Virus Win32 détecté sous Windows XP par avast

Bennnito Messages postés 32 Statut Membre -  
moK´s@ Messages postés 4410 Statut Membre -
Bonjour à tous, voila je suis sous windows XP et mon antivirus avast 4.7 PRO n'arrête pas de me détecter la présence du virus trojan WIN32, je mets au fur et à mesure en quarantaine mais cela ne règle pas le problême,mon ordi plante constamment, les programmes bloquent etc... j'ai fait un Logfile avec HijackThis que je vous donne. Merci à vous de me trouver une solution pour virer ce virus défastateur. Vous êtes ma dernière chance, Bennnito

Logfile of HijackThis v1.99.1
Scan saved at 16:48:26, on 21/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\Arcade\PCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00A7863B-DDC7-0034-A0C8-07530F512758} - C:\WINDOWS\system32\mttqnzh.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0B38AA6B-CFD5-481D-894F-D8354C3788E4} - C:\WINDOWS\system32\dscglgim.dll
O2 - BHO: (no name) - {182B90A3-F372-438A-800C-6814B4DE417B} - C:\WINDOWS\system32\hggdbba.dll (file missing)
O2 - BHO: (no name) - {2B5E25BC-C1B2-92D8-02F0-081D435BC4F0} - C:\WINDOWS\system32\mmzarpe.dll
O2 - BHO: (no name) - {3F47CEB7-3C27-74D8-053F-046090C17FFF} - C:\WINDOWS\system32\fzitqie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Benjamin\516113452.dll
O2 - BHO: (no name) - {62B2F83B-3884-4670-A34C-67E33B9DA9BD} - C:\WINDOWS\system32\syoiyatj.dll (file missing)
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6monr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {B69BF0EA-E0AD-4906-B252-364B070B29EB} - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\SafetyBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ovuflnf.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ovuflnf.dll,onbcyhg
O4 - HKLM\..\Run: [kvnhgyc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\kvnhgyc.dll,uonaovf
O4 - HKLM\..\Run: [cwhwdoc.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Benjamin\Local Settings\Application Data\cwhwdoc.dll",fgijoic
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [Intel system tool] C:\WINDOWS\system32\svehost.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
O4 - HKCU\..\Run: [Idwjnkz] "C:\Documents and Settings\Benjamin\Application Data\A?pPatch\r?gedit.exe"
O4 - HKCU\..\Run: [Brave-Sentry] C:\Program Files\BraveSentry\BraveSentry.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: A3dxq - C:\WINDOWS\system32\a3dxq.dll
O20 - Winlogon Notify: ahrdcac - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
O20 - Winlogon Notify: hggdbba - hggdbba.dll (file missing)
O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
Configuration: Windows XP
Firefox 1.5.0.11

36 réponses

  • 1
  • 2
Résumé de la discussion

Problème rencontré : sur Windows XP, l'antivirus Avast signale en continu un Trojan WIN32 et la mise en quarantaine ne suffit pas, l'ordinateur plante et les programmes bloquent. Des éléments de réponse essentiels portent sur le fichier HijackThis et les nombreux composants détectés, notamment des BHO, des DLL et des entrées de démarrage, qui nécessitent des nettoyages ciblés et des redéploiements de sécurité. Plusieurs réponses suggèrent l'emploi d'outils spécialisés tels que Look2Me remover, SmitfraudFix et VundoFix, avec des instructions pour redémarrer en mode sans échec et effectuer des scans répétés jusqu'à disparition des traces. En complément, il est mentionné que certains éléments détectés peuvent être des faux positifs et demandent une vérification croisée avec d'autres outils avant suppression définitive.

Généré automatiquement par IA
sur la base des meilleures réponses
  1. Utilisateur anonyme
     
    avec avast met toi sous l'antivirus et planifie une analyse complete (vas dans avancé tu fait scanner egalement les archives ) il va te demander de redémarer ton pc .En redémarant , avast vas se lancer avant meme que windows démarre , et il va supprimer tous lé virus ; enfin moi cela a marché car j'ai deja eu ce probleme
    bonne journée ++
    0
  2. vaillant92
     
    j'ai eu le cas une foi - j'ai carrément mis supprimer sous avast et je n'ai plus de probleme -
    0
  3. Bennnito Messages postés 32 Statut Membre
     
    Je n'arrive pas à régler avast 4.7 pour faire une analyse complète comme tu m'as indiqué DANTE 33. merci de m'aider
    0
  4. Utilisateur anonyme
     
    je sui au boulot je rentre dans 30 min , je te donnerais la réponse exacte dans 40 min tu auras la procédure exacte
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. moK´s@ Messages postés 4410 Statut Membre 89
     
    re,

    La ca va pas suffir notre ami est tres infécté...

    avec hijack this coche les lignes suivantes :

    O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\SafetyBar.dll (file missing)
    O4 - HKLM\..\Run: [ovuflnf.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ovuflnf.dll,onbcyhg
    O4 - HKLM\..\Run: [kvnhgyc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\kvnhgyc.dll,uonaovf
    O4 - HKLM\..\Run: [cwhwdoc.dll] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Benjamin\Local Settings\Application Data\cwhwdoc.dll",fgijoic
    O4 - HKLM\..\Run: [Intel system tool] C:\WINDOWS\system32\svehost.exe
    O4 - HKCU\..\Run: [Idwjnkz] "C:\Documents and Settings\Benjamin\Application Data\A?pPatch\r?gedit.exe"
    O4 - HKCU\..\Run: [Brave-Sentry] C:\Program Files\BraveSentry\BraveSentry.exe
    O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)
    O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)
    Quitte tes applications et ton navigateur et fixe /check les lignes ci dessus

    2
    Télécharge Pocket KillBox sur ton bureau.
    http://www.downloads.subratam.org/KillBox.exe

    Double-clique sur le fichier Killbox.exe, et coche la case "Delete on reboot".
    copie les lignes ci dessous :

    C:\WINDOWS\system32\ovuflnf.dll,onbcyhg
    C:\WINDOWS\system32\kvnhgyc.dll,uonaovf
    C:\Documents and Settings\Benjamin\Local Settings\Application Data\cwhwdoc.dll",fgijoic
    C:\WINDOWS\system32\svehost.exe
    C:\Documents and Settings\Benjamin\Application Data\A?pPatch\r?gedit.exe
    C:\Program Files\BraveSentry\BraveSentry.exe

    Sur PocketKillBox --> menu "File" --> "Paste from Clipboard"

    Tu peux vérifier dans le menu déroulant que les fichiers sot bien présent.
    - coche la case "Unregister dll before deleting" (si tu en as la possibilité)
    - clique sur le bouton "All files"
    - clique ensuite sur la croix rouge

    Au deux messages qui vont s'afficher, tu réponds par "YES"
    L'ordinateur doit redémarrer, sinon, fais le toi-même, quoiqu'il arrive.

    3
    demarrer>executer>services.msc et regarde si tu voie le service :

    COM+ Messages si tu le voie arrete le.

    4

    Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
    http://www.atribune.org/ccount/click.php?id=4
    * Double-clique VundoFix.exe afin de le lancer
    * Clique sur le bouton Scan for Vundo
    * Lorsque le scan est complété, clique sur le bouton Remove Vundo
    * Une invite te demandera si tu veux supprimer les fichiers, clique YES
    * Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
    * Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
    * Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

    Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

    et repost un log hijackthis ,

    @+
    0
    1. Bennnito Messages postés 32 Statut Membre
       
      Salut Mok's et merci de m'aider
      j'ai fais ce que tu m'a dit et je te poste les logs VUNDO et HITJACKTHIS

      VundoFix V6.4.1

      Checking Java version...

      Sun Java not detected
      Scan started at 18:39:09 21/05/2007

      Listing files found while scanning....

      C:\Program Files\VSAdd-in\VSAdd-in.dll
      C:\WINDOWS\system32\aaoiwwry.dll
      C:\WINDOWS\system32\hbofttle.dll
      C:\WINDOWS\system32\hggdbba.dll
      C:\WINDOWS\system32\hgpfsbke.dll
      C:\WINDOWS\system32\knermbau.dll
      C:\WINDOWS\system32\kuvlnduv.dll
      C:\WINDOWS\system32\kvnhgyc.dll
      C:\WINDOWS\system32\mmzarpe.dll
      C:\WINDOWS\system32\mttqnzh.dll
      C:\WINDOWS\system32\nnfbvadt.dll
      C:\WINDOWS\system32\oinkkkuj.dll
      C:\WINDOWS\system32\osecmoww.dll
      C:\WINDOWS\system32\qagxddrt.dll
      C:\WINDOWS\system32\Restore\ahrdcac.dll
      C:\WINDOWS\system32\Restore\cacdrha.bak1
      C:\WINDOWS\system32\Restore\cacdrha.bak2
      C:\WINDOWS\system32\Restore\cacdrha.ini
      C:\WINDOWS\system32\vtuvtsr.dll
      C:\WINDOWS\system32\vudnlvuk.ini
      C:\WINDOWS\system32\wfgtxwdt.dll
      C:\WINDOWS\system32\xbllwejp.dll

      Beginning removal...

      Attempting to delete C:\WINDOWS\system32\aaoiwwry.dll
      C:\WINDOWS\system32\aaoiwwry.dll Has been deleted!

      Attempting to delete C:\WINDOWS\system32\hbofttle.dll
      C:\WINDOWS\system32\hbofttle.dll Has been deleted




      Logfile of HijackThis v1.99.1
      Scan saved at 19:02:30, on 21/05/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Acer\eManager\anbmServ.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\AGRSMMSG.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\WINDOWS\system32\keyhook.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Launch Manager\QtZgAcer.EXE
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      C:\Program Files\Arcade\PCMService.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\RocketDock\RocketDock.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
      C:\WINDOWS\system32\sistray.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      C:\Program Files\palmOne\Hotsync.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\acer\eRecovery\Monitor.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: (no name) - {00A7863B-DDC7-0034-A0C8-07530F512758} - C:\WINDOWS\system32\mttqnzh.dll (file missing)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {0B38AA6B-CFD5-481D-894F-D8354C3788E4} - C:\WINDOWS\system32\dscglgim.dll
      O2 - BHO: (no name) - {2B5E25BC-C1B2-92D8-02F0-081D435BC4F0} - C:\WINDOWS\system32\mmzarpe.dll (file missing)
      O2 - BHO: (no name) - {3F47CEB7-3C27-74D8-053F-046090C17FFF} - C:\WINDOWS\system32\fzitqie.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Benjamin\52116830.dll
      O2 - BHO: (no name) - {62B2F83B-3884-4670-A34C-67E33B9DA9BD} - C:\WINDOWS\system32\syoiyatj.dll (file missing)
      O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6monr.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: (no name) - {B69BF0EA-E0AD-4906-B252-364B070B29EB} - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [LaunchApp] Alaunch
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
      O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
      O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
      O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
      O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: A3dxq - C:\WINDOWS\system32\a3dxq.dll
      O20 - Winlogon Notify: ahrdcac - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
      O20 - Winlogon Notify: hggdbba - hggdbba.dll (file missing)
      O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)
      O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

      Merci et j'attends ta réponse
      0
    2. yoyo
       
      merci de m'aider, alerte rouge
      bizoux

      Logfile of HijackThis v1.99.1
      Scan saved at 16:53:48, on 23/05/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16441)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\system32\WgaTray.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Spyware Doctor\swdsvc.exe
      C:\Program Files\Spyware Doctor\svcntaux.exe
      C:\Program Files\Spyware Doctor\swdoctor.exe
      C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~nsu.tmp\Au_.exe
      C:\Program Files\Spyware Doctor\sdtrayapp.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\WinRAR\WinRAR.exe
      C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.722\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
      O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O11 - Options group: [INTERNATIONAL] International*
      O11 - Options group: [TABS] Tabbed Browsing
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
      O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
      O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
      O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
      O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
      O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
      O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
      O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
      0
      1. Bennnito Messages postés 32 Statut Membre > yoyo
         
        Salut YoYo,
        Si tu veux que une personne qualifiée t'aide alors lance ta question dans le forum sécurité en créant un nouveau sujet et non pas dans ma le mien, certainement que des internautes vont intervenir, c'est ce que j' ai fait pour moi et ça marche bien.
        Tu peux y joindre ton Log HijackThis. A+
        0
  7. Utilisateur anonyme
     
    moi je pense que avast peut réglere le probleme ... d'ailleur quand tu vas sur des site de comparaison , il est toujour numéro 1 , bref considéré comme le meilleur antivirus gratuit du moment (meme meilleur que certain payant)
    0
  8. moK´s@ Messages postés 4410 Statut Membre 89
     
    salut dante 33

    Pour vundo tu fais comment avec avast?

    lol
    0
  9. Utilisateur anonyme
     
    tu lance avast en scan de démarage tu redémarre ton pc et avast vas se lancer avant meme que windows ne démarre et scanner tous tes fichiers , vundo vas-donc virer avant meme de se lancer
    voila , il n'y a rien de marrant
    0
  10. Utilisateur anonyme
     
    de plus hijackthis tt le monde en parle; j'ai eu un pb , il ne me l'a pas corrigé : j'ai installé avast home (que j'ai en pro maintenant) et je n'ai plus eu de probleme c'est pourquoi je le conseille a tt le monde
    0
  11. moK´s@ Messages postés 4410 Statut Membre 89
     
    re,

    ok, time will tell...

    Puis non je trouve pas ca marrant mais si il y a des outils créer pour supprimer des infections précises, vaut mieux les utiliser.

    Je ne discute pas les performances d´avast; mais les infections de type "vundo" sont parfois corriace a supprimer meme avec le vundo fix qu´il faut parfois passer plusieurs fois...

    C´est tout

    @+
    0
  12. Utilisateur anonyme
     
    je part du boulot je te fait un résumé complet en arrivant
    0
  13. Bennnito Messages postés 32 Statut Membre
     
    j'ai fais ce que m'a dit mok's et je vous poste les logs VUNDO et HITJACKTHIS aprés la manip décrite par mok's

    VundoFix V6.4.1

    Checking Java version...

    Sun Java not detected
    Scan started at 18:39:09 21/05/2007

    Listing files found while scanning....

    C:\Program Files\VSAdd-in\VSAdd-in.dll
    C:\WINDOWS\system32\aaoiwwry.dll
    C:\WINDOWS\system32\hbofttle.dll
    C:\WINDOWS\system32\hggdbba.dll
    C:\WINDOWS\system32\hgpfsbke.dll
    C:\WINDOWS\system32\knermbau.dll
    C:\WINDOWS\system32\kuvlnduv.dll
    C:\WINDOWS\system32\kvnhgyc.dll
    C:\WINDOWS\system32\mmzarpe.dll
    C:\WINDOWS\system32\mttqnzh.dll
    C:\WINDOWS\system32\nnfbvadt.dll
    C:\WINDOWS\system32\oinkkkuj.dll
    C:\WINDOWS\system32\osecmoww.dll
    C:\WINDOWS\system32\qagxddrt.dll
    C:\WINDOWS\system32\Restore\ahrdcac.dll
    C:\WINDOWS\system32\Restore\cacdrha.bak1
    C:\WINDOWS\system32\Restore\cacdrha.bak2
    C:\WINDOWS\system32\Restore\cacdrha.ini
    C:\WINDOWS\system32\vtuvtsr.dll
    C:\WINDOWS\system32\vudnlvuk.ini
    C:\WINDOWS\system32\wfgtxwdt.dll
    C:\WINDOWS\system32\xbllwejp.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\aaoiwwry.dll
    C:\WINDOWS\system32\aaoiwwry.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hbofttle.dll
    C:\WINDOWS\system32\hbofttle.dll Has been deleted

    Logfile of HijackThis v1.99.1
    Scan saved at 19:02:30, on 21/05/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Launch Manager\QtZgAcer.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
    C:\Program Files\Arcade\PCMService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\palmOne\Hotsync.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\acer\eRecovery\Monitor.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: (no name) - {00A7863B-DDC7-0034-A0C8-07530F512758} - C:\WINDOWS\system32\mttqnzh.dll (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {0B38AA6B-CFD5-481D-894F-D8354C3788E4} - C:\WINDOWS\system32\dscglgim.dll
    O2 - BHO: (no name) - {2B5E25BC-C1B2-92D8-02F0-081D435BC4F0} - C:\WINDOWS\system32\mmzarpe.dll (file missing)
    O2 - BHO: (no name) - {3F47CEB7-3C27-74D8-053F-046090C17FFF} - C:\WINDOWS\system32\fzitqie.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Benjamin\52116830.dll
    O2 - BHO: (no name) - {62B2F83B-3884-4670-A34C-67E33B9DA9BD} - C:\WINDOWS\system32\syoiyatj.dll (file missing)
    O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6monr.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: (no name) - {B69BF0EA-E0AD-4906-B252-364B070B29EB} - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
    O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
    O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: A3dxq - C:\WINDOWS\system32\a3dxq.dll
    O20 - Winlogon Notify: ahrdcac - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O20 - Winlogon Notify: hggdbba - hggdbba.dll (file missing)
    O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

    Merci de me répondre
    0
  14. Utilisateur anonyme
     
    (quand je te marque clique droit sur avast ca veux dire clique droit sur l'icone en bas a droite)

    re bon alors deja tu met a jour avast
    clique droit sur avast mise à jour/mise a jour du programme
    quand cela est fait
    clique droit sur avast mise à jour / mise à jour de la base virale

    quand cela est fait clique droit sur avast /démarere avast antivirus
    tu as avast antivirus (annule le scan de démarage) ensuite tu a un bouton dans avast (comme ejecter sur un lecteur cd) tu clique dessus

    tu clique sur planifier un scan au démarage
    tu vérifie que scanner tous les diques locaux est coché
    tu coches scan des archives
    tu coches options avancées
    la premeire boite, tu séléctionnes "supprimer le fichier infecté"
    le deuxieme boite , tu séléctionnes "autoriser à détruire ou à déplacer"
    ensuite tu clique sur le bouton planifier
    tu clique sur oui
    et le pc va redémarere tout seul (parfois cela te dit que ca risque d'abimer des fichiers, tu t'en fou tu fais ok) et la tu laisse le scann se faire t'en a pour une bonne demi heure (voir plus) quand cela sera fait ton pc sera désinfecté
    bonne journée ++
    0
  15. moK´s@ Messages postés 4410 Statut Membre 89
     
    re,

    * Relance Vundofix
    * Ne clique pas sur "Scan for a vundo"
    * Clique droit au milieu de la fenêtre
    * Clique sur Add more files ?
    * Copie/colle les fichiers ci-dessous ( un par case) :

    C:\WINDOWS\System32\dscglgim.dll
    C:\WINDOWS\System32\fzitqie.dll

    * Clique sur Add files
    * Ensuite clique sur Close Windows
    * Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
    * Si l'outils demande un redémarrage, accepte
    * Poste le rapport Vundofix
    puis un nouveau hijack this
    0
    1. Bennnito Messages postés 32 Statut Membre
       
      Mok's voici les 3 rapports:

      VUNDO:

      Beginning removal...

      Attempting to delete C:\WINDOWS\System32\dscglgim.dll
      C:\WINDOWS\System32\dscglgim.dll Has been deleted!

      Attempting to delete C:\WINDOWS\System32\fzitqie.dll
      C:\WINDOWS\System32\fzitqie.dll Has been deleted!

      Performing Repairs to the registry.
      Done!

      HITJACKTHIS:

      Logfile of HijackThis v1.99.1
      Scan saved at 19:35:28, on 21/05/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Acer\eManager\anbmServ.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\AGRSMMSG.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\WINDOWS\system32\keyhook.exe
      C:\Program Files\Launch Manager\QtZgAcer.EXE
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      C:\Program Files\Arcade\PCMService.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\RocketDock\RocketDock.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\system32\sistray.exe
      C:\Program Files\palmOne\Hotsync.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\acer\eRecovery\Monitor.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: (no name) - {00A7863B-DDC7-0034-A0C8-07530F512758} - C:\WINDOWS\system32\mttqnzh.dll (file missing)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {0B38AA6B-CFD5-481D-894F-D8354C3788E4} - C:\WINDOWS\system32\dscglgim.dll (file missing)
      O2 - BHO: (no name) - {2B5E25BC-C1B2-92D8-02F0-081D435BC4F0} - C:\WINDOWS\system32\mmzarpe.dll (file missing)
      O2 - BHO: (no name) - {3F47CEB7-3C27-74D8-053F-046090C17FFF} - C:\WINDOWS\system32\fzitqie.dll (file missing)
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Benjamin\52116830.dll
      O2 - BHO: (no name) - {62B2F83B-3884-4670-A34C-67E33B9DA9BD} - C:\WINDOWS\system32\syoiyatj.dll (file missing)
      O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6monr.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: (no name) - {B69BF0EA-E0AD-4906-B252-364B070B29EB} - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [LaunchApp] Alaunch
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
      O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
      O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
      O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
      O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: A3dxq - C:\WINDOWS\system32\a3dxq.dll
      O20 - Winlogon Notify: ahrdcac - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
      O20 - Winlogon Notify: hggdbba - hggdbba.dll (file missing)
      O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)
      O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

      MERCI
      0
    2. moK´s@ Messages postés 4410 Statut Membre 89
       
      re,

      Télécharger l2mfix
      http://www.downloads.subratam.org/l2mfix.exe
      Double-cliquer sur l2mfix.exe pour lancer l'extraction
      Dans le dossier l2mfix, double clic sur l2mfix.bat
      Appuyer sur n'importe quelle touche puis choisir l'option #1 (et pas autre chose) et valider avec la touche entrée.
      Le bloc-note va s'ouvrir avec le résultat du scan.
      copie le rapoort ici

      @+
      0
      1. Bennnito Messages postés 32 Statut Membre > moK´s@ Messages postés 4410 Statut Membre
         
        VOICI LE RAPPORT

        L2MFIX find log 051206
        These are the registry keys present
        **********************************************************************************
        Winlogon/notify:
        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\A3dxq]
        "DllName"="C:\\WINDOWS\\system32\\a3dxq.dll"
        "Asynchronous"=dword:00000001
        "Impersonate"=dword:00000001
        "Startup"="Startup"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ahrdcac]
        "Asynchronous"=dword:00000001
        "DllName"="C:\\WINDOWS\\system32\\Restore\\ahrdcac.dll"
        "Impersonate"=dword:00000000
        "Startup"="RealLogon"
        "Logoff"="RealLogoff"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
        "Asynchronous"=dword:00000000
        "Impersonate"=dword:00000000
        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
        6c,00,00,00
        "Logoff"="ChainWlxLogoffEvent"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
        "Asynchronous"=dword:00000000
        "Impersonate"=dword:00000000
        "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Logoff"="CryptnetWlxLogoffEvent"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
        "DLLName"="cscdll.dll"
        "Logon"="WinlogonLogonEvent"
        "Logoff"="WinlogonLogoffEvent"
        "ScreenSaver"="WinlogonScreenSaverEvent"
        "Startup"="WinlogonStartupEvent"
        "Shutdown"="WinlogonShutdownEvent"
        "StartShell"="WinlogonStartShellEvent"
        "Impersonate"=dword:00000000
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hggdbba]
        "Asynchronous"=dword:00000001
        "DllName"="hggdbba.dll"
        "Impersonate"=dword:00000000
        "Logon"="Logon"
        "Logoff"="Logoff"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
        "DLLName"="wlnotify.dll"
        "Logon"="SCardStartCertProp"
        "Logoff"="SCardStopCertProp"
        "Lock"="SCardSuspendCertProp"
        "Unlock"="SCardResumeCertProp"
        "Enabled"=dword:00000001
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
        "Asynchronous"=dword:00000000
        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Impersonate"=dword:00000000
        "StartShell"="SchedStartShell"
        "Logoff"="SchedEventLogOff"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
        "Logoff"="WLEventLogoff"
        "Impersonate"=dword:00000000
        "Asynchronous"=dword:00000001
        "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
        "DLLName"="WlNotify.dll"
        "Lock"="SensLockEvent"
        "Logon"="SensLogonEvent"
        "Logoff"="SensLogoffEvent"
        "Safe"=dword:00000001
        "MaxWait"=dword:00000258
        "StartScreenSaver"="SensStartScreenSaverEvent"
        "StopScreenSaver"="SensStopScreenSaverEvent"
        "Startup"="SensStartupEvent"
        "Shutdown"="SensShutdownEvent"
        "StartShell"="SensStartShellEvent"
        "PostShell"="SensPostShellEvent"
        "Disconnect"="SensDisconnectEvent"
        "Reconnect"="SensReconnectEvent"
        "Unlock"="SensUnlockEvent"
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
        "Asynchronous"=dword:00000000
        "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
        6c,00,6c,00,00,00
        "Impersonate"=dword:00000000
        "Logoff"="TSEventLogoff"
        "Logon"="TSEventLogon"
        "PostShell"="TSEventPostShell"
        "Shutdown"="TSEventShutdown"
        "StartShell"="TSEventStartShell"
        "Startup"="TSEventStartup"
        "MaxWait"=dword:00000258
        "Reconnect"="TSEventReconnect"
        "Disconnect"="TSEventDisconnect"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wineil32]
        "Asynchronous"=dword:00000001
        "DllName"="wineil32.dll"
        "Impersonate"=dword:00000000
        "Startup"="EvtStartup"
        "Shutdown"="EvtShutdown"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
        "DLLName"="wlnotify.dll"
        "Logon"="RegisterTicketExpiredNotificationEvent"
        "Logoff"="UnregisterTicketExpiredNotificationEvent"
        "Impersonate"=dword:00000001
        "Asynchronous"=dword:00000001

        **********************************************************************************
        useragent:
        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

        **********************************************************************************
        Shell Extension key:
        Windows Registry Editor Version 5.00

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
        "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
        "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
        "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
        "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
        "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
        "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
        "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
        "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
        "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
        "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
        "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
        "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
        "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
        "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
        "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
        "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
        "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
        "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
        "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
        "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
        "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
        "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
        "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
        "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
        "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
        "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
        "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
        "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
        "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
        "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
        "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
        "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
        "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
        "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
        "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
        "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
        "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
        "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
        "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
        "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
        "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
        "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
        "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
        "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
        "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
        "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
        "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
        "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
        "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
        "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
        "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
        "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
        "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
        "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Page de propri‚t‚s des versions pr‚c‚dentes"
        "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Versions pr‚c‚dentes"
        "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
        "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
        "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
        "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
        "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
        "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
        "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
        "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
        "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
        "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
        "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
        "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
        "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="IE Search Band"
        "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
        "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
        "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
        "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
        "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
        "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
        "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
        "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
        "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
        "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
        "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
        "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
        "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
        "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
        "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
        "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
        "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
        "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
        "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
        "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
        "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
        "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
        "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
        "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
        "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
        "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
        "{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
        "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
        "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
        "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
        "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
        "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
        "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
        "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
        "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
        "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
        "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
        "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
        "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
        "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
        "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
        "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
        "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
        "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
        "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
        "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
        "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
        "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
        "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
        "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
        "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
        "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
        "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
        "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
        "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
        "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
        "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
        "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
        "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
        "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
        "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
        "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
        "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
        "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
        "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
        "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
        "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
        "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
        "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
        "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
        "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
        "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
        "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
        "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
        "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
        "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
        "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
        "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
        "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
        "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
        "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
        "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
        "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
        "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
        "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
        "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
        "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
        "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
        "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
        "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
        "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
        "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
        "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
        "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
        "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
        "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
        "{2F603045-309F-11CF-9774-0020AFD0CFF6}"="Synaptics Control Panel"
        "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
        "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
        "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
        "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
        "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
        "{472083B0-C522-11CF-8763-00608CC02F24}"="avast"
        "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}"="NeroCoverEd Live Icons"
        "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders"
        "{07C45BB1-4A8C-4642-A1F5-237E7215FF66}"="IE Microsoft BrowserBand"
        "{1C1EDB47-CE22-4bbb-B608-77B48F83C823}"="IE Fade Task"
        "{205D7A97-F16D-4691-86EF-F3075DCCA57D}"="IE Menu Desk Bar"
        "{3028902F-6374-48b2-8DC6-9725E775B926}"="IE AutoComplete"
        "{43886CD5-6529-41c4-A707-7B3C92C05E68}"="IE Navigation Bar"
        "{44C76ECD-F7FA-411c-9929-1B77BA77F524}"="IE Menu Site"
        "{4B78D326-D922-44f9-AF2A-07805C2A3560}"="IE Menu Band"
        "{6038EF75-ABFC-4e59-AB6F-12D397F6568D}"="IE Microsoft History AutoComplete List"
        "{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE}"="IE Tracking Shell Menu"
        "{6CF48EF8-44CD-45d2-8832-A16EA016311B}"="IE IShellFolderBand"
        "{73CFD649-CD48-4fd8-A272-2070EA56526B}"="IE BandProxy"
        "{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8}"="IE MRU AutoComplete List"
        "{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E}"="IE RSS Feeder Folder"
        "{9D958C62-3954-4b44-8FAB-C4670C1DB4C2}"="IE Microsoft Shell Folder AutoComplete List"
        "{B31C5FAE-961F-415b-BAF0-E697A5178B94}"="IE Microsoft Multiple AutoComplete List Container"
        "{BC476F4C-D9D7-4100-8D4E-E043F6DEC409}"="Microsoft Browser Architecture"
        "{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}"="IE Shell Rebar BandSite"
        "{E6EE9AAC-F76B-4947-8260-A9F136138E11}"="IE Shell Band Site Menu"
        "{F2CF5485-4E02-4f68-819C-B92DE9277049}"="&Links"
        "{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E}"="IE Registry Tree Options Utility"
        "{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75}"="IE User Assist"
        "{FDE7673D-2E19-4145-8376-BBD58C4BC7BA}"="IE Custom MRU AutoCompleted List"

        **********************************************************************************
        HKEY ROOT CLASSIDS:
        **********************************************************************************
        Files Found are not all bad files:

        C:\WINDOWS\SYSTEM32\
        ipv6monr.dll Mon 21 May 2007 16:04:20 A.... 44 640 43,59 K
        a3dxq.dll Wed 18 Apr 2007 18:51:26 A.... 10 045 9,81 K
        ipv6mons.dll Wed 18 Apr 2007 18:11:58 A.... 45 664 44,59 K
        cwhwdoc.dll Wed 21 Mar 2007 21:02:12 A.... 84 992 83,00 K
        neroco.dll Wed 14 Mar 2007 19:19:56 A.... 95 864 93,62 K

        5 items found: 5 files, 0 directories.
        Total of file sizes: 281 205 bytes 274,61 K
        Locate .tmp files:

        No matches found.
        **********************************************************************************
        Directory Listing of system files:
        Le volume dans le lecteur C s'appelle ACER
        Le num‚ro de s‚rie du volume est 320D-180E

        R‚pertoire de C:\WINDOWS\System32

        07/03/2005 20:29 <REP> Microsoft
        07/03/2005 20:11 <REP> dllcache
        0 fichier(s) 0 octets
        2 R‚p(s) 7ÿ371ÿ718ÿ656 octets libres
        0
      2. moK´s@ Messages postés 4410 Statut Membre 89 > moK´s@ Messages postés 4410 Statut Membre
         
        re,

        relancer l2mfix.bat
        et choisir l'option 2
        Il va demander d'appuyer sur une touche pour redémarrer.

        repost un raport hijack this :

        @+
        0
  16. Bennnito Messages postés 32 Statut Membre
     
    voici en premier un rapport apparu aprés redemarrage et le rapport Hijackthis

    L2mfix 051206
    Creating Account.
    La commande s'est termin‚e correctement.

    Adding Administrative privleges.
    Checking for L2MFix account(0=no 1=yes):
    1
    Granting SeDebugPrivilege to L2MFIX ... successful

    Running From:
    C:\WINDOWS\system32

    Killing Processes!
    Killing 'smss.exe'
    \SystemRoot\System32\smss.exe (564)
    Killing 'winlogon.exe'
    winlogon.exe (656)
    Killing 'explorer.exe'
    C:\WINDOWS\Explorer.EXE (1904)
    Killing 'rundll32.exe'
    "C:\WINDOWS\system32\Rundll32.exe" SiSPower.dll,ModeAgent (580)
    Restoring Sedebugprivilege:
    Granting SeDebugPrivilege to Administrateurs ... successful

    Scanning First Pass. Please Wait!

    First Pass Completed

    Second Pass Scanning

    Second pass Completed!
    Desktop.ini sucessfully removed

    HIJACKTHIS:
    Logfile of HijackThis v1.99.1
    Scan saved at 20:42:02, on 21/05/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Launch Manager\QtZgAcer.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
    C:\Program Files\Arcade\PCMService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\palmOne\Hotsync.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\acer\eRecovery\Monitor.exe
    C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: (no name) - {00A7863B-DDC7-0034-A0C8-07530F512758} - C:\WINDOWS\system32\mttqnzh.dll (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {0B38AA6B-CFD5-481D-894F-D8354C3788E4} - C:\WINDOWS\system32\dscglgim.dll (file missing)
    O2 - BHO: (no name) - {2B5E25BC-C1B2-92D8-02F0-081D435BC4F0} - C:\WINDOWS\system32\mmzarpe.dll (file missing)
    O2 - BHO: (no name) - {3F47CEB7-3C27-74D8-053F-046090C17FFF} - C:\WINDOWS\system32\fzitqie.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Benjamin\52116830.dll
    O2 - BHO: (no name) - {62B2F83B-3884-4670-A34C-67E33B9DA9BD} - C:\WINDOWS\system32\syoiyatj.dll (file missing)
    O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6monr.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: (no name) - {B69BF0EA-E0AD-4906-B252-364B070B29EB} - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
    O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
    O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: A3dxq - C:\WINDOWS\system32\a3dxq.dll
    O20 - Winlogon Notify: ahrdcac - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O20 - Winlogon Notify: hggdbba - hggdbba.dll (file missing)
    O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

    MERCI
    0
  17. moK´s@ Messages postés 4410 Statut Membre 89
     
    re,

    * Relance Vundofix
    * Ne clique pas sur "Scan for a vundo"
    * Clique droit au milieu de la fenêtre
    * Clique sur Add more files ?
    * Copie/colle les fichiers ci-dessous ( un par case) :

    C:\Documents and Settings\Benjamin\52116830.dll
    C:\WINDOWS\system32\ipv6monr.dll
    C:\WINDOWS\System32\a3dxq.dll

    * Clique sur Add files
    * Ensuite clique sur Close Windows
    * Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
    * Si l'outils demande un redémarrage, accepte
    * Poste le rapport Vundofix
    + un rapport hijack this
    0
  18. Bennnito Messages postés 32 Statut Membre
     
    Au redemarrage aprés la manip windows m'a signaler qu'il a réparer une erreur sérieuse
    j'ai le log VUNDOFIX:

    Beginning removal...

    Attempting to delete C:\WINDOWS\System32\dscglgim.dll
    C:\WINDOWS\System32\dscglgim.dll Has been deleted!

    Attempting to delete C:\WINDOWS\System32\fzitqie.dll
    C:\WINDOWS\System32\fzitqie.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\Documents and Settings\Benjamin\52116830.dll
    C:\Documents and Settings\Benjamin\52116830.dll Has been deleted!

    Attempting to delete C:\WINDOWS\System32\a3dxq.dll
    C:\WINDOWS\System32\a3dxq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ipv6monr.dll
    C:\WINDOWS\system32\ipv6monr.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    MERCI
    0
  19. Bennnito Messages postés 32 Statut Membre
     
    Voici aussi le rapport HITJACKTHIS

    Logfile of HijackThis v1.99.1
    Scan saved at 21:08:04, on 21/05/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\keyhook.exe
    C:\Program Files\Launch Manager\QtZgAcer.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
    C:\Program Files\Arcade\PCMService.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\RocketDock\RocketDock.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\acer\eRecovery\Monitor.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\palmOne\Hotsync.exe
    C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: (no name) - {00A7863B-DDC7-0034-A0C8-07530F512758} - C:\WINDOWS\system32\mttqnzh.dll (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {0B38AA6B-CFD5-481D-894F-D8354C3788E4} - C:\WINDOWS\system32\dscglgim.dll (file missing)
    O2 - BHO: (no name) - {2B5E25BC-C1B2-92D8-02F0-081D435BC4F0} - C:\WINDOWS\system32\mmzarpe.dll (file missing)
    O2 - BHO: (no name) - {3F47CEB7-3C27-74D8-053F-046090C17FFF} - C:\WINDOWS\system32\fzitqie.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Benjamin\52116830.dll (file missing)
    O2 - BHO: (no name) - {62B2F83B-3884-4670-A34C-67E33B9DA9BD} - C:\WINDOWS\system32\syoiyatj.dll (file missing)
    O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6monr.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: (no name) - {B69BF0EA-E0AD-4906-B252-364B070B29EB} - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
    O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
    O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
    O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: ahrdcac - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O20 - Winlogon Notify: hggdbba - hggdbba.dll (file missing)
    O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

    MERCI
    0
  20. moK´s@ Messages postés 4410 Statut Membre 89
     
    re ,

    Maintenant ton rapport hijack this parait propre enfin apres avoir fixés les lignes suivantes :

    Avec hijack this coche les lignes suivantes:
    O2 - BHO: (no name) - {00A7863B-DDC7-0034-A0C8-07530F512758} - C:\WINDOWS\system32\mttqnzh.dll (file missing)
    O2 - BHO: (no name) - {0B38AA6B-CFD5-481D-894F-D8354C3788E4} - C:\WINDOWS\system32\dscglgim.dll (file missing)
    O2 - BHO: (no name) - {2B5E25BC-C1B2-92D8-02F0-081D435BC4F0} - C:\WINDOWS\system32\mmzarpe.dll (file missing)
    O2 - BHO: (no name) - {3F47CEB7-3C27-74D8-053F-046090C17FFF} - C:\WINDOWS\system32\fzitqie.dll (file missing)
    O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Benjamin\52116830.dll (file missing)
    O2 - BHO: (no name) - {62B2F83B-3884-4670-A34C-67E33B9DA9BD} - C:\WINDOWS\system32\syoiyatj.dll (file missing)
    O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\system32\ipv6monr.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
    O2 - BHO: (no name) - {B69BF0EA-E0AD-4906-B252-364B070B29EB} - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O20 - Winlogon Notify: ahrdcac - C:\WINDOWS\system32\Restore\ahrdcac.dll (file missing)
    O20 - Winlogon Notify: hggdbba - hggdbba.dll (file missing)
    O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)

    Quitte ton navigateur et tes application et fixe/check les lignes si dessus.

    Tu n´as pas de par feu :

    https://kerio.probb.fr/t4-tlcharger-sunbelt-kerio-personal-firewall

    tutoriels :

    https://kerio.probb.fr/f2-sunbelt-kerio-personal-firewall

    Comme tu étais tres infecté le mieux maintenant c´est de faire un scan en ligne puis un scan pour les trojants :

    scan en ligne kaspersky :

    https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr désactiver avast pendant le scan car kaspersky n´aime pas avast

    ou celui la :

    https://www.bitdefender.fr/
    et copie colle le résultat ici
    * En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
    * Dans la nouvelle fenêtre, clique sur I agree
    * La fenêtre change encore, clique sur Click here to scan
    * Les signatures se chargent, etc.

    tuto en image

    http://pageperso.aol.fr/rginformatique/mapage/defender.htm

    accèpte l´active x

    scan pour les trojants et spyware :

    * télécharge AVG Anti-Spyware (ewido)

    https://www.avg.com/en-ww/free-antivirus-download
    http://www.infos-du-net.com/telecharger/Ewido-Security-Suite,0301-734.html
    * tu l'installes

    * lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente
    si tu n'arrives pas à le mettre à jour prends ici les màj
    http://downloads.ewido.net/avgas-signatures-full-current.exe

    Sur la page "analyse":
    •- tu choisis d'abord l'onglet "paramètres".
    - sous « Comment réagir » clic sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer »

    poste les rapports

    Bon courrage...

    @+
    0
    1. Bennnito Messages postés 32 Statut Membre
       
      Salut Mok's, j'ai donc fait le scan en ligne qui m'a seulement détecté des virus mais pas nettoyé, j'ai installé Kerio en parre feu + AVG en anti spyware, je l'ai mis en action et il m'a fait le menage je te fait suivre les rapports:

      Pour le parre-feu Kerio j'ai l'application GENERIC HOST PROCESS FOR WIN32 qui apparait, que dois-je faire?


      KAPERSKY en ligne:
      Nom de l'objet infecté Nom du virus Dernière action
      C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SYSTEM L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SOFTWARE L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\DEFAULT L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

      C:\WINDOWS\system32\ovuflnf.dll Infecté : Trojan.Win32.Obfuscated.ev ignoré

      C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

      C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

      C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\dlh9jkd1q6.exe Infecté : Email-Worm.Win32.Zhelatin.da ignoré

      C:\WINDOWS\system32\ipv6mons.dll Suspect : Packed.Win32.Morphine.a ignoré

      C:\WINDOWS\system32\cwhwdoc.dll Infecté : Trojan.Win32.Obfuscated.ev ignoré

      C:\WINDOWS\system32\dlh9jkd1q2.exe Infecté : Trojan-Downloader.Win32.Small.cpg ignoré

      C:\WINDOWS\system32\vexg4am1et2.exe Infecté : Email-Worm.Win32.Zhelatin.da ignoré

      C:\WINDOWS\system32\vexga4me1.exe Infecté : Trojan-Proxy.Win32.Xorpix.ba ignoré

      C:\WINDOWS\system32\vexga5me3.exe Infecté : Trojan-Downloader.Win32.Agent.bls ignoré

      C:\WINDOWS\system32\cent.exe.exe Infecté : Email-Worm.Win32.Zhelatin.da ignoré

      C:\WINDOWS\system32\pdp.exe.exe Infecté : Email-Worm.Win32.Zhelatin.da ignoré

      C:\WINDOWS\Temp\Perflib_Perfdata_704.dat L'objet est verrouillé ignoré

      C:\WINDOWS\Temp\winA8.tmp.exe Infecté : Trojan.Win32.Obfuscated.ev ignoré

      C:\WINDOWS\Temp\winB41.tmp.exe Infecté : Trojan.Win32.Obfuscated.ev ignoré

      C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

      C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

      C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

      C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré

      C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

      C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

      C:\WINDOWS\updater.exe.tmp Infecté : Trojan-Downloader.Win32.Agent.bls ignoré

      C:\WINDOWS\winhp32.exe Infecté : Trojan-Clicker.Win32.Small.kj ignoré

      C:\WINDOWS\winlogon32.dll Infecté : Trojan-Clicker.Win32.Small.kj ignoré

      C:\WINDOWS\winlogon32.exe Infecté : Trojan-Clicker.Win32.Small.kj ignoré

      C:\WINDOWS\2035.exe Suspect : Packed.Win32.Morphine.a ignoré

      C:\DOCUME~1\Benjamin\LOCALS~1\Temp\spoolsv32.exe Infecté : Trojan-Clicker.Win32.Agent.hz ignoré

      C:\DOCUME~1\Benjamin\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\E9VD2QUM\2035[1].exe Suspect : Packed.Win32.Morphine.a ignoré

      C:\DOCUME~1\Benjamin\LOCALS~1\Temp\~DFD42E.tmp L'objet est verrouillé ignoré

      C:\DOCUME~1\Benjamin\LOCALS~1\Temp\~DFD436.tmp L'objet est verrouillé ignoré

      RAPPORT AVG:

      ---------------------------------------------------------
      AVG Anti-Spyware - Rapport d'analyse
      ---------------------------------------------------------

      + Créé à: 23:24:24 21/05/2007

      + Résultat de l'analyse:



      C:\Program Files\Safety Bar -> Adware.Generic : Nettoyé.
      C:\Program Files\Safety Bar\Uninstall.bat -> Adware.Generic : Nettoyé.
      HKLM\SOFTWARE\Classes\CLSID\{052b12f7-86fa-4921-8482-26c42316b522} -> Adware.Generic : Nettoyé.
      HKU\S-1-5-21-174483677-2792361935-2627159090-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{052B12F7-86FA-4921-8482-26C42316B522} -> Adware.Generic : Nettoyé.
      HKU\S-1-5-21-174483677-2792361935-2627159090-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A43385F0-7113-496D-96D7-B9B550E3FCCA} -> Adware.Isearch : Nettoyé.
      HKLM\SOFTWARE\Clickspring -> Adware.PurityScan : Nettoyé.
      C:\Program Files\Fichiers communs\{320D180E-0708-1036-0824-050330050021}\system.dll -> Adware.Softomate : Nettoyé.
      C:\Documents and Settings\Benjamin\Local Settings\Temp\pa_0265.exe -> Dialer.Agent.k : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0044879.exe -> Downloader.Agent.bls : Nettoyé.
      C:\WINDOWS\system32\vexga5me3.exe -> Downloader.Agent.bls : Nettoyé.
      C:\WINDOWS\updater.exe.tmp -> Downloader.Agent.bls : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0038820.EXE -> Downloader.Agent.es : Nettoyé.
      C:\FOUND.005\FILE0019.CHK -> Downloader.Small : Nettoyé.
      C:\FOUND.005\FILE0020.CHK -> Downloader.Small : Nettoyé.
      C:\FOUND.005\FILE0022.CHK -> Downloader.Small : Nettoyé.
      C:\FOUND.005\FILE0023.CHK -> Downloader.Small : Nettoyé.
      C:\WINDOWS\system32\dlh9jkd1q2.exe -> Downloader.Small.cpg : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0038822.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0039768.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0039785.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0039800.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0039817.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0039839.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0041852.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0042868.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0044939.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0047935.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0047964.dll -> Hijacker.Small.kj : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0051046.dll -> Hijacker.Small.kj : Nettoyé.
      C:\WINDOWS\winlogon32.dll -> Hijacker.Small.kj : Nettoyé.
      C:\FOUND.005\FILE0032.CHK -> Not-A-Virus.SpamTool.Win32.Agent.af : Nettoyé.
      C:\FOUND.005\FILE0009.CHK -> Proxy.Xorpix.ba : Nettoyé.
      C:\FOUND.005\FILE0010.CHK -> Proxy.Xorpix.ba : Nettoyé.
      C:\WINDOWS\system32\vexga4me1.exe -> Proxy.Xorpix.ba : Nettoyé.
      :mozilla.14:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
      :mozilla.15:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyé.
      :mozilla.112:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
      :mozilla.113:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
      :mozilla.114:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
      :mozilla.307:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
      :mozilla.168:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
      :mozilla.169:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
      :mozilla.170:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
      :mozilla.222:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@2.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@3.adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
      :mozilla.281:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
      :mozilla.305:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
      :mozilla.306:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@adtech[3].txt -> TrackingCookie.Adtech : Nettoyé.
      :mozilla.136:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
      :mozilla.138:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
      :mozilla.119:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
      :mozilla.27:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
      :mozilla.403:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
      :mozilla.92:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
      :mozilla.283:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@casalemedia[2].txt -> TrackingCookie.Casalemedia : Nettoyé.
      :mozilla.376:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Clickhype : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@commission-junction[2].txt -> TrackingCookie.Commission-junction : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@cpvfeed[3].txt -> TrackingCookie.Cpvfeed : Nettoyé.
      :mozilla.191:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Cqcounter : Nettoyé.
      :mozilla.68:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
      :mozilla.321:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
      :mozilla.42:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
      :mozilla.43:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
      :mozilla.44:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
      :mozilla.45:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@media.fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@findwhat[1].txt -> TrackingCookie.Findwhat : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@findwhat[2].txt -> TrackingCookie.Findwhat : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@goclick[2].txt -> TrackingCookie.Goclick : Nettoyé.
      :mozilla.86:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
      :mozilla.87:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@searchportal.information[2].txt -> TrackingCookie.Information : Nettoyé.
      :mozilla.195:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Liveperson : Nettoyé.
      :mozilla.196:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Liveperson : Nettoyé.
      :mozilla.400:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Masterstats : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@image.masterstats[1].txt -> TrackingCookie.Masterstats : Nettoyé.
      :mozilla.129:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@search.msn[2].txt -> TrackingCookie.Msn : Nettoyé.
      :mozilla.404:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
      :mozilla.405:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
      :mozilla.96:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@pocitadlo[2].txt -> TrackingCookie.Pocitadlo : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@guide.real[1].txt -> TrackingCookie.Real : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@real[1].txt -> TrackingCookie.Real : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@real[2].txt -> TrackingCookie.Real : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@real[3].txt -> TrackingCookie.Real : Nettoyé.
      :mozilla.175:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
      :mozilla.176:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@realmedia[1].txt -> TrackingCookie.Realmedia : Nettoyé.
      :mozilla.406:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
      :mozilla.407:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
      :mozilla.408:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
      :mozilla.409:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
      :mozilla.410:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@stats1.reliablestats[3].txt -> TrackingCookie.Reliablestats : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@ads1.revenue[1].txt -> TrackingCookie.Revenue : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@revenue[1].txt -> TrackingCookie.Revenue : Nettoyé.
      :mozilla.261:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
      :mozilla.62:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
      :mozilla.63:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
      :mozilla.64:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
      :mozilla.65:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
      :mozilla.66:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
      :mozilla.67:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
      :mozilla.397:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
      :mozilla.398:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
      :mozilla.399:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
      :mozilla.401:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
      :mozilla.402:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
      :mozilla.74:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
      :mozilla.53:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
      :mozilla.54:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
      :mozilla.59:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
      :mozilla.61:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@www.smartadserver[3].txt -> TrackingCookie.Smartadserver : Nettoyé.
      :mozilla.262:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
      :mozilla.263:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
      :mozilla.267:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
      :mozilla.268:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
      :mozilla.221:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.224:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.225:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.226:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.227:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.228:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.229:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.230:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.231:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.232:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
      :mozilla.353:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Toplist : Nettoyé.
      :mozilla.162:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
      :mozilla.163:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
      :mozilla.164:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@tradedoubler[3].txt -> TrackingCookie.Tradedoubler : Nettoyé.
      :mozilla.255:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Nettoyé.
      :mozilla.55:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
      :mozilla.56:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
      :mozilla.57:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
      :mozilla.157:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
      :mozilla.158:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
      :mozilla.159:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
      :mozilla.282:C:\Documents and Settings\Benjamin\Application Data\Mozilla\Firefox\Profiles\hk798p0d.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
      C:\Documents and Settings\Benjamin\Cookies\benjamin@zedo[1].txt -> TrackingCookie.Zedo : Nettoyé.
      C:\System Volume Information\_restore{0E53C2D2-603D-4B01-84F6-6DE602018BFB}\RP128\A0038810.exe -> Trojan.Small : Nettoyé.
      C:\WINDOWS\system32\wnsapisv.exe -> Trojan.Small : Nettoyé.
      C:\WINDOWS\winhp32.exe -> Trojan.Small : Nettoyé.
      C:\WINDOWS\winlogon32.exe -> Trojan.Small : Nettoyé.
      C:\WINDOWS\system32\dlh9jkd1q7.exe -> Worm.Nuwar.gen : Nettoyé.
      C:\WINDOWS\system32\dlh9jkd1q6.exe -> Worm.Zhelatin.da : Nettoyé.
      C:\WINDOWS\system32\vexg4am1et2.exe -> Worm.Zhelatin.da : Nettoyé.


      Fin du rapport

      Nouveau RAPPORT HITJACKTHIS:

      Logfile of HijackThis v1.99.1
      Scan saved at 12:25:18, on 22/05/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Acer\eManager\anbmServ.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\AGRSMMSG.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\WINDOWS\system32\keyhook.exe
      C:\Program Files\Launch Manager\QtZgAcer.EXE
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      C:\Program Files\Arcade\PCMService.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\RocketDock\RocketDock.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      C:\WINDOWS\system32\sistray.exe
      C:\Program Files\palmOne\Hotsync.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\acer\eRecovery\Monitor.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [LaunchApp] Alaunch
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
      O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
      O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
      O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
      O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe


      MERCI Pour ton aide
      0
    2. moK´s@ Messages postés 4410 Statut Membre 89
       
      salut,

      Je t´avais dis que tu était trés infécté...

      Avec kill box :

      Double-clique sur le fichier Killbox.exe, et coche la case "Delete on reboot".
      copie les lignes ci dessous :

      C:\WINDOWS\system32\dlh9jkd1q6.exe

      C:\WINDOWS\system32\ipv6mons.dll

      C:\WINDOWS\system32\cwhwdoc.dll

      C:\WINDOWS\system32\dlh9jkd1q2.exe

      C:\WINDOWS\system32\vexga4me1.exe

      C:\WINDOWS\system32\cent.exe.exe

      C:\WINDOWS\system32\pdp.exe.exe Infecté :

      C:\WINDOWS\Temp\winA8.tmp.exe

      C:\WINDOWS\Temp\winB41.tmp.exe

      C:\WINDOWS\Temp\winA8.tmp.exe

      C:\WINDOWS\updater.exe.tmp

      C:\WINDOWS\2035.exe

      C:\DOCUME~1\Benjamin\LOCALS~1\Temp\spoolsv32.exe


      Sur PocketKillBox --> menu "File" --> "Paste from Clipboard"

      Tu peux vérifier dans le menu déroulant que les fichiers sont bien présent.
      - coche la case "Unregister dll before deleting" (si tu en as la possibilité)
      - clique sur le bouton "All files"
      - clique ensuite sur la croix rouge

      Au deux messages qui vont s'afficher, tu réponds par "YES"
      L'ordinateur doit redémarrer, sinon, fais le toi-même, quoiqu'il arrive.

      Refais un scan kaspersky en ligne et colle le rapport

      @+
      0
    3. moK´s@ Messages postés 4410 Statut Membre 89
       
      j´ai eu un probleme pour ecrir le message :

      Fais ceci aussi :

      Telecharge:
      Clean Up 40:
      http://pageperso.aol.fr/balltrap34/CleanUp40.exe
      -aide en image:(merci a Balltrap34)
      http://pageperso.aol.fr/balltrap34/democleanup.htm
      fais le marcher

      @+

      Courrage...


      0
    4. Bennnito Messages postés 32 Statut Membre > moK´s@ Messages postés 4410 Statut Membre
       
      Salut Mok's, je suis tes instructions et j'ai utiliser cleanup40 qui m'a viré 67Mb, j'ai fait un scan en ligne que je te donne et un log Hijackthis qui suit:

      SCAN EN LIGNE KAPERSKY:
      Nom de l'objet infecté Nom du virus Dernière action
      C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SYSTEM L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SOFTWARE L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\DEFAULT L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

      C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

      C:\WINDOWS\system32\ovuflnf.dll Infecté : Trojan.Win32.Obfuscated.ev ignoré

      C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

      C:\WINDOWS\Temp\_avast4_\Webshlock.txt L'objet est verrouillé ignoré

      C:\WINDOWS\Temp\_avast4_\unp125114913.tmp L'objet est verrouillé ignoré

      C:\WINDOWS\Temp\Perflib_Perfdata_e0.dat L'objet est verrouillé ignoré

      C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

      C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

      C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

      C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

      C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré

      C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

      C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

      C:\DOCUME~1\Benjamin\LOCALS~1\Temp\~DF3494.tmp L'objet est verrouillé ignoré

      Analyse terminée.

      LOG HIJACKTHIS:

      Logfile of HijackThis v1.99.1
      Scan saved at 17:10:02, on 22/05/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Acer\eManager\anbmServ.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\WINDOWS\system32\keyhook.exe
      C:\Program Files\Launch Manager\QtZgAcer.EXE
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      C:\Program Files\Arcade\PCMService.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\RocketDock\RocketDock.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINDOWS\system32\sistray.exe
      C:\Program Files\palmOne\Hotsync.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\acer\eRecovery\Monitor.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Benjamin\Bureau\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [LaunchApp] Alaunch
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
      O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
      O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
      O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
      O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
      O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
      O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Version Cue\ControlPanel\VersionCueTray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
      O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
      O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
      O4 - HKCU\..\Run: [Nphb] "C:\WINDOWS\system32\SCURIT~1\dexplore.exe" -vt yazb
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
      O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
      O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{473A2208-4C7F-42DA-9173-03F2E29408C5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{7FAE03F8-21B7-4AA8-A7F1-D7F5B04BB5D5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CCS\Services\Tcpip\..\{C44463CC-F5B1-4EEF-87B5-271083CAE3F5}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS1\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O17 - HKLM\System\CS2\Services\Tcpip\..\{16BB4D6F-477C-415F-810F-5BA9362F285B}: NameServer = 210.131.249.33
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

      MERCI MOK'S
      0
    5. moK´s@ Messages postés 4410 Statut Membre 89 > moK´s@ Messages postés 4410 Statut Membre
       
      re,

      toujours avec la kill box

      efface :

      C:\WINDOWS\system32\ovuflnf.dll

      Dis moi comment va ton pc?

      @+
      0
  21. Bennnito Messages postés 32 Statut Membre
     
    Mok's, lorsque j'utilise KillBOx pour cette ligne, le programme me dit qu'il l'effacera aprés redemarrage et avant de s'éteindre il y a un message d'erreur qui me dit: PendingFileRenameOperations Registry Data has been Removed by External Process.
    Que dois-je faire? attends instructions
    Merci
    0
  • 1
  • 2

Discussions similaires

Impossible de joindre Avast
soleil12 -
BZH -

8 réponses
Phishing faux mail d'avast
Colette34 -
Gerper -

2 réponses