infection msn Fermé

Question

Bonjour,g recu une demande dacceptation de fichier photo dun de mes contact msn probleme en louvrant c un virus g effectuer des analyses antivirus avec avast met il ne toruve rien g ossi utiliser avg anti spyware neant ossi...pouver vous maider g vu ke je ne suis pa le seul a etre contaminer par ce virus.merci de votre aide

O VertigO · Answer

Bonjour, 

- Télécharge MSNFix de !aur3n7 sur ton bureau http://sosvirus.changelog.fr/MSNFix.zip 
- Cliques droit dessus, extraire ici.
- Double cliques sur MSNFix.bat
- Choisis l'option R
- S'il trouve une infection, tu devras appuyer sur une touche.
- Poste le rapport MSNFix (qui se trouve dans le même répertoire que MSNFix.bat sous le format date_heure).
Remarque: voici le tutoriel: https://www.malekal.com/supprimer-virus-desinfecter-pc/ 

PUIS

- Télécharge HiJackThis de Merijn http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
- Installe le dans un dossier dédié (ou sur ton bureau).
- Accepte la licence
- Le programme va se lancer tout seul. Cliques sur "Main Menu" en bas de la fenêtre.
- Choisis l'option "Do a scan and Save a logfile"
- Copie Colle le log généré ci-dessous. 

Bonne journée !

Prisci · Answer

Bonjour, 

J'ai le meme soucis, voici le rapport de Hijack

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:14:23, on 28/09/2007
Platform: Windows Vista  (WinNT 6.00.1904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Common Files\AOL\1189094706\ee\aolsoftware.exe
C:\Windows\usnsvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\AOL 9.0 VR\waol.exe
C:\Windows\system32\conime.exe
C:\Program Files\AOL 9.0 VR\shellmon.exe
C:\Windows\system32\lnaccess.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\program files\aol\aol toolbar 4.0\AolTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Fred\Downloads\HiJackThis_v2.exe
C:\Users\Fred\Downloads\ccsetup200.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1189094706\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [usnsvc.exe] C:\Windows\usnsvc.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Instant Access] C:\Windows\system32\lnaccess.exe /res
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0esources\fr-FR\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\Windows\system32\Shdocvw.dll
O13 - Gopher Prefix: 
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcsvc.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\emdmgmt.dll,-1000 (EMDMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (Eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-200 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32
etman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
etprof.dll,-246 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32
lasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
sisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32asauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32asmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ipnathlp.dll,-106 (SharedAccess) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe
O23 - Service: @%SystemRoot%\system32\SLUINotify.dll,-103 (SLUINotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	apisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	bssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32	ermsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32	rkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\Windows\wanmpsvc.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

O VertigO · Answer

Salut prisci, 

Tu devrais créer ton propre sujet, car celui ci appartient a quelqu'un d'autre... Ensuite on pourra t'aider !

guez60 · Answer

virus toujours present avec hijack et msn fix komen faire....

O VertigO · Answer

Poste les rapports, c'est ce qui est demandé !

Tu ne dois rien faire d'HiJackThis avant que je te le demande !

guez60 · Answer

MSNFix 1.521  
 
C:\Documents and Settings\guez\Bureau\MSNFix 
Fix exécuté le 28/09/2007 - 15:11:50,95 By guez 
mode normal    
    
************************ Recherche les fichiers présents      
    
Aucun Fichier trouvé 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

guez60 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:16:51, on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\mdn.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
c:\progra~1\azureus\Azureus.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Machine Debug Mgr] mdn.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{568C2983-CCAF-402A-A9BB-9FC987C3F594}: NameServer = 86.64.145.144 84.103.237.144
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

O VertigO · Answer

Mouais... 

Pas fameux çà.. Tu l'as ouvert le fichier téléchargé ? Comment sais tu que c'est un virus ?
- Télécharge clean.zip http://www.malekal.com/download/clean.zip sur ton bureau.
- Fais Clic droit, extraire tout. 
- ATTENTION, Enregistre tout ce qui va suivre dans un fichier texte sur ton bureau car tu n'auras plus accès à internet en mode sans échec. 
- Redémarre en mode sans échec. Pour cela, après le bip d'allumage de ton PC, tapotes sur F8. Un menu va s'ouvrir, sélectionne "Mode sans échec".Quand tu y seras, regardes les instructions que tu as enregistré pour connaitre la suite. 
- Ouvre le dossier Clean sur ton bureau et double cliques sur clean.cmd
- Dans la fenêtre qui apparait, choisis l'option 2 et laisse le nettoyage commencer.

guez60 · Answer

g bien utiliser clean kom prevu voici le rapport.pour repondre a ta kestion plusieur fenetre de msn contact souvre et envoi  une demande de fichier photo a mes contact...Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 28/09/2007 a 16:08:41,23 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
 
*** Suppression des fichiers dans C:\Program Files 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

guez60 · Answer

le probleme es tjs la....ke faire svp...

O VertigO · Answer

C'est toi qui demande d'envoyer les fichiers donc ?

As tu toujours le fichier envoyé ?

guez60 · Answer

non la fentre msn souvre et envoi un fichier photo inconnu ke je nai pa sur mon pc...tout ce ke je pe te dire c kil sapel photo25....si ca pe taider....merci

O VertigO · Answer

Mais as tu le fichier original que tu as accepté et qui t'a mis le vers ?

guez60 · Answer

euh non je lai supprimer en pensan men debarasser tu kompren....

O VertigO · Answer

arf merde... dommage ! On va faire çà: 

- Télécharge Diaghelp.zip de Malekal_Morte http://www.malekal.com/download/DiagHelp.zip
- Cliques droit dessus et choisis extraire tout.
- Un nouveau dossier va être créé: DiagHelp
- Ouvre le et double cliques sur Go.cmd
- Choisis l'option 1
- Suis les instructions qui apparaissent, et appuies bien sur une touche quand demandé, après le rapport CatchMe. 
- Peut-etre que tu devras redémarrer ton ordinateur.
- Copie colle le rapport se trouve dans C:Resultat.txt ici.

guez60 · Answer

voici le rapport en esperan taider...DiagHelp version v1.2 - http://www.malekal.com excute le 28/09/2007 à 16:47:04,57 Liste des derniers fichies modifies/crees dans windir\system32 et prefetch C:\WINDOWS\prefetch\CHCP.COM-18156052.pf -->28/09/2007 16:46:59 C:\WINDOWS\prefetch\CMD.EXE-087B4001.pf -->28/09/2007 16:46:55 C:\WINDOWS\prefetch\WINRAR.EXE-39C6DAD9.pf -->28/09/2007 16:45:26 C:\WINDOWS\prefetch\VERCLSID.EXE-3667BD89.pf -->28/09/2007 16:45:25 C:\WINDOWS\prefetch\WLLOGINPROXY.EXE-2D4B6027.pf -->28/09/2007 16:45:08 C:\WINDOWS\prefetch\IEXPLORE.EXE-27122324.pf -->28/09/2007 16:44:58 C:\WINDOWS\prefetch\SETUP.OVR-154CE291.pf -->28/09/2007 16:30:13 C:\WINDOWS\prefetch\WUAUCLT.EXE-399A8E72.pf -->28/09/2007 16:30:11 C:\WINDOWS\prefetch\WMIPRVSE.EXE-28F301A9.pf -->28/09/2007 16:30:11 C:\WINDOWS\prefetch\WGATRAY.EXE-0ED38BED.pf -->28/09/2007 16:30:11 C:\WINDOWS\System32\drivers\aswmon.sys -->06/09/2007 12:05:25 C:\WINDOWS\System32\drivers\aswmon2.sys -->06/09/2007 12:05:10 C:\WINDOWS\System32\drivers\aswRdr.sys -->06/09/2007 12:03:02 C:\WINDOWS\System32\drivers\aswTdi.sys -->06/09/2007 12:02:20 C:\WINDOWS\System32\drivers\aavmker4.sys -->06/09/2007 12:00:53 C:\WINDOWS\System32\drivers\sptd.sys -->16/07/2007 21:21:37 C:\WINDOWS\System32\drivers\fetnd5bv.sys -->05/07/2007 06:33:54 C:\WINDOWS\System32\wpa.dbl -->28/09/2007 16:29:39 C:\WINDOWS\System32 vapps.xml -->28/09/2007 16:29:11 C:\WINDOWS\System32 mp.txt -->28/09/2007 16:25:55 C:\WINDOWS\System32 mp.reg -->28/09/2007 16:25:55 C:\WINDOWS\System32\WS2Fix.exe -->28/09/2007 14:26:50 C:\WINDOWS\System32\FNTCACHE.DAT -->26/09/2007 09:14:29 C:\WINDOWS\System32\mdn.exe -->24/09/2007 19:17:40 C:\WINDOWS\System32\BASSMOD.dll -->17/09/2007 18:46:58 C:\WINDOWS\System32\CONFIG.NT -->09/09/2007 11:04:02 C:\WINDOWS\System32\aswBoot.exe -->06/09/2007 12:09:49 C:\WINDOWS\System32\AVASTSS.scr -->06/09/2007 12:00:07 C:\WINDOWS\System32\MRT.exe -->06/09/2007 04:50:42 C:\WINDOWS\System32\VCCLSID.exe -->06/09/2007 00:22:23 C:\WINDOWS\System32\TZLog.log -->29/08/2007 23:20:39 C:\WINDOWS\System32\lhacm.acm -->29/08/2007 16:03:09 C:\WINDOWS\System32\sirenacm.dll -->16/08/2007 16:17:18 C:\WINDOWS\System32\jupdate-1.6.0_02-b06.log -->01/08/2007 13:03:54 C:\WINDOWS\System32\wuaucpl.cpl.mui -->30/07/2007 19:20:06 C:\WINDOWS\System32\wuapi.dll.mui -->30/07/2007 19:19:52 C:\WINDOWS\System32\wuaueng.dll -->30/07/2007 19:19:42 C:\WINDOWS\System32\wuapi.dll -->30/07/2007 19:19:36 C:\WINDOWS\System32\wucltui.dll -->30/07/2007 19:19:32 C:\WINDOWS\System32\wuweb.dll -->30/07/2007 19:19:28 C:\WINDOWS\System32\wuaucpl.cpl -->30/07/2007 19:19:28 C:\WINDOWS\System32\cdm.dll -->30/07/2007 19:19:20 C:\WINDOWS\ModemLog_Bluetooth Fax Modem.txt -->28/09/2007 16:29:42 C:\WINDOWS\ModemLog_Bluetooth DUN Modem.txt -->28/09/2007 16:29:42 C:\WINDOWS\ModemLog_Bluetooth DUN Modem #2.txt -->28/09/2007 16:29:42 C:\WINDOWS\0.log -->28/09/2007 16:29:22 C:\WINDOWS\wiadebug.log -->28/09/2007 16:29:19 C:\WINDOWS\WindowsUpdate.log -->28/09/2007 16:29:14 C:\WINDOWS\wiaservc.log -->28/09/2007 16:29:14 C:\WINDOWS\bootstat.dat -->28/09/2007 16:29:03 C:\WINDOWS\SchedLgU.Txt -->28/09/2007 16:28:13 C:\WINDOWS\setupact.log -->28/09/2007 16:25:59 C:\WINDOWS\setuperr.log -->28/09/2007 16:08:48 C:\WINDOWS tbtlog.txt -->28/09/2007 16:07:38 C:\WINDOWS\msnfix.txt -->28/09/2007 15:14:17 C:\WINDOWS\Sti_Trace.log -->28/09/2007 05:16:35 C:\WINDOWS\mngui.INI -->08/09/2007 16:26:34 MD5 des fichiers sensibles tcpip.sys b2220c618b42a2212a59d91ebd6fc4b4 ndis.sys 558635d3af1c7546d26067d5d9b6959e null.sys 73c1e1f395918bc2c6dd67af7591a3ad svchost.exe 1bd6c2f707a275cb7c16fd99fe0f31ca Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 98C3-1840 Répertoire de C:\WINDOWS\system32 10/08/2004 21:00 6 144 csrss.exe 1 fichier(s) 6 144 octets 0 Rép(s) 300 732 317 696 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 98C3-1840 Répertoire de C:\WINDOWS\Downloaded Program Files 26/09/2007 18:39 . 26/09/2007 18:39 .. 02/03/2007 14:49 1 443 408 banksht2.dll 09/04/2007 22:47 65 desktop.ini 25/07/2002 18:13 24 576 dwusplay.dll 25/07/2002 18:13 196 608 dwusplay.exe 13/04/2004 06:04 307 200 isusweb.dll 22/02/2007 23:41 304 544 MessengerStatsPAClient.dll 28/02/2007 14:21 130 472 MineSweeper.dll 20/06/2006 15:44 379 704 MsnPUpld.dll 19/06/2006 14:40 393 MsnPUpld.inf 30/07/2007 19:24 295 muweb.inf 20/06/2006 15:44 117 560 PURen-us.dll 28/02/2007 14:21 142 248 SolitaireShowdown.dll 11/06/2007 12:21 5 021 swflash.inf 19/02/2007 11:26 159 128 ZIntro.ocx 14 fichier(s) 3 211 222 octets Total des fichiers listés : 14 fichier(s) 3 211 222 octets 2 Rép(s) 300 732 313 600 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Export des clefs sensibles.. Liste des fichiers en exception sur le pare-feu XP SP2 "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus" "C:\Program Files\Bid For Power\quake3.exe"="C:\Program Files\Bid For Power\quake3.exe:*:Enabled:quake3" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\MotoRacer3\MotoRacer3.exe"="C:\Program Files\MotoRacer3\MotoRacer3.exe:*:Enabled:Moto Racer 3 PC" "C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server" "C:\Program Files\KONAMI\Winning Eleven 2007\we2007.exe"="C:\Program Files\KONAMI\Winning Eleven 2007\we2007.exe:*:Enabled:pes6.exe" "C:\Program Files\Eidos Interactive\Hothouse Creations\Gangsters 2\Gangsters2SpawnedVersion.exe"="C:\Program Files\Eidos Interactive\Hothouse Creations\Gangsters 2\Gangsters2SpawnedVersion.exe:*:Enabled:Gangsters 2" "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil" "C:\Program Files\KONAMI\Pro Evolution Soccer 6\PES6.exe"="C:\Program Files\KONAMI\Pro Evolution Soccer 6\PES6.exe:*:Enabled:pes6.exe" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" "C:\Program Files\EA SPORTS\FIFA 07\fifa07.exe"="C:\Program Files\EA SPORTS\FIFA 07\fifa07.exe:*:Enabled:fifa07" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "C:\mcoinstall.exe"="C:\mcoinstall.exe:*:Enabled:mcoinstall" "C:\Program Files\IncrediMail\bin\ImApp.exe"="C:\Program Files\IncrediMail\bin\ImApp.exe:*:Enabled:IncrediMail" "C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail" "C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail" "C:\Program Files\Bomberman Online International\BomberMan.exe"="C:\Program Files\Bomberman Online International\BomberMan.exe:*:Disabled:BomberMan" "C:\Program Files\Valve\Steam\SteamApps\guezmer666\condition zero\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\guezmer666\condition zero\hl.exe:*:Enabled:Half-Life Launcher" "C:\Program Files\Valve\Steam\SteamApps\guezmer666\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\guezmer666\counter-strike\hl.exe:*:Enabled:Half-Life Launcher" "C:\Program Files\Valve\Steam\SteamApps\guezmer666\condition zero deleted scenes\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\guezmer666\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe"="C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" Export de la clef SharedTaskScheduler [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" exports des policies REGEDIT4 [system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\ 63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\ 6d,73,73,74,79,6c,65,73,00 "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\ 73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00 Export des clefs sensibles.. Rechercher adresses sensibles dans le fichier HOSTS... catchme 0.3.1160 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-28 16:47:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:6c,95,70,58,02,49,d1,8e,5e,ff,ed,c7,fe,65,be,62,14,15,b0,3a,d5,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:cd,76,c6,22,1c,6c,d1,43,a6,9f,ca,87,25,27,9d,6a,52,94,22,35,7b,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,05,0f,60,33,b2,4b,0f,b8,0d,b4,27,2f,03,1e,76,37,fb,.. "khjeh"=hex:c1,2c,95,c7,d2,00,be,d0,20,77,71,c5,ff,fd,c6,28,39,e9,9f,89,14,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:93,4d,9c,db,4b,39,ee,a8,a7,f7,ef,e9,aa,61,29,d7,fd,07,75,2e,13,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:6c,95,70,58,02,49,d1,8e,5e,ff,ed,c7,fe,65,be,62,14,15,b0,3a,d5,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:cd,76,c6,22,1c,6c,d1,43,a6,9f,ca,87,25,27,9d,6a,52,94,22,35,7b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,05,0f,60,33,b2,4b,0f,b8,0d,b4,27,2f,03,1e,76,37,fb,.. "khjeh"=hex:c1,2c,95,c7,d2,00,be,d0,20,77,71,c5,ff,fd,c6,28,39,e9,9f,89,14,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:93,4d,9c,db,4b,39,ee,a8,a7,f7,ef,e9,aa,61,29,d7,fd,07,75,2e,13,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden services: 0 hidden files: 0 KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Process list by traversal of KiWaitListHead 4 - System 260 - ehSched.exe 280 - GoogleUpdaterSe 320 - ehtray.exe 560 - RTHDCPL.EXE 664 - svchost.exe 708 - ashDisp.exe 788 - csrss.exe 812 - winlogon.exe 860 - services.exe 872 - lsass.exe 920 - StarWindService 1032 - svchost.exe 1088 - svchost.exe 1128 - svchost.exe 1304 - msnmsgr.exe 1428 - ashServ.exe 1512 - avgas.exe 1556 - ctfmon.exe 1608 - explorer.exe 2020 - guard.exe 2072 - mcrdsvc.exe 2096 - dslmon.exe 2156 - GoogleUpdater.e 2624 - iexplore.exe 2784 - ashMaiSv.exe 2816 - ashWebSv.exe 2936 - dllhost.exe 3932 - cmd.exe Total number of processes = 29 NOTE: Under WinXP, this will not show all processes. KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg) Driver/Module list by traversal of PsLoadedModuleList 804D7000 - \WINDOWS\system32 tkrnlpa.exe 806E2000 - \WINDOWS\system32\hal.dll F7B10000 - \WINDOWS\system32\KDCOM.DLL F7A20000 - \WINDOWS\system32\BOOTVID.dll F7425000 - sptd.sys F7B12000 - \WINDOWS\System32\Drivers\WMILIB.SYS F740D000 - \WINDOWS\System32\Drivers\SCSIPORT.SYS F73DE000 - ACPI.sys F7610000 - isapnp.sys F7620000 - ohci1394.sys F7630000 - \WINDOWS\system32\DRIVERS\1394BUS.SYS F73CD000 - pci.sys F73BA000 - sfsync04.sys F7BD8000 - pciide.sys F7890000 - \WINDOWS\system32\DRIVERS\PCIIDEX.SYS F7B14000 - viaide.sys F7640000 - MountMgr.sys F739B000 - ftdisk.sys F7B16000 - dmload.sys F7375000 - dmio.sys F7898000 - PartMgr.sys F7650000 - VolSnap.sys F735D000 - atapi.sys F7660000 - disk.sys F7670000 - \WINDOWS\system32\DRIVERS\CLASSPNP.SYS F733D000 - fltMgr.sys F732B000 - sr.sys F78A0000 - PxHelp20.sys F7314000 - KSecDD.sys F7287000 - Ntfs.sys F725A000 - NDIS.sys F78A8000 - sfhlp02.sys F7246000 - sfdrv01a.sys F722B000 - Mup.sys F77F0000 - \SystemRoot\system32\DRIVERS\intelppm.sys F676B000 - \SystemRoot\system32\DRIVERS v4_mini.sys F6757000 - \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS F7800000 - \SystemRoot\system32\DRIVERS\imapi.sys F7810000 - \SystemRoot\system32\DRIVERS\cdrom.sys F7820000 - \SystemRoot\system32\DRIVERS edbook.sys F6734000 - \SystemRoot\system32\DRIVERS\ks.sys F7968000 - \SystemRoot\system32\DRIVERS\usbuhci.sys F6711000 - \SystemRoot\system32\DRIVERS\USBPORT.SYS F7970000 - \SystemRoot\system32\DRIVERS\usbehci.sys F7830000 - \SystemRoot\system32\DRIVERS\fetnd5bv.sys F66EC000 - \SystemRoot\system32\DRIVERS\HDAudBus.sys F7840000 - \SystemRoot\system32\DRIVERS ic1394.sys F6686000 - \SystemRoot\System32\Drivers\araqxeiy.SYS F6675000 - \SystemRoot\system32\DRIVERS\serial.sys F6B0F000 - \SystemRoot\system32\DRIVERS\serenum.sys F7C95000 - \SystemRoot\system32\DRIVERS\audstub.sys F7B38000 - \SystemRoot\System32\Drivers\RootMdm.sys F79D0000 - \SystemRoot\System32\Drivers\Modem.SYS F7850000 - \SystemRoot\system32\DRIVERS asl2tp.sys F6B0B000 - \SystemRoot\system32\DRIVERS distapi.sys F665E000 - \SystemRoot\system32\DRIVERS diswan.sys F7860000 - \SystemRoot\system32\DRIVERS aspppoe.sys F7870000 - \SystemRoot\system32\DRIVERS aspptp.sys F79D8000 - \SystemRoot\system32\DRIVERS\TDI.SYS F664D000 - \SystemRoot\system32\DRIVERS\psched.sys F7880000 - \SystemRoot\system32\DRIVERS\msgpc.sys F79E0000 - \SystemRoot\system32\DRIVERS\ptilink.sys F79E8000 - \SystemRoot\system32\DRIVERS aspti.sys F6509000 - \SystemRoot\system32\DRIVERS dpdr.sys F76A0000 - \SystemRoot\system32\DRIVERS ermdd.sys F79F0000 - \SystemRoot\system32\DRIVERS\kbdclass.sys F79F8000 - \SystemRoot\system32\DRIVERS\mouclass.sys F7A00000 - \SystemRoot\system32\drivers\SaiNtBus.sys F7B3A000 - \SystemRoot\system32\DRIVERS\swenum.sys F64B0000 - \SystemRoot\system32\DRIVERS\update.sys F6AEF000 - \SystemRoot\system32\DRIVERS\mssmbios.sys F76B0000 - \SystemRoot\System32\Drivers\NDProxy.SYS F7AF4000 - \SystemRoot\system32\DRIVERS\SaiMini.sys F76C0000 - \SystemRoot\system32\DRIVERS\HIDCLASS.SYS F7A10000 - \SystemRoot\system32\DRIVERS\HIDPARSE.SYS F7AF8000 - \SystemRoot\system32\DRIVERS\mouhid.sys F7AFC000 - \SystemRoot\system32\DRIVERS\kbdhid.sys F76D0000 - \SystemRoot\system32\DRIVERS\usbhub.sys F7B3E000 - \SystemRoot\system32\DRIVERS\USBD.SYS F39CD000 - \SystemRoot\system32\drivers\RtkHDAud.sys F39AB000 - \SystemRoot\system32\drivers\portcls.sys F76E0000 - \SystemRoot\system32\drivers\drmk.sys F7B42000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS F7C9C000 - \SystemRoot\System32\Drivers\Null.SYS F7B44000 - \SystemRoot\System32\Drivers\Beep.SYS F7C9D000 - \SystemRoot\System32\DRIVERS\AvgAsCln.sys F7908000 - \SystemRoot\System32\drivers\vga.sys F7B46000 - \SystemRoot\System32\Drivers\mnmdd.SYS F7B48000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys F7910000 - \SystemRoot\System32\Drivers\Msfs.SYS F7918000 - \SystemRoot\System32\Drivers\Npfs.SYS F649C000 - \SystemRoot\system32\DRIVERS asacd.sys F3928000 - \SystemRoot\system32\DRIVERS\ipsec.sys F38CF000 - \SystemRoot\system32\DRIVERS cpip.sys F7700000 - \SystemRoot\System32\Drivers\aswTdi.SYS F38AE000 - \SystemRoot\system32\DRIVERS\ipnat.sys F3886000 - \SystemRoot\system32\DRIVERS etbt.sys F7710000 - \SystemRoot\system32\DRIVERS\wanarp.sys F3864000 - \SystemRoot\System32\drivers\afd.sys F7720000 - \SystemRoot\system32\DRIVERS\arp1394.sys F7730000 - \SystemRoot\system32\DRIVERS etbios.sys F3839000 - \SystemRoot\system32\DRIVERS dbss.sys F37CA000 - \SystemRoot\system32\DRIVERS\mrxsmb.sys F7740000 - \SystemRoot\System32\Drivers\Fips.SYS F7D1D000 - \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys F7928000 - \SystemRoot\System32\Drivers\Aavmker4.SYS F3E40000 - \SystemRoot\system32\DRIVERS\hidusb.sys F7950000 - \SystemRoot\system32\DRIVERS\USBSTOR.SYS F7980000 - \SystemRoot\system32\DRIVERS\usbccgp.sys F3661000 - \SystemRoot\system32\DRIVERS\adiusbaw.sys F77A0000 - \SystemRoot\System32\Drivers\Cdfs.SYS F3649000 - \SystemRoot\System32\Drivers\dump_atapi.sys F7B52000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS BF800000 - \SystemRoot\System32\win32k.sys F39A3000 - \SystemRoot\System32\drivers\Dxapi.sys F7990000 - \SystemRoot\System32\watchdog.sys BF9C3000 - \SystemRoot\System32\drivers\dxg.sys F7C85000 - \SystemRoot\System32\drivers\dxgthk.sys BF9D5000 - \SystemRoot\System32 v4_disp.dll BFFA0000 - \SystemRoot\System32\ATMFD.DLL BADA0000 - \SystemRoot\system32\DRIVERS disuio.sys BAC0A000 - \SystemRoot\System32\Drivers\aswMon2.SYS B99AD000 - \SystemRoot\system32\DRIVERS\mrxdav.sys B98D0000 - \SystemRoot\system32\drivers\wdmaud.sys F7780000 - \SystemRoot\system32\drivers\sysaudio.sys B9831000 - \SystemRoot\system32\DRIVERS\atksgt.sys B9596000 - \SystemRoot\System32\Drivers\HTTP.sys F7900000 - \SystemRoot\system32\DRIVERS\lirsgt.sys B9454000 - \SystemRoot\system32\DRIVERS\srv.sys F7920000 - \SystemRoot\system32\DRIVERS\secdrv.sys B9020000 - \SystemRoot\System32\Drivers\aswRdr.SYS F7D2C000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys Total number of drivers = 132 Liste des programmes installes HijackThis 2.0.2 Navilog1 3.1.2 Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 98C3-1840 Répertoire de C:\Program Files 28/09/2007 15:46 . 28/09/2007 15:46 .. 25/09/2007 19:38 Adobe 10/04/2007 05:12 ADSL Autoconnect 10/04/2007 05:16 Ahead 17/07/2007 20:58 Alcohol Soft 10/04/2007 12:59 Alwil Software 27/09/2007 22:25 a-squared Free 05/09/2007 17:08 Azureus 10/04/2007 05:25 CCleaner 09/04/2007 23:57 Cegetel 28/06/2007 17:51 Common Files 10/04/2007 12:28 Creative 17/05/2007 15:48 directx 16/06/2007 15:47 Disc2Phone 28/09/2007 05:21 eMule 26/09/2007 20:53 Fichiers communs 10/04/2007 00:20 Google 26/09/2007 21:04 Grisoft 18/06/2007 20:35 inKline Global 15/08/2007 17:38 Internet Explorer 01/08/2007 13:03 Java 10/04/2007 00:01 Kit ADSL 27/09/2007 19:21 Messenger 26/09/2007 10:07 Messenger Plus! Live 10/07/2007 21:33 Micro Application 26/09/2007 17:29 Microsoft CAPICOM 2.1.0.2 09/04/2007 22:53 microsoft frontpage 28/04/2007 22:25 Microsoft Office 09/04/2007 22:46 Movie Maker 28/06/2007 19:03 MSBuild 09/04/2007 22:43 MSN Gaming Zone 15/08/2007 16:30 MSXML 4.0 28/06/2007 19:05 MSXML 6.0 28/09/2007 16:02 Navilog1 09/04/2007 22:46 NetMeeting 09/04/2007 22:44 Online Services 13/06/2007 05:08 Outlook Express 28/06/2007 19:00 Reference Assemblies 19/08/2007 22:56 ReflexiveArcade 18/08/2007 15:01 RegCleaner 09/04/2007 23:57 SAGEM 30/04/2007 19:45 Saitek 09/04/2007 22:47 Services en ligne 16/06/2007 15:48 Sony Ericsson 26/09/2007 21:00 Sophos 08/08/2007 19:56 Spybot - Search & Destroy 29/08/2007 16:56 Teamspeak2_RC2 28/09/2007 15:14 Trend Micro 25/09/2007 19:29 Ubisoft 01/09/2007 15:05 Valve 30/06/2007 14:35 VideoLAN 26/09/2007 09:37 Windows Live 27/09/2007 19:21 Windows Media Connect 2 10/04/2007 12:57 Windows Media Player 09/04/2007 22:42 Windows NT 09/04/2007 22:44 Windows Plus 14/06/2007 05:04 WinRAR 09/04/2007 22:53 xerox 0 fichier(s) 0 octets 59 Rép(s) 300 732 461 056 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 98C3-1840 Répertoire de C:\Program Files\fichiers communs 26/09/2007 20:53 . 26/09/2007 20:53 .. 26/09/2007 20:39 Adobe 10/04/2007 05:16 Ahead 24/08/2007 12:35 BinarySense 18/04/2007 19:32 Everstrike Software 21/06/2007 13:40 InstallShield 09/04/2007 22:51 Java 26/09/2007 09:34 Microsoft Shared 09/04/2007 22:46 MSSoap 10/04/2007 00:38 ODBC 09/04/2007 22:46 Services 10/04/2007 00:38 SpeechEngines 10/04/2007 14:06 Symantec Shared 13/06/2007 05:08 System 16/06/2007 15:49 Teleca Shared 0 fichier(s) 0 octets 16 Rép(s) 300 732 461 056 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 98C3-1840 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 09/04/2007 23:03 . 09/04/2007 23:03 .. 18/05/2001 15:57 561 209 MSONSEXT.DLL 03/06/1999 12:09 122 937 MSOWS409.DLL 07/03/2001 07:00 127 033 MSOWS40c.DLL 3 fichier(s) 811 179 octets 2 Rép(s) 300 732 456 960 octets libres Le volume dans le lecteur C n'a pas de nom. Le numéro de série du volume est 98C3-1840 Répertoire de C:\Program Files\common files 28/06/2007 17:51 . 28/06/2007 17:51 .. 28/06/2007 17:51 EasyInfo 0 fichier(s) 0 octets 3 Rép(s) 300 732 456 960 octets libres c:\Documents and Settings\guez\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix.exe c:\Documents and Settings\guez\Bureau\clean\pskill.exe c:\Documents and Settings\guez\Bureau\DiagHelp\catchme.exe c:\Documents and Settings\guez\Bureau\DiagHelp\diff.exe c:\Documents and Settings\guez\Bureau\DiagHelp\dumphive.exe c:\Documents and Settings\guez\Bureau\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\guez\Bureau\DiagHelp\find2.exe c:\Documents and Settings\guez\Bureau\DiagHelp\Fport.exe c:\Documents and Settings\guez\Bureau\DiagHelp\grep.exe c:\Documents and Settings\guez\Bureau\DiagHelp\KProcCheck.exe c:\Documents and Settings\guez\Bureau\DiagHelp\LFiles.exe c:\Documents and Settings\guez\Bureau\DiagHelp\LISTDLLS.exe c:\Documents and Settings\guez\Bureau\DiagHelp\md5sums.exe c:\Documents and Settings\guez\Bureau\DiagHelp\pslist.exe c:\Documents and Settings\guez\Bureau\DiagHelp\streams.exe c:\Documents and Settings\guez\Bureau\DiagHelp\swreg.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\dumphive.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\exit.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\GenericRenosFix.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\HostsChk.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\Process.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\Reboot.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix estart.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\SmiUpdate.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\SrchSTS.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\swreg.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\swsc.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\swxcacls.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\unzip.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\VCCLSID.exe c:\Documents and Settings\guez\Bureau\SmitfraudFix\WS2Fix.exe c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\DEPANN\_ISDEL.EXE c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\DEPANN\REGOCX32.EXE c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\DEPANN\SETUP.EXE c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\SETUP\_ISDEL.EXE c:\Documents and Settings\guez\Mes documents\programmes\cv lettre motiv\CV et lettre de motivation\SETUP\SETUP.EXE c:\Documents and Settings\All Users\Application Data\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\guez\Application Data\Microsoft\IdentityCRL\Production\ppcrlconfig.dll c:\Documents and Settings\guez\Application Data\Microsoft\IdentityCRL\Production\ppcrlui.dll c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll ****** Fin du rapport DiagHelp

guez60 · Answer

suite au rapport ai je tjs le ver?

O VertigO · Answer

Euh va me falloir un pti moment pour analyser ca... 
;o)

A biento

O VertigO · Answer

Tu possèdes Avast!, tu n'es donc pas, pour moi et beaucoup d'autres helpers, protégé au mieux. Je te recommande d'en changer pour Avira Antivir, qui est beaucoup plus performant et réactif. Le petit défaut est qu'il est en anglais, c'est pourquoi voici deux liens qui t'aideront à en changer sans problème: 
- Tutoriel: http://forum.malekal.com/ftopic4192.php
- Comparatif de Malekal: http://forum.malekal.com/ftopic3528.php
Désinstalle Avast! avant d'installer Avira Antivir !

Fais un scan avec antivir A JOUR et poste le rapport...

céline · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:21:33, on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAME.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\usnsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PCDrProfiler] "C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe" -r
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ps2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [EPSON Stylus Photo RX640 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAME.EXE /P31 "EPSON Stylus Photo RX640 Series" /O6 "USB001" /M "Stylus Photo RX640"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [usnsvc.exe] C:\WINDOWS\usnsvc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Crystal.lnk = ?
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{B23B7734-9E2D-4754-96B7-AAA13FE29C5A}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

O VertigO · Answer

Ok... Chui con ! 

J'ai pas vu l'éléphant dans le magasin de porcelaine... 

1. Processus
- Ouvre le gestionnaire de tâches. 
- Sous l'onglet processus, cliques sur MDN.EXE et termine le. 

2. Regedit
- Ouvre l'éditeur de registre: démarrer / exécuter / Regedit
- Dans le panneau de gauche, rends toi là: HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run
- Dans la colonne de droite qui s'affiche, supprime ceci: MDN = "MDN.exe"
- Ensuite, dans le panneau de gauche, rends toi là: HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
- Dans la colonne de droite qui s'affiche, supprime ceci: MDN = "MDN.exe"
- Ferme l'éditeur de registre. 

3. Fichiers cachés
- Ouvre le poste de travail / Outil / Option des dossiers / Affichage / Cliques sur afficher les fichiers et dossiers cachés
- Cherches C:\WINDOWS\system32\mdn.exe  et supprime le. 

4. Scans
- Refais un scan avec Antivir
- Poste le rapport
- Refais un scan HiJackThis et poste le rapport. 

Bon courage !

Infection msn

21 réponses

Discussions similaires