
                                      C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                      C:\HP\KBD\KBD.EXE
                                      C:\WINDOWS\system32\RUNDLL32.EXE
                                      C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                                      C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                                      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                                      C:\Program Files\Styler\Styler.exe
                                      C:\Program Files\PeerGuardian2\pg2.exe
                                      C:\WINDOWS\system32\ctfmon.exe
                                      C:\Program Files\JPA\Madotate 3D\madotate.exe
                                      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                      C:\Program Files\eMule\emule.exe
                                      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                      C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                      C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                                      C:\Program Files\MSN Messenger\usnsvc.exe
                                      C:\Program Files\Mozilla Firefox\firefox.exe
                                      C:\Program Files\LClock\lclock.exe
                                      C:\WINDOWS\system32\cmd.exe
                                      C:\WINDOWS\system32\wbem\wmiprvse.exe
                                      C:\WINDOWS\system32\SearchFilterHost.exe

                                      »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propri‚taire

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propri‚taire\Application Data

                                      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_PRO~1\Favoris

                                      »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                      "Source"="About:Home"
                                      "SubscribedURL"="About:Home"
                                      "FriendlyName"="Ma page d'accueil"

                                      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      SrchSTS.exe by S!Ri
                                      Search SharedTaskScheduler's .dll

                                      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                      "AppInit_DLLs"=""

                                      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

                                      »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32

                                      »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                      Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
                                      DNS Server Search Order: 194.117.200.10
                                      DNS Server Search Order: 194.117.200.15

                                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer=194.117.200.10,194.117.200.15
                                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer=194.117.200.10,194.117.200.15
                                      HKLM\SYSTEM\CS3\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer=194.117.200.10,194.117.200.15
                                      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.74 85.255.112.167
                                      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.74 85.255.112.167
                                      HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.74 85.255.112.167

                                      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                                      »»»»»»»»»»»»»»»»»»»»»»»» Fin
                                      0
                                      1. did71 Contributeur sécurité
                                        Bonjour,

                                        je vois que tu as AVG antispyware, fais un scan avec et poste le rapport

                                        poste aussi un nouveau rapport hijackthis!

                                        a+
                                        0
                                        • 1
                                        • 2

                                        Discussions similaires

                                        Problème avec "PUADIManager:Win32/OfferCore
                                        Knaki

                                        3 réponses
                                        PUADlManager:Win32/OfferCore
                                        tenmalade

                                        2 réponses
                                        PUADlManager:Win32/OfferCore
                                        bernardarrad

                                        3 réponses
                                        PUA:Win32/InstallCore detecté par windows sécurité
                                        thetib

                                        11 réponses
                                        Pb Windows 7, .EXE n'est pas app win32 valide
                                        Witeric

                                        15 réponses