shdoclc.dll me télécharge des virus

Question

Bonjour, depuis quelque temps j'ai des pages html qui s'affichent (que je sois connecté ou pas). Lorsque je ne suis pas connecté, la page s'ouvre et se referme illico, elle cherche un site du nom de smetsys.net puis elle cherche une autre adresse bizar : res://C:\Windows\system32\shdoclc.dll/dnserror.htm.... Quand je suis connecté, ce sont des pages de pub qui s'affichent, ces pages m'envoies des programmes (le nom d'un des programme est tmpA24.tmp.exe) contenant des virus (la plupart du temps des trojans). J'ai aussi des favoris qui ne peuvent pas s'enlever mais je pense que ce n'est pas en rapport avec le virus. Je dispose d'un antivirus qui est Nod32, celui-ci bloque les fenêtres et les programmes mais les pages s'affichent quand même et les programmes sont toujours télécharger.

Je crois que j'ai tout dit, merci pour votre aide.

Lyonnais92 · Answer

Bonjour,

Télécharge HijackThis ici: 
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html 

Dézippe le dans un dossier prévu à cet effet. 
Par exemple C:\hijackthis < Enregistre le bien dans c : ! 
Démo : (Merci a Balltrap34 pour cette réalisation) 
http://perso.orange.fr/rginformatique/section%20virus/Hijenr.gif

Lance le puis: 
clique sur "do a system scan and save logfile" (cf démo) 
faire un copier coller du log entier sur le forum 

Démo : (Merci a Balltrap34 pour cette réalisation) 

http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

Je pense connaître au moins un de tes soucis, mais Hijackthis va permettre de vérifier.
@+

Burning_sky_18 · Answer

J'avais déja HijackThis mais je ne sais pas lire entre les ligne lol, vila le log :




Logfile of HijackThis v1.99.1
Scan saved at 17:36:21, on 14/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\MA SESSION\Mes documents\Logiciels\Sécurité\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {69b29049-2d1e-4920-bdb5-f27020f3b4fa} - C:\WINDOWS\system32\cermat.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9B14FF84-0E44-4754-8AB0-A37A42DC05DA} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
O2 - BHO: (no name) - {E44527F6-1296-4A84-B67D-A6CEA6ED4B69} - (no file)
O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32
vsysrot.dll,Enable
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Live Mpeg Less About] C:\Documents and Settings\All Users\Application Data\axis show live mpeg\atom bend.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [chinonce] C:\DOCUME~1\MASESS~1\APPLIC~1\PLATFO~1\forroam.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\fr-fr\msntabres.dll.mui/229?2237dd14d4c04700b56d3597d73310a8
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\fr-fr\msntabres.dll.mui/230?2237dd14d4c04700b56d3597d73310a8
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E4C8076-F80A-4C9A-A864-09B8B3D1EE5A}: NameServer = 213.36.80.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ddayxwv.dll
O20 - Winlogon Notify: cermat - C:\WINDOWS\SYSTEM32\cermat.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
O20 - Winlogon Notify: ssqrrsq - ssqrrsq.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\apache2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe


Merci pour ton aide

Lyonnais92 · Answer

Re,

gagné, mais 2 pour le prix d'un.

1) Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 
Double-clique VundoFix.exe afin de le lancer. 

Clique sur le bouton Scan for Vundo. 
Lorsque le scan est complété, clique sur le bouton Remove Vundo. 
Une invite te demandera si tu veux supprimer les fichiers, clique YES 
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK 
Démarre ton PC à nouveau. 

poste le rapport (c:\vundofix.txt). Si tu ne le trouve pas, cherche le via la fonction rechercher de Windows sur ton poste de travail et avec vundofix.txt.

2) Télécharge lopxp 

http://www.alt-shift-return.org/Info/Fichiers/lopxpMH2.zip


dezippe le (clic droit dessus > extraire tout) 
et lance lopxpmh.bat en double-cliquant dessus
quand il à terminé, un rapport s'ouvre , copie et colle le contenu dans ta réponse. 

3) Remets un log Hijackthis.
@+

Burning_sky_18 · Answer

VundoFix ne peut pas supprimer un fichier infecté : ddayxwv.dll
Voila le rapport de lop XP : (je n'est pas pu extraire la commande)

Rapport lopxpMH2 version 2.0 fait à 18:51:30,76 le 14/06/2007
C:\Documents and Settings\MA SESSION\Bureau

******************************************
## Répertoires Application Data

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\Administrateur\Application Data

15/09/2006 14:45 <REP> .
15/09/2006 14:45 <REP> ..
22/09/2006 13:51 <REP> Adobe
18/09/2006 14:02 <REP> ATI
15/09/2006 15:51 <REP> Identities
05/03/2007 15:12 <REP> Intel
15/09/2006 14:45 <REP> Microsoft
22/09/2006 13:58 <REP> Sonic
22/09/2006 11:51 <REP> toshiba
22/09/2006 14:17 <REP> Windows Desktop Search
15/09/2006 14:45 62 desktop.ini
1 fichier(s) 62 octets
10 Rép(s) 39 556 108 288 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\Administrateur\Local Settings\Application Data

15/09/2006 14:45 <REP> .
15/09/2006 14:45 <REP> ..
15/09/2006 15:22 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150060}
22/09/2006 13:51 <REP> Adobe
15/09/2006 14:49 <REP> ApplicationHistory
18/09/2006 14:02 <REP> ATI
15/09/2006 14:45 <REP> Microsoft
15/09/2006 14:49 137 fusioncache.dat
18/09/2006 14:02 65 544 GDIPFONTCACHEV1.DAT
15/09/2006 16:39 1 424 644 IconCache.db
3 fichier(s) 1 490 325 octets
7 Rép(s) 39 556 108 288 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\All Users\Application Data

15/09/2006 16:31 <REP> .
15/09/2006 16:31 <REP> ..
22/09/2006 13:49 <REP> Adobe
18/03/2007 16:48 <REP> Ahead
21/03/2007 19:34 <REP> Apple Computer
25/03/2007 04:26 <REP> axis show live mpeg
18/03/2007 15:52 <REP> DVD Shrink
27/04/2007 19:49 <REP> Google
15/04/2007 20:44 <REP> InstallShield
05/03/2007 15:12 <REP> Intel
25/03/2007 04:31 <REP> Messenger Plus!
15/09/2006 16:31 <REP> Microsoft
10/06/2007 01:08 <REP> nView_Profiles
25/03/2007 01:22 <REP> Real
28/04/2007 17:42 <REP> Spybot - Search & Destroy
14/04/2007 21:05 <REP> Start 1 Junk Fast
22/09/2006 14:07 <REP> Symantec
18/03/2007 17:22 <REP> Ubisoft
25/03/2007 00:57 <REP> Windows Genuine Advantage
15/09/2006 16:31 62 desktop.ini
02/04/2007 19:17 770 Installer.log
2 fichier(s) 832 octets
19 Rép(s) 39 556 108 288 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\Default User\Application Data

15/09/2006 16:31 <REP> .
15/09/2006 16:31 <REP> ..
05/03/2007 15:09 <REP> Adobe
05/03/2007 15:09 <REP> ATI
05/03/2007 15:09 <REP> Identities
05/03/2007 15:12 <REP> Intel
15/09/2006 16:31 <REP> Microsoft
05/03/2007 15:09 <REP> Sonic
05/03/2007 15:09 <REP> toshiba
05/03/2007 15:09 <REP> Windows Desktop Search
15/09/2006 16:31 62 desktop.ini
1 fichier(s) 62 octets
10 Rép(s) 39 556 108 288 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\Default User\Local Settings\Application Data

15/09/2006 16:31 <REP> .
15/09/2006 16:31 <REP> ..
05/03/2007 15:09 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150060}
05/03/2007 15:09 <REP> Adobe
05/03/2007 15:09 <REP> ApplicationHistory
05/03/2007 15:09 <REP> ATI
15/09/2006 14:41 <REP> Microsoft
05/03/2007 15:09 137 fusioncache.dat
05/03/2007 15:09 19 744 GDIPFONTCACHEV1.DAT
05/03/2007 15:09 1 424 644 IconCache.db
3 fichier(s) 1 444 525 octets
7 Rép(s) 39 556 104 192 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\LocalService\Application Data

15/09/2006 14:45 <REP> .
15/09/2006 14:45 <REP> ..
05/03/2007 15:12 <REP> Intel
15/09/2006 14:45 <REP> Microsoft
22/09/2006 14:27 <REP> X10 Commander
0 fichier(s) 0 octets
5 Rép(s) 39 556 104 192 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data

15/09/2006 14:45 <REP> .
15/09/2006 14:45 <REP> ..
15/09/2006 14:45 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 39 556 104 192 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\MA SESSION\Application Data

05/03/2007 15:10 <REP> .
05/03/2007 15:10 <REP> ..
05/03/2007 15:10 <REP> Adobe
08/04/2007 21:13 <REP> AdobeUM
18/03/2007 16:53 <REP> Ahead
21/03/2007 20:39 <REP> Apple Computer
21/04/2007 21:41 <REP> ArcSoft
05/03/2007 15:10 <REP> ATI
25/03/2007 01:28 <REP> DivX
27/04/2007 19:49 <REP> Google
19/03/2007 01:18 <REP> Help
05/03/2007 15:10 <REP> Identities
05/03/2007 15:12 <REP> Intel
05/03/2007 16:55 <REP> InterVideo
28/04/2007 17:19 <REP> Lavasoft
21/03/2007 19:27 <REP> Macromedia
05/03/2007 15:10 <REP> Microsoft
09/05/2007 18:43 <REP> Mozilla
25/03/2007 04:26 <REP> PLATFORM AXIS
25/03/2007 01:22 <REP> Real
25/03/2007 04:37 <REP> Screenshot Sender
13/05/2007 20:31 <REP> Sierra
05/03/2007 15:10 <REP> Sonic
24/03/2007 14:51 <REP> Sun
05/03/2007 15:10 <REP> toshiba
03/04/2007 18:25 <REP> U3
09/06/2007 15:51 <REP> VirtuaWin
05/03/2007 15:10 <REP> Windows Desktop Search
05/03/2007 15:10 62 desktop.ini
17/03/2007 23:33 196 G-Force Prefs (WindowsMediaPlayer).txt
14/04/2007 20:01 4 188 qp1c_prefs
18/03/2007 12:52 2 132 QuickZip45.ini
14/06/2007 18:16 131 072 tmp12C.tmp.exe
08/06/2007 13:10 32 768 tmp153.tmp.exe
14/06/2007 18:18 32 768 tmp15C.tmp.exe
11/06/2007 18:37 32 768 tmp162B.tmp.exe
12/06/2007 14:58 229 376 tmp163.tmp.exe
11/06/2007 18:39 131 072 tmp1660.tmp.exe
08/06/2007 13:13 131 072 tmp178.tmp.exe
07/06/2007 19:01 32 768 tmp1B5D.tmp.exe
12/06/2007 15:00 32 768 tmp1BD.tmp.exe
09/06/2007 15:31 32 768 tmp1E8.tmp.exe
09/06/2007 15:33 131 072 tmp20D.tmp.exe
07/06/2007 20:04 32 768 tmp247E.tmp.exe
07/06/2007 16:27 32 768 tmp2A3.tmp.exe
07/06/2007 16:32 131 072 tmp313.tmp.exe
08/06/2007 12:13 32 768 tmp33.tmp.exe
07/06/2007 19:03 131 072 tmp36C5.tmp.exe
09/06/2007 15:44 32 768 tmp3B7.tmp.exe
09/06/2007 15:07 32 768 tmp3C.tmp.exe
09/06/2007 15:08 131 072 tmp3E.tmp.exe
09/06/2007 15:53 131 072 tmp42B.tmp.exe
11/06/2007 14:24 32 768 tmp75.tmp.exe
08/06/2007 12:16 131 072 tmp8D.tmp.exe
14/06/2007 16:23 131 072 tmp9EB.tmp.exe
14/06/2007 16:24 32 768 tmpA24.tmp.exe
11/06/2007 14:27 147 456 tmpD4.tmp.exe
14/06/2007 14:03 131 072 tmpEE.tmp.exe
14/06/2007 14:04 32 768 tmpF0.tmp.exe
08/06/2007 18:06 32 768 tmpF62.tmp.exe
08/06/2007 18:08 131 072 tmpF86.tmp.exe
33 fichier(s) 2 447 794 octets
28 Rép(s) 39 556 100 096 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\MA SESSION\Local Settings\Application Data

05/03/2007 15:10 <REP> .
05/03/2007 15:10 <REP> ..
05/03/2007 15:10 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150060}
13/04/2007 23:45 <REP> {35A3A4F2-B792-11D6-A78A-00B0D0142130}
05/03/2007 15:10 <REP> Adobe
21/03/2007 20:38 <REP> Apple Computer
05/03/2007 15:10 <REP> ApplicationHistory
05/03/2007 15:10 <REP> ATI
27/04/2007 19:49 <REP> Google
19/03/2007 01:18 <REP> Help
07/06/2007 15:56 <REP> Identities
03/04/2007 18:09 <REP> Logitech-LS
05/03/2007 15:10 <REP> Microsoft
05/06/2007 15:29 <REP> Mozilla
09/06/2007 18:38 <REP> sTabLauncher
17/03/2007 20:53 <REP> Stardock
18/03/2007 17:22 <REP> Ubisoft
23/03/2007 19:37 <REP> WMTools Downloaded Files
17/03/2007 23:44 59 904 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
05/03/2007 15:10 133 fusioncache.dat
05/03/2007 15:10 19 744 GDIPFONTCACHEV1.DAT
05/03/2007 15:10 2 109 876 IconCache.db
4 fichier(s) 2 189 657 octets
18 Rép(s) 39 556 100 096 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\NetworkService\Application Data

15/09/2006 14:45 <REP> .
15/09/2006 14:45 <REP> ..
05/03/2007 15:12 <REP> Intel
15/09/2006 14:45 <REP> Microsoft
0 fichier(s) 0 octets
4 Rép(s) 39 556 100 096 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data

15/09/2006 14:45 <REP> .
15/09/2006 14:45 <REP> ..
15/09/2006 14:45 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 39 556 100 096 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\WINDOWS\system32\config\systemprofile\Application Data

15/09/2006 14:44 <REP> .
15/09/2006 14:44 <REP> ..
05/03/2007 15:09 <REP> Adobe
05/03/2007 15:09 <REP> ATI
05/03/2007 15:09 <REP> Identities
05/03/2007 15:12 <REP> Intel
15/09/2006 14:44 <REP> Microsoft
05/03/2007 15:09 <REP> Sonic
05/03/2007 15:09 <REP> Symantec
05/03/2007 15:09 <REP> toshiba
05/03/2007 15:09 <REP> Windows Desktop Search
15/09/2006 14:44 62 desktop.ini
1 fichier(s) 62 octets
11 Rép(s) 39 556 100 096 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data

15/09/2006 14:44 <REP> .
15/09/2006 14:44 <REP> ..
05/03/2007 15:09 <REP> {3248F0A6-6813-11D6-A77B-00B0D0150060}
05/03/2007 15:09 <REP> Adobe
05/03/2007 15:09 <REP> ApplicationHistory
05/03/2007 15:09 <REP> ATI
15/09/2006 14:44 <REP> Microsoft
05/03/2007 15:09 137 fusioncache.dat
05/03/2007 15:09 19 744 GDIPFONTCACHEV1.DAT
05/03/2007 15:09 1 424 644 IconCache.db
3 fichier(s) 1 444 525 octets
7 Rép(s) 39 556 096 000 octets libres

******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks

C:\WINDOWS\Tasks\A25CC5A991CB7CA1.job
ÍE+øûêûC™ûo÷š×Œ_F à <
s "€!× 7 c : \ d o c u m e ~ 1 \ m a s e s s ~ 1 \ a p p l i c ~ 1 \ p l a t f o ~ 1 \ 1 6 N a m e O b j . e x e M A S E S S I O N 0 Ñ <
******************************************
## Répertoires de C:\Program Files

Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est C087-4E27

Répertoire de C:\Program Files

13/06/2007 13:20 <REP> .
13/06/2007 13:20 <REP> ..
25/03/2007 01:25 <REP> AC3Filter
05/05/2007 15:40 <REP> Activision
22/09/2006 13:48 <REP> Adobe
16/05/2007 17:05 <REP> Age of Mythology
18/03/2007 16:50 <REP> Ahead
26/05/2007 20:44 <REP> Alcohol Soft
21/03/2007 20:37 <REP> Apple Software Update
25/03/2007 01:18 <REP> AviSynth 2.5
07/06/2007 18:28 <REP> Bodom-Child
08/06/2007 19:43 <REP> BreakPoint Software
18/03/2007 13:19 <REP> CCleaner
18/03/2007 12:52 <REP> CleanUp!
02/06/2007 13:26 <REP> Codemasters
07/06/2007 15:40 <REP> Common Files
15/09/2006 14:36 <REP> ComPlus Applications
07/06/2007 18:12 <REP> ConTEXT
25/03/2007 01:20 <REP> DivX
18/03/2007 15:52 <REP> DVD Shrink
17/03/2007 23:29 <REP> DVD-RAM
02/06/2007 16:52 <REP> EA GAMES
22/05/2007 20:09 <REP> Eidos
03/06/2007 12:17 <REP> Electronic Arts
13/05/2007 20:31 <REP> Empire Earth II
25/03/2007 18:16 <REP> ESET
25/03/2007 02:38 <REP> Everstrike Software
25/03/2007 01:24 <REP> ffdshow
22/04/2007 11:16 <REP> Fichiers communs
27/05/2007 13:42 <REP> Final Fantasy VII Origin
23/05/2007 20:29 <REP> Firefly Studios
28/04/2007 19:32 <REP> Google
25/03/2007 01:22 <REP> Haali
21/04/2007 21:38 <REP> Hercules
07/06/2007 19:39 <REP> HView
02/06/2007 14:39 <REP> Id Software
05/03/2007 15:12 <REP> Intel
11/06/2007 20:47 <REP> Internet Explorer
22/09/2006 11:57 <REP> InterVideo
03/06/2007 15:20 <REP> Jardinains
15/09/2006 15:23 <REP> Java
09/06/2007 18:58 <REP> JPA
28/04/2007 17:19 <REP> Lavasoft
25/03/2007 02:26 <REP> LimeWire
29/03/2007 18:48 <REP> Lionhead Studios
22/04/2007 11:16 <REP> Logitech
05/03/2007 23:34 <REP> ltmoh
09/04/2007 00:27 <REP> Macromedia
05/03/2007 23:34 <REP> Messenger
05/06/2007 15:27 <REP> Messenger Plus! Live
22/04/2007 11:09 <REP> Microsoft Bootvis
05/03/2007 23:34 <REP> microsoft frontpage
16/04/2007 22:10 <REP> Microsoft Office
16/04/2007 22:09 <REP> Microsoft Visual Studio
16/04/2007 22:09 <REP> Microsoft Works
16/04/2007 22:08 <REP> Microsoft.NET
09/06/2007 19:55 <REP> MIKSOFT
14/04/2007 19:25 <REP> Mindscape
15/09/2006 14:38 <REP> Movie Maker
14/06/2007 13:54 <REP> Mozilla Firefox
09/05/2007 17:30 <REP> MSN
05/03/2007 23:34 <REP> MSN Gaming Zone
25/03/2007 16:31 <REP> MSN Messenger
22/09/2006 14:16 <REP> MSN Toolbar Suite
25/03/2007 02:43 <REP> MSXML 4.0
13/04/2007 23:47 <REP> netbeans-5.0
05/03/2007 23:34 <REP> NetMeeting
10/05/2007 21:33 <REP> NuMega
22/09/2006 13:52 <REP> Offre Wanadoo
15/04/2007 20:44 <REP> OLITEC
25/03/2007 01:24 <REP> On2 Technologies
05/03/2007 23:35 <REP> Online Services
24/03/2007 22:29 <REP> Outlook Express
25/03/2007 04:32 <REP> PLATFORM AXIS
28/03/2007 22:27 <REP> QuickTime Alternative
13/05/2007 21:26 <REP> RADVideo
11/06/2007 20:03 <REP> RamBoost XP
25/03/2007 01:22 <REP> Real Alternative
05/03/2007 23:35 <REP> Realtek
28/04/2007 17:19 <REP> RegCleaner
25/03/2007 01:18 <REP> Ripp-It Codec Pack
28/03/2007 22:32 <REP> Ripp-it_am
27/05/2007 15:12 <REP> Services en ligne
22/09/2006 12:11 <REP> Sonic
08/06/2007 14:39 <REP> SpeedFan
09/06/2007 18:29 <REP> Spybot - Search & Destroy
22/09/2006 10:24 <REP> Synaptics
22/04/2007 11:14 <REP> Toshiba
19/05/2007 17:26 <REP> TrackMania Nations ESWC
19/05/2007 17:32 <REP> Ubisoft
09/06/2007 19:07 <REP> VisualTooltip
09/04/2007 03:24 <REP> wamp
22/09/2006 14:17 <REP> Windows Desktop Search
11/05/2007 20:29 <REP> Windows Live Safety Center
28/03/2007 22:49 <REP> Windows Media Connect 2
25/03/2007 01:00 <REP> Windows Media Player
15/09/2006 14:35 <REP> Windows NT
15/09/2006 14:36 <REP> Windows Plus
05/05/2007 22:47 <REP> WinRAR
05/03/2007 23:37 <REP> X10 Hardware
25/03/2007 01:22 <REP> x264
05/03/2007 23:37 <REP> xerox
25/03/2007 01:22 <REP> Xvid
10/06/2007 01:32 <REP> Yod'm 3D
0 fichier(s) 0 octets
104 Rép(s) 39 556 091 904 octets libres

******************************************
## Popups autorisées

* Internet Explorer

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
cache.yacast.fr/ REG_BINARY
*.musicmatch.com REG_BINARY
webmessenger.msn.com/ REG_BINARY
*.live.com/ REG_BINARY
*.cams.com REG_BINARY
netbios-wait.com REG_SZ
www.netbios-wait.com REG_SZ
mysearchnow.com REG_SZ
www.mysearchnow.com REG_SZ

* Mozilla Firefox (1 autorisé 2 interdit)

---------- C:\DOCUMENTS AND SETTINGS\MA SESSION\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\58YXN1XH.DEFAULT\HOSTPERM.1

******************************************
## Registre

* [HKEY_CURRENT_USER\\Software\Microsoft\Internet Explorer\Main]
Search Bar REG_SZ http://www.google.com/toolbar/ie8/sidebar.html

* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Live Mpeg Less About REG_SZ C:\Documents and Settings\All Users\Application Data\axis show live mpeg\atom bend.exe

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
chinonce REG_SZ C:\DOCUME~1\MASESS~1\APPLIC~1\PLATFO~1\forroam.exe

******************************************
## Zones de sécurité

* HKCU Domains (4)

* P3P History (5)

******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"

*************** Fin du rapport ****************

Voila le log de Hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 18:50:03, on 14/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Documents and Settings\MA SESSION\Mes documents\Logiciels\Sécurité\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {69b29049-2d1e-4920-bdb5-f27020f3b4fa} - C:\WINDOWS\system32\exe2861.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9B14FF84-0E44-4754-8AB0-A37A42DC05DA} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Live Mpeg Less About] C:\Documents and Settings\All Users\Application Data\axis show live mpeg\atom bend.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [chinonce] C:\DOCUME~1\MASESS~1\APPLIC~1\PLATFO~1\forroam.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\fr-fr\msntabres.dll.mui/229?2237dd14d4c04700b56d3597d73310a8
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\fr-fr\msntabres.dll.mui/230?2237dd14d4c04700b56d3597d73310a8
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E4C8076-F80A-4C9A-A864-09B8B3D1EE5A}: NameServer = 213.36.80.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ddayxwv.dll
O20 - Winlogon Notify: exe2861 - C:\WINDOWS\SYSTEM32\exe2861.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
O20 - Winlogon Notify: ssqrrsq - ssqrrsq.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\apache2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Voila, voila.

Lyonnais92 · Answer

Re,

1) je voudrais avoir le rapport de vundofix

2) Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis. 
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu

3) Démarrer, panneau de configuration, ajout/suppression de programmes.

Tu cliques sur messenger plus! puis supprimer. Il va te demander si tu veux désinstaller le sponsor seulement, tu réponds oui. Tu suis les consignes. 
Tu fermes le panneau de configuration, et tu refais tourner lopxp. Tu posteras le nouveau rapport dans ta réponse.

4) Rends toi sur ce site :
http://www.virustotal.com/xhtml/virustotal_en.html

Clique sur parcourir et cherche ce fichier : C:\Documents and Settings\MA SESSION\Application Data	mp12C.tmp.exe

Clique sur send.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

5) Remets un nouveau rapport Hijckthis

(5 rapports vundofix, virtumundobegone, lopxp, virustotal et hijackthis)

6) Ote moi d'un doute, nod32 a un parefeu intégré ?

@+

Burning_sky_18 · Answer

Voila le rapport de vundofix : 


VundoFix V6.5.0

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 18:23:10 14/06/2007

Listing files found while scanning....

C:\windows\system32\cermat.dll
C:\windows\system32\ddayxwv.dll

Beginning removal...

 Attempting to delete C:\windows\system32\cermat.dll
C:\windows\system32\cermat.dll Has been deleted!

 Attempting to delete C:\windows\system32\ddayxwv.dll
C:\windows\system32\ddayxwv.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\windows\system32\ddayxwv.dll
C:\windows\system32\ddayxwv.dll Could not be deleted.

Performing Repairs to the registry.
Done!


Voila le rapport de 
VundoFix V6.5.0

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 18:30:33 14/06/2007

Listing files found while scanning....

C:\windows\system32\ddayxwv.dll

Beginning removal...

 Attempting to delete C:\windows\system32\ddayxwv.dll
C:\windows\system32\ddayxwv.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.0

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 18:34:44 14/06/2007

Listing files found while scanning....

C:\windows\system32\ddayxwv.dll

Beginning removal...

 Attempting to delete C:\windows\system32\ddayxwv.dll
C:\windows\system32\ddayxwv.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Voila le VBG.TXT :


[06/14/2007, 19:39:28] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\MA SESSION\Bureau\VirtumundoBeGone.exe" )
[06/14/2007, 19:39:32] - Detected System Information:
[06/14/2007, 19:39:32] -  Windows Version: 5.1.2600, Service Pack 2
[06/14/2007, 19:39:32] -  Current Username: MA SESSION (Admin)
[06/14/2007, 19:39:32] -  Windows is in NORMAL mode.
[06/14/2007, 19:39:32] - Searching for Browser Helper Objects:
[06/14/2007, 19:39:32] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[06/14/2007, 19:39:32] -  BHO 2: {2F85D76C-0569-466F-A488-493E6BD0E955} (dsWebAllowBHO Class)
[06/14/2007, 19:39:32] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[06/14/2007, 19:39:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:32] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[06/14/2007, 19:39:32] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[06/14/2007, 19:39:32] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[06/14/2007, 19:39:32] -  BHO 5: {69b29049-2d1e-4920-bdb5-f27020f3b4fa} ()
[06/14/2007, 19:39:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:32] -  Checking for HKLM\...\Winlogon\Notify\exe2861
[06/14/2007, 19:39:32] -  Found: HKLM\...\Winlogon\Notify\exe2861 - This is probably Virtumundo.
[06/14/2007, 19:39:32] -  Assigning {69b29049-2d1e-4920-bdb5-f27020f3b4fa} MSEvents Object
[06/14/2007, 19:39:32] - BHO list has been changed! Starting over...
[06/14/2007, 19:39:32] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[06/14/2007, 19:39:32] -  BHO 2: {2F85D76C-0569-466F-A488-493E6BD0E955} (dsWebAllowBHO Class)
[06/14/2007, 19:39:32] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[06/14/2007, 19:39:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:32] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[06/14/2007, 19:39:32] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[06/14/2007, 19:39:32] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[06/14/2007, 19:39:32] -  BHO 5: {69b29049-2d1e-4920-bdb5-f27020f3b4fa} (MSEvents Object)
[06/14/2007, 19:39:32] - ALERT: Found MSEvents Object!
[06/14/2007, 19:39:32] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[06/14/2007, 19:39:32] -  BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[06/14/2007, 19:39:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:32] -  No filename found. Continuing.
[06/14/2007, 19:39:32] -  BHO 8: {9B14FF84-0E44-4754-8AB0-A37A42DC05DA} ()
[06/14/2007, 19:39:32] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:32] -  No filename found. Continuing.
[06/14/2007, 19:39:32] -  BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[06/14/2007, 19:39:32] -  BHO 10: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Barre d'outils MSN Search Helper)
[06/14/2007, 19:39:32] - Finished Searching Browser Helper Objects
[06/14/2007, 19:39:32] - *** Detected MSEvents Object
[06/14/2007, 19:39:32] - Trying to remove MSEvents Object...
[06/14/2007, 19:39:33] -    Terminating Process: IEXPLORE.EXE
[06/14/2007, 19:39:34] -    Terminating Process: RUNDLL32.EXE
[06/14/2007, 19:39:34] -    Disabling Automatic Shell Restart
[06/14/2007, 19:39:34] -    Terminating Process: EXPLORER.EXE
[06/14/2007, 19:39:34] -    Suspending the NT Session Manager System Service
[06/14/2007, 19:39:34] -    Terminating Windows NT Logon/Logoff Manager
[06/14/2007, 19:39:35] -    Re-enabling Automatic Shell Restart
[06/14/2007, 19:39:35] -   File to disable: C:\WINDOWS\system32\exe2861.dll
[06/14/2007, 19:39:35] -  Renaming C:\WINDOWS\system32\exe2861.dll -> C:\WINDOWS\system32\exe2861.dll.vir
[06/14/2007, 19:39:35] - ! File rename was unsucessful.
[06/14/2007, 19:39:35] -  Attempting to Deny Access to C:\WINDOWS\system32\exe2861.dll
[06/14/2007, 19:39:35] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[06/14/2007, 19:39:35] -  ERROR: Le mappage entre les noms de compte et les ID de sécurité n'a pas été effectué.

[06/14/2007, 19:39:35] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[06/14/2007, 19:39:35] -   Removing HKLM\...\Browser Helper Objects\{69b29049-2d1e-4920-bdb5-f27020f3b4fa}
[06/14/2007, 19:39:35] -   Removing HKCR\CLSID\{69b29049-2d1e-4920-bdb5-f27020f3b4fa}
[06/14/2007, 19:39:35] -   Adding Kill Bit for ActiveX for GUID: {69b29049-2d1e-4920-bdb5-f27020f3b4fa}
[06/14/2007, 19:39:35] -   Deleting ATLEvents/MSEvents Registry entries
[06/14/2007, 19:39:35] -   Removing HKLM\...\Winlogon\Notify\exe2861
[06/14/2007, 19:39:35] - Searching for Browser Helper Objects:
[06/14/2007, 19:39:35] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[06/14/2007, 19:39:35] -  BHO 2: {2F85D76C-0569-466F-A488-493E6BD0E955} (dsWebAllowBHO Class)
[06/14/2007, 19:39:35] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[06/14/2007, 19:39:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:35] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[06/14/2007, 19:39:35] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[06/14/2007, 19:39:35] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[06/14/2007, 19:39:35] -  BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[06/14/2007, 19:39:35] -  BHO 6: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[06/14/2007, 19:39:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:35] -  No filename found. Continuing.
[06/14/2007, 19:39:35] -  BHO 7: {9B14FF84-0E44-4754-8AB0-A37A42DC05DA} ()
[06/14/2007, 19:39:35] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/14/2007, 19:39:35] -  No filename found. Continuing.
[06/14/2007, 19:39:35] -  BHO 8: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[06/14/2007, 19:39:35] -  BHO 9: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Barre d'outils MSN Search Helper)
[06/14/2007, 19:39:35] - Finished Searching Browser Helper Objects
[06/14/2007, 19:39:35] - Finishing up...
[06/14/2007, 19:39:35] - A restart is needed.
[06/14/2007, 19:39:43] - Attempting to Restart via STOP error (Blue Screen!)


Voila le nouveau rapport de Hijackthis :


Logfile of HijackThis v1.99.1
Scan saved at 19:48:22, on 14/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\MA SESSION\Mes documents\Logiciels\Sécurité\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {69b29049-2d1e-4920-bdb5-f27020f3b4fa} - C:\WINDOWS\system32\mscMRT.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9B14FF84-0E44-4754-8AB0-A37A42DC05DA} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32
vsysrot.dll,Enable
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Live Mpeg Less About] C:\Documents and Settings\All Users\Application Data\axis show live mpeg\atom bend.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [chinonce] C:\DOCUME~1\MASESS~1\APPLIC~1\PLATFO~1\forroam.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\fr-fr\msntabres.dll.mui/229?2237dd14d4c04700b56d3597d73310a8
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\fr-fr\msntabres.dll.mui/230?2237dd14d4c04700b56d3597d73310a8
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E4C8076-F80A-4C9A-A864-09B8B3D1EE5A}: NameServer = 213.36.80.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ddayxwv.dll
O20 - Winlogon Notify: exe2861 - exe2861.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
O20 - Winlogon Notify: mscMRT - C:\WINDOWS\SYSTEM32\mscMRT.dll
O20 - Winlogon Notify: ssqrrsq - ssqrrsq.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\apache2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe


Le rapport de Virus total sera prêt ds 15min

Nod32 ne dispose pas d'un parefeu, je me sert de celui de Windows

Burning_sky_18 · Answer

J'ai pris ce qu'il y avait dans la grille vu que j'ai pas eu de log :


AhnLab-V3 2007.6.12.2 06.14.2007                  no virus found 
AntiVir 7.4.0.32 06.14.2007                                no virus found 
Authentium 4.93.8 06.14.2007                          could be a corrupted executable file 
Avast 4.7.997.0 06.14.2007                                no virus found 
AVG 7.5.0.467 06.14.2007                                   no virus found 
BitDefender 7.2 06.14.2007                                no virus found 
CAT-QuickHeal 9.00 06.14.2007                         no virus found 
ClamAV devel-20070416 06.14.2007               no virus found 
DrWeb 4.33 06.14.2007                                        no virus found 
eSafe 7.0.15.0 06.14.2007                                  suspicious Trojan/Worm 
eTrust-Vet 30.7.3718 06.14.2007                     no virus found 
Ewido 4.0 06.14.2007                                           no virus found 
FileAdvisor 1 06.14.2007                                    no virus found 
Fortinet 2.85.0.0 06.14.2007                                  suspicious 
F-Prot 4.3.2.48 06.14.2007                                no virus found 
F-Secure 6.70.13030.0 06.14.2007                   no virus found 
Ikarus T3.1.1.8 06.14.2007                             no virus found 
Kaspersky 4.0.2.24 06.14.2007                     no virus found 
McAfee 5053 06.14.2007                               no virus found 
Microsoft 1.2503 06.14.2007                        no virus found 
NOD32v2 2329 06.14.2007                            no virus found 
Norman 5.80.02 06.14.2007                             no virus found 
Panda 9.0.0.4 06.14.2007                                no virus found 

la je dois me déconnecter je reviendrai sur le forum demain, encore merci pour ton aide.

Lyonnais92 · Answer

Bonjour,

à ton retour, pourrais tu recommencer la maneuvre Virus total avec 2 ou 3 de ces fichiers :
 tmp1660.tmp.exe 
  tmp178.tmp.exe 
  tmp1B5D.tmp.exe 
 tmp1BD.tmp.exe 
  tmp1E8.tmp.exe 
 tmp20D.tmp.exe 
 tmp247E.tmp.exe 

Ils sont tous dans le répertoire C:\Documents and Settings\MA SESSION\Application Data

Tu attends bien la fin du rapport . En particulier, tu dois avoir la taille du fichier et son MD5.
@+

Shdoclc.dll me télécharge des virus

8 réponses

Discussions similaires

Newsletters