Contaminé par dance dec sur msn Résolu

Question

Bonjour,
aidez moi svp!!! Marre de ces virus...lol 
Est ce que quelqu'un pourrait m'aider svp!? J'ai eu le malheur d'accepter un fichier zip nommé dance dec avec comme message ma soeur voulait que tu regarde ça. Et maintenant a chaque fois que je me connecte a msn sur mon pc, il envoi ce message et donc ce virus a tout mes contacts qui sont connecté, bref... j'ai besoin d'aide! merci d'avance pour celui ou celle qui pourra m'aider a m'en débarrasser.

nico · Answer

Bonjour, 
il faut suprimet le ficher et faire une recherche sur le pc pour etre sur qu il n y et plus

Reila · Answer

Bonjour, 
J'ai ce problème depuis 3heures maintenant, et c'est plutôt agaçant.
Je me suis baladée sur d'autres forums pour voir si il conseillait quelque chose : j'ai fait tout ce qu'il s disait.. Et j'ai toujours ce virus!
c'est insupportable, mais j'ai peut-être fait quelque chose qui ne fallait pas : j'ai supprimé le fichier, après avoir ouvert ce qu'il y avait à l'interieur. Du coup j'ai plus le dossier d'origine é_è
On m'a dit de changer de mot de passe, pour voir si ça marchait, et résultat : non! je l'ai toujours, bref je me demandais si, si je désinstallais et réinstallais MSN, il serait toujours là?
J'ai fait plein de scan antivirus, et rien n'a été détécté.

Merci :S

vivi59 · Answer

moi aussi j'ai besoin d'aide j'ai reçu aujourd'hui ce même virus "dance"

Megan Fox · Answer

Bonjour tout le monde,


Ce post a été crée par Guicath*, pour tous les autres il faudrait crée son propre sujet svp.


Télécharge MSNFix.zip (de !aur3n7) sur ton bureau:
http://sosvirus.changelog.fr/MSNFix.zip

Décompresse-le (clic droit >> Extraire ici) et place les fichiers dans C:\MSNFix (très important).

Double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt
Copie/colle le rapport sur le forum

ensuite

* Télécharge HijackThis ici:
http://telechargement.zebulon.fr/138-hijackthis-1991.html

Dézippe le dans un dossier prévu à cet effet.
Par exemple C:\hijackthis < Enregistre-le bien dans c : !
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/Hijenr.gif

Lance le puis:
Clique sur "do a system scan and save logfile" (cf démo)
Faire un copier coller du log entier sur le forum

Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/demohijack.htm

A+

Kalisonever · Answer

Bonjour, 
Copie du rapport de msn fix, je viens de le faire! merci pour votre aide!

MSNFix 1.574  
 
C:\MSNFix\MSNFix 
Fix exécuté le 11/11/2007 - 22:50:09,89 By Yoyox 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\PROGRA~2\MICROS~1\Windows\STARTM~1\carlton 
... C:\Program Files\Common Files\Carlson\carlton 
... C:\ir-1-1148.exe 
... C:\p6g7j3w2g3f5.exe 
... C:\Windows\ccSvcHst.exe 
... C:\Windows\Dance_dec_jpg.zip 
... C:\Windows\mrofinu*.exe 
... C:\Windows\system32\microsoft\backup.ftp 
... C:\Windows\Dance_dec_jpg.zip 

************************  MSNCHK ***** /!\ beta test /!\

[!] C:\Windows\Dance_dec_jpg.zip is INFECTED

 
************************ Recherche les dossiers présents       
 
... C:\Program Files\Common Files\Carlson\ 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\PROGRA~2\MICROS~1\Windows\STARTM~1\carlton  
.. OK ... C:\Program Files\Common Files\Carlson\carlton  
.. OK ... C:\ir-1-1148.exe  
.. OK ... C:\p6g7j3w2g3f5.exe  
/!\ ...  C:\Windows\ccSvcHst.exe   
.. OK ... C:\Windows\Dance_dec_jpg.zip  
/!\ ...  C:\Windows\mrofinu*.exe   
.. OK ... C:\Windows\system32\microsoft\backup.ftp  
.. OK ... C:\ir-1-1148.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\Windows\Dance_dec_jpg.zip 
 
 
************************ Suppression des dossiers       
 
.. OK ... C:\Program Files\Common Files\Carlson\   
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\Windows\ccSvcHst.exe  
.. OK ... C:\Windows\mrofinu*.exe  
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 11112007_22564612.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

naf · Answer

Bonjour, 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:02:57, on 11/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Neuf\Kit\WiFi\9wifi.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Calendrier\Cld2000.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\le henaff\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe /normal-run2
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] "C:\Program Files\Neuf\Kit\WiFi\9wifi.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AnumanLive] C:\Documents and Settings\le henaff\Application Data\Anuman Interactive\AnumanLive\AnumanLive.exe
O4 - HKCU\..\Run: [BitComet] C:\Program Files\BitComet\BitComet.exe /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

Kalisonever · Answer

Copie du log de Hijackthis, espèrons que tout aille bien pour mon msn maintenant! merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:43, on 11/11/2007
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Windows\system32\SearchFilterHost.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Nvrdrormport - NVIDIA Corporation - (no file)
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

mecstras · Answer

Bonjour, 

j'ai suivi tous vos conseils mais après le redémarrage il relance la recherche et affiche "service bloqué".........
et là, on fait quoi?????

Guicath* · Answer

Slt  Megan Fox !
Je viens de téléchargé MSNfix et voici le rapport:

MSNFix 1.575  
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix 
Fix exécuté le lun. 12/11/2007 - 12:35:45,71 By Thys Guillaume 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\Program Files\Fichiers communs\Carlson\carlton 
... C:\PROGRA~1\Temporary\wininstall.exe 
... C:\3d3t4t8n7l.exe 
... C:\ir-1-1148.exe 
... C:\p6g7j3w2g3f5.exe 
... C:\WINDOWS\b???.exe 
... C:\WINDOWS\b122.exe 
... C:\WINDOWS\ccSvcHst.exe 
... C:\WINDOWS\Dance_dec_jpg.zip 
... C:\WINDOWS\mrofinu*.exe 
... C:\WINDOWS\msnimport.exe 
... C:\WINDOWS\system32\drivers\oreans32.sys 
... C:\WINDOWS\system32\microsoft\backup.ftp 
... C:\WINDOWS\system32\microsoft\backup.tftp 
... C:\WINDOWS\Dance_dec_jpg.zip 

************************  MSNCHK ***** /!\ beta test /!\

[!] C:\WINDOWS\Dance_dec_jpg.zip is INFECTED

 
************************ Recherche les dossiers présents       
 
... C:\Program Files\Fichiers communs\Carlson\ 
... C:\PROGRA~1\Temporary\ 
... C:\PROGRA~1\WinAble\ 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\Program Files\Fichiers communs\Carlson\carlton  
.. OK ... C:\PROGRA~1\Temporary\wininstall.exe  
.. OK ... C:\3d3t4t8n7l.exe  
.. OK ... C:\ir-1-1148.exe  
.. OK ... C:\p6g7j3w2g3f5.exe  
.. OK ... C:\WINDOWS\b???.exe  
.. OK ... C:\WINDOWS\b122.exe  
/!\ ...  C:\WINDOWS\ccSvcHst.exe   
.. OK ... C:\WINDOWS\Dance_dec_jpg.zip  
/!\ ...  C:\WINDOWS\mrofinu*.exe   
.. OK ... C:\WINDOWS\msnimport.exe  
.. OK ... C:\WINDOWS\system32\drivers\oreans32.sys  
.. OK ... C:\WINDOWS\system32\microsoft\backup.ftp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.tftp  
.. OK ... C:\ir-1-1148.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\WINDOWS\Dance_dec_jpg.zip 
 
 
************************ Suppression des dossiers       
 
.. OK ... C:\Program Files\Fichiers communs\Carlson\   
.. OK ... C:\PROGRA~1\Temporary\   
.. OK ... C:\PROGRA~1\WinAble\   
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\WINDOWS\ccSvcHst.exe  
.. OK ... C:\WINDOWS\mrofinu*.exe  
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier lun. 12112007_12404320.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

Guicath* · Answer

Et voici le rapport avec Hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:42, on 12/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Belkin\Logiciel Bluetooth\bin\btwdins.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Packard Bell\SrvCDEject.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Belkin\Logiciel Bluetooth\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.fr.msn.be/0SEFRBE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [DriveIcons] "C:\Program Files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe"
O4 - HKLM\..\Run: [NECHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Belkin\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\befr.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-f5b08253bcdd8e67.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SrvCDEject - Unknown owner - C:\Program Files\Packard Bell\SrvCDEject.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

Guicath* · Answer

Voilà et maintenant? C fini???
J'attends la suite avec impatience lol si sa peut me débarrasser de cette merd...!
A bientôt...

Guicath* · Answer

Merci!!!! Je sais pas si il fallait que je fasse encore quelque choses, mais sa va faire 1h1/2 que je suis connecté a msn et rien!!!!

Megan Fox · Answer

salut  Guicath*,

C'est pas trop mal.


* Relance HijackThis.

Choisis Do a scan only

Coche la case devant les lignes suivantes

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Clique sur fix checked.

Ferme Hijackthis.


--------------------------------------------------

Recherche et supprimes ce fichier:

-C:\Windows\ALCMTR.EXE


--------------------------------------------------

On va faire un petit scan en ligne:

* Fait un scan antivirus en ligne avec Internet Explorer
www.bitdefender.com/scan8/ie.html
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
* Dans la nouvelle fenêtre, clique sur I agree
* La fenêtre change encore, clique sur Click here to scan
* Les signatures se chargent, etc.

tuto en image

http://pageperso.aol.fr/rginformatique/mapage/defender.htm


--------------------------------------------------

Quel est ton pare-feu ?


A+

Mirab3ll3 · Answer

Bonjour, 
Pour pouvoir enlever ce virus (c'est comme moi j'ai fait) vous aller dans démarrer, rechercher, tous les dossiers
Puis vous tapez danc_dec_jpg dans la barre.Normalement il doit le trouver.Ensuite clique droit sur les fichier, supprimer, puis vider ma corbeille.Si ca ne marche pas recommencer l'operation plusieurs fois

Guicath* · Answer

ok, je vais faire ce que tu m'as dis megan fox.
a tout de suite 
mon pare-feu c celui que j'ai eu avec windows...

Guicath* · Answer

Tu ma's dit de rechercher  puis de le supprimer le fichier c:/windows/ALCMTR.EXE mais je le trouve pas...

yannickouaf · Answer

Bonjour, 
Je n'ai pas tout lu , mais j'ai reçu aussi ce fichier "dance dec" hier 4 fois de deux contacts différents.
En allant sur Secuser , j'ai trouvé le remède !!!
Il ne suffit pas de le supprimer d'un simple clic :y'a la base de registre qui est infectée aussi alors à moins d'être un pro et de le faire "à la main "....
ça prend 3 min chrono . 

http://www.secuser.com/alertes/2007/sdbotcha_dance_dec_jpg.htm

il faut télécharger msnfix ici  : http://www.secuser.com/telechargement/index.htm#MSNFix
et hop vous lancez , il fait tout tout seul 3 min maxi et y'a plus de Bobo .
plus de fichier infecté , plus de lancement de fichier via msn à mes contacts depuis.
Bon courage à tous , et surtout : PREVENEZ vos contacts !!!qu'ils n'acceptent pas les fichiers .zip de ce type .

Guicath* · Answer

Et voici le résultat de bitdefender:



BitDefender Online Scanner
  
  
 
Scan report generated at: Mon, Nov 12, 2007 - 18:24:25
 
 
  
  
 
Scan path: C:\;D:\;
  
  
 
 
  
  
 
Statistics
 
Time
 00:28:18
 
Files
 225776
 
Folders
 7350
 
Boot Sectors
 3
 
Archives
 7360
 
Packed Files
 12693
 
  
  
 
Results
 
Identified Viruses 
 5
 
Infected Files 
 18
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 18
 
  
  
 
Engines Info
 
Virus Definitions
 868655
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 14
 
Archive plugins
 38
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 1
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)=>zlib_nsis0001
 Infected with: Trojan.Hotbar.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)=>zlib_nsis0001
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)=>zlib_nsis0001
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)
 Update failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)=>zlib_nsis0006=>(NSIS g)=>zlib_nsis0001
 Infected with: Trojan.Hotbar.A
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)=>zlib_nsis0006=>(NSIS g)=>zlib_nsis0001
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)=>zlib_nsis0006=>(NSIS g)=>zlib_nsis0001
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3FF2247A.exe=>(Quarantine-2)=>(NSIS o)=>lzma_nsis0017=>(NSIS o)=>zlib_nsis0006=>(NSIS g)
 Update failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temp\Répertoire temporaire 1 pour Dance_dec_jpg.zip\www.Dance_dec_jpg_Msn.com
 Infected with: Backdoor.SdBot.DFAB
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temp\Répertoire temporaire 1 pour Dance_dec_jpg.zip\www.Dance_dec_jpg_Msn.com
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temp\Répertoire temporaire 1 pour Dance_dec_jpg.zip\www.Dance_dec_jpg_Msn.com
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temp\Répertoire temporaire 2 pour Dance_dec_jpg.zip\www.Dance_dec_jpg_Msn.com
 Infected with: Backdoor.SdBot.DFAB
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temp\Répertoire temporaire 2 pour Dance_dec_jpg.zip\www.Dance_dec_jpg_Msn.com
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temp\Répertoire temporaire 2 pour Dance_dec_jpg.zip\www.Dance_dec_jpg_Msn.com
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\MFQL9SYS\dual[1].jpg
 Infected with: MemScan:Trojan.Dialer.VUY
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\MFQL9SYS\dual[1].jpg
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\17PHolmes[1].cmt
 Infected with: Trojan.Generic.69276
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\17PHolmes[1].cmt
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\17PHolmes[1].cmt
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/3d3t4t8n7l.exe
 Infected with: MemScan:Trojan.Dialer.VUY
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/3d3t4t8n7l.exe
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/carlton
 Infected with: MemScan:Trojan.Dialer.VUY
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/carlton
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/ccSvcHst.exe
 Infected with: Backdoor.SdBot.DFAB
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/ccSvcHst.exe
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/ccSvcHst.exe
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/Dance_dec_jpg.zip=>www.Dance_dec_jpg_Msn.com
 Infected with: Backdoor.SdBot.DFAB
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/Dance_dec_jpg.zip=>www.Dance_dec_jpg_Msn.com
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/Dance_dec_jpg.zip=>www.Dance_dec_jpg_Msn.com
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/Dance_dec_jpg.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/ir-1-1148.exe
 Infected with: Trojan.Generic.69783
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/ir-1-1148.exe
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/ir-1-1148.exe
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/mrofinu1148.exe
 Infected with: Trojan.Generic.69276
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/mrofinu1148.exe
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/mrofinu1148.exe
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/p6g7j3w2g3f5.exe
 Infected with: MemScan:Trojan.Dialer.VUY
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip=>backup/p6g7j3w2g3f5.exe
 Deleted
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\RIQC28YX\MSNFix[2]\MSNFix\lun. 12112007_12404320.zip
 Updated
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\Y7HSE62D\wr-1-1148[1].jpg
 Infected with: Trojan.Generic.69783
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\Y7HSE62D\wr-1-1148[1].jpg
 Disinfection failed
 
C:\Documents and Settings\Thys Guillaume\Local Settings\Temporary Internet Files\Content.IE5\Y7HSE62D\wr-1-1148[1].jpg
 Deleted
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016418.exe
 Infected with: Trojan.Generic.69783
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016418.exe
 Disinfection failed
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016418.exe
 Deleted
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016430.exe
 Infected with: MemScan:Trojan.Dialer.VUY
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016430.exe
 Deleted
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016443.exe
 Infected with: Backdoor.SdBot.DFAB
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016443.exe
 Disinfection failed
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016443.exe
 Deleted
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016444.exe
 Infected with: Trojan.Generic.69276
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016444.exe
 Disinfection failed
 
C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP153\A0016444.exe
 Deleted

Megan Fox · Answer

Re salut Guicath*,

Si tu n'as pas trouvé ALCMTR.EXE , c'est qu'il n'existait peut être plus.


Bitdefender a fait un petit nettoyage.

Tu as encore beaucoup de problèmes ?

Guicath* · Answer

Salut Megan Fox!!!!
Plus problèmes!!!!
Tout est arrangé je pense....
Merciiiiii!!!!
Bonne journée et encore merci lol .

Brom Bones · Answer

Bonjour, 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:41:15, on 15/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\docume~1\admini~1\locals~1	emp\secuufd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\MessengerSkinner\MessengerSkinner.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcD+LDHhd+DajFaBDSW+L8lQFFgsjE6jgqyPgUCujCnmT5vDlrRcIOiIoWfkwrrSCqxepCjA+opQ3ZlhgO4zELX4QeBh4Jz4SCXSqweb8ffFeOUEdHujL0+bQrUtfXbgXJ71dSxbw8KlAvf+TIkky4Zs/Wv+pGnu9l18fHiiQ8J0I8=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [SecuUFD] c:\docume~1\admini~1\locals~1	emp\secuufd.exe sys_auto_run C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Workflow] E:\install\Workflow.exe
O4 - HKLM\..\Run: [IdiomaX Product Update] C:\Program Files\Fichiers communs\IdiomaX Shared\Cat 6.0\IdxLUpdate.exe /AUTOSTART
O4 - HKLM\..\Run: [IdiomaX Office] C:\Program Files\IdiomaX\Office Translator 4.0\IdxOffice.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Flash32] c:\Program Files\Flash 32\Flash32.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [cscsklkhg] c:\windows\system32\cscsklkhg.exe cscsklkhg
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [cscsklkhg] c:\windows\system32\cscsklkhg.exe cscsklkhg
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?6d3597bbadc049baa0baf48014530303
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?6d3597bbadc049baa0baf48014530303
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: bw+0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {9BF5BB64-5773-452A-B82C-02E5EE7EA8B8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

Megan Fox · Answer

Salut  Brom Bones,

Il faudrait que tu crée ton propre message, ça te permettra d'avoir une aide plus efficace.


A+

cocosan91 · Answer

bonsoir,
voici le compte rendu de l'analyse msnfix:
MSNFix 1.586  
 
C:\unzipped\MSNFix\MSNFix 
Fix exécuté le 18/11/2007 - 23:38:48,46 By Corinne 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton 
... C:\Program Files\Fichiers communs\Carlson\carlton 
... C:\PROGRA~1\Insider\Insider.exe 
... C:\*-1-1148.exe 
... C:\3d3t4t8n7l.exe 
... C:\i-1-1148.exe 
... C:\ir-1-1148.exe 
... C:\or-1-1148.exe 
... C:\p6g7j3w2g3f5.exe 
... C:\vr-1-1148.exe 
... C:\DOCUME~1\Corinne\LOCALS~1\Temp\camg-*.exe 
... C:\DOCUME~1\Corinne\LOCALS~1\Temp\MBDownloader_*.exe 
... C:\WINDOWS\b???.exe 
... C:\WINDOWS\ccSvcHst.exe 
... C:\WINDOWS\Dance_dec_jpg.zip 
... C:\WINDOWS\mrofinu*.exe 
... C:\WINDOWS\mrofinu*.exe.tmp 
... C:\WINDOWS\system32\microsoft\backup.ftp 
... C:\WINDOWS\system32\microsoft\backup.tftp 
... C:\WINDOWS\Dance_dec_jpg.zip 

************************  MSNCHK ***** /!\ beta test /!\

[!] C:\WINDOWS\Dance_dec_jpg.zip is INFECTED

 
************************ Recherche les dossiers présents       
 
... C:\Program Files\Fichiers communs\Carlson\ 
... C:\PROGRA~1\Insider\ 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton  
.. OK ... C:\Program Files\Fichiers communs\Carlson\carlton  
/!\ ...  C:\PROGRA~1\Insider\Insider.exe   
.. OK ... C:\*-1-1148.exe  
.. OK ... C:\3d3t4t8n7l.exe  
.. OK ... C:\i-1-1148.exe  
.. OK ... C:\ir-1-1148.exe  
.. OK ... C:\or-1-1148.exe  
.. OK ... C:\p6g7j3w2g3f5.exe  
.. OK ... C:\vr-1-1148.exe  
.. OK ... C:\DOCUME~1\Corinne\LOCALS~1\Temp\camg-*.exe  
.. OK ... C:\DOCUME~1\Corinne\LOCALS~1\Temp\MBDownloader_*.exe  
.. OK ... C:\WINDOWS\b???.exe  
/!\ ...  C:\WINDOWS\ccSvcHst.exe   
.. OK ... C:\WINDOWS\Dance_dec_jpg.zip  
/!\ ...  C:\WINDOWS\mrofinu*.exe   
.. OK ... C:\WINDOWS\mrofinu*.exe.tmp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.ftp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.tftp  
.. OK ... C:\i-1-1148.exe 
.. OK ... C:\i1-1148.exe 
.. OK ... C:\i-1-1148.exe 
.. OK ... C:\i1-1148.exe 
.. OK ... C:\ir-1-1148.exe 
.. OK ... C:\it-1-1148.exe 
.. OK ... C:\ir-1-1148.exe 
.. OK ... C:\it-1-1148.exe 
.. OK ... C:\or-1-1148.exe 
.. OK ... C:\vr-1-1148.exe 
.. OK ... C:\or-1-1148.exe 
.. OK ... C:\vr-1-1148.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\WINDOWS\Dance_dec_jpg.zip 
 
 
************************ Suppression des dossiers       
 
.. OK ... C:\Program Files\Fichiers communs\Carlson\   
/!\ ...  C:\PROGRA~1\Insider\   
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\PROGRA~1\Insider\Insider.exe  
.. OK ... C:\WINDOWS\ccSvcHst.exe  
.. OK ... C:\WINDOWS\mrofinu*.exe  
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 18112007_23471240.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

puis hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:04:00, on 19/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
D:\LOGICI~1\d\PSFree.exe
C:\DOCUME~1\Corinne\APPLIC~1\YMBOLS~1\winword.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32	askmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\LOGICI~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\Logiciels et téléchargements\qttask.exe" -atboottime
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "D:\LOGICI~1\d\PSFree.exe"
O4 - HKCU\..\Run: [Sorl] "C:\DOCUME~1\Corinne\APPLIC~1\YMBOLS~1\winword.exe" -vt yazb
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://cocosan91.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cocosan91.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1073_em_XP.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - D:\Logiciels et téléchargements\Common\Database\bin\fbserver.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Service CANALPLAY - Unknown owner - D:\Logiciels et téléchargements\CanalPlayService.exe (file missing)
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Megan Fox · Answer

Salut cocosan91,

idem que pour tous les autres.
Fait ton propre message ça sera plus facile.
Comme tu peux le constater on n'y comprend plus rien sur ce post avec toutes les demande qu'il y a eu.

Bonne soirée

cocosan91 · Answer

Bonsoir

voila le résultat de l'install MSNFix:

MSNFix 1.586  
 
C:\unzipped\MSNFix\MSNFix 
Fix exécuté le 18/11/2007 - 23:38:48,46 By Corinne 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton 
... C:\Program Files\Fichiers communs\Carlson\carlton 
... C:\PROGRA~1\Insider\Insider.exe 
... C:\*-1-1148.exe 
... C:\3d3t4t8n7l.exe 
... C:\i-1-1148.exe 
... C:\ir-1-1148.exe 
... C:\or-1-1148.exe 
... C:\p6g7j3w2g3f5.exe 
... C:\vr-1-1148.exe 
... C:\DOCUME~1\Corinne\LOCALS~1\Temp\camg-*.exe 
... C:\DOCUME~1\Corinne\LOCALS~1\Temp\MBDownloader_*.exe 
... C:\WINDOWS\b???.exe 
... C:\WINDOWS\ccSvcHst.exe 
... C:\WINDOWS\Dance_dec_jpg.zip 
... C:\WINDOWS\mrofinu*.exe 
... C:\WINDOWS\mrofinu*.exe.tmp 
... C:\WINDOWS\system32\microsoft\backup.ftp 
... C:\WINDOWS\system32\microsoft\backup.tftp 
... C:\WINDOWS\Dance_dec_jpg.zip 

************************  MSNCHK ***** /!\ beta test /!\

[!] C:\WINDOWS\Dance_dec_jpg.zip is INFECTED

 
************************ Recherche les dossiers présents       
 
... C:\Program Files\Fichiers communs\Carlson\ 
... C:\PROGRA~1\Insider\ 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton  
.. OK ... C:\Program Files\Fichiers communs\Carlson\carlton  
/!\ ...  C:\PROGRA~1\Insider\Insider.exe   
.. OK ... C:\*-1-1148.exe  
.. OK ... C:\3d3t4t8n7l.exe  
.. OK ... C:\i-1-1148.exe  
.. OK ... C:\ir-1-1148.exe  
.. OK ... C:\or-1-1148.exe  
.. OK ... C:\p6g7j3w2g3f5.exe  
.. OK ... C:\vr-1-1148.exe  
.. OK ... C:\DOCUME~1\Corinne\LOCALS~1\Temp\camg-*.exe  
.. OK ... C:\DOCUME~1\Corinne\LOCALS~1\Temp\MBDownloader_*.exe  
.. OK ... C:\WINDOWS\b???.exe  
/!\ ...  C:\WINDOWS\ccSvcHst.exe   
.. OK ... C:\WINDOWS\Dance_dec_jpg.zip  
/!\ ...  C:\WINDOWS\mrofinu*.exe   
.. OK ... C:\WINDOWS\mrofinu*.exe.tmp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.ftp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.tftp  
.. OK ... C:\i-1-1148.exe 
.. OK ... C:\i1-1148.exe 
.. OK ... C:\i-1-1148.exe 
.. OK ... C:\i1-1148.exe 
.. OK ... C:\ir-1-1148.exe 
.. OK ... C:\it-1-1148.exe 
.. OK ... C:\ir-1-1148.exe 
.. OK ... C:\it-1-1148.exe 
.. OK ... C:\or-1-1148.exe 
.. OK ... C:\vr-1-1148.exe 
.. OK ... C:\or-1-1148.exe 
.. OK ... C:\vr-1-1148.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\3d3t4t8n7l.exe 
.. OK ... C:\p6g7j3w2g3f5.exe 
.. OK ... C:\WINDOWS\Dance_dec_jpg.zip 
 
 
************************ Suppression des dossiers       
 
.. OK ... C:\Program Files\Fichiers communs\Carlson\   
/!\ ...  C:\PROGRA~1\Insider\   
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\PROGRA~1\Insider\Insider.exe  
.. OK ... C:\WINDOWS\ccSvcHst.exe  
.. OK ... C:\WINDOWS\mrofinu*.exe  
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 18112007_23471240.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------


puis de hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:04:00, on 19/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
D:\LOGICI~1\d\PSFree.exe
C:\DOCUME~1\Corinne\APPLIC~1\YMBOLS~1\winword.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32	askmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\LOGICI~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\Logiciels et téléchargements\qttask.exe" -atboottime
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "D:\LOGICI~1\d\PSFree.exe"
O4 - HKCU\..\Run: [Sorl] "C:\DOCUME~1\Corinne\APPLIC~1\YMBOLS~1\winword.exe" -vt yazb
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://cocosan91.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cocosan91.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://scripts.dlv4.com/binaries/egaccess4/egaccess4_1073_em_XP.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - D:\Logiciels et téléchargements\Common\Database\bin\fbserver.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Service CANALPLAY - Unknown owner - D:\Logiciels et téléchargements\CanalPlayService.exe (file missing)
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

low · Answer

Bonjour, 

J'ai un petit soucy , il y a deux jours j'ai recu un lien sur msn par l'un de mes contacts . Il était écrit : regarde, c'est pas sa toi? . et puis j'ai cliqué sur le lien , une photo d'un homme est apparue et depuis dés que je me connecte à msn ce lien est envoyé a tout mes contats . Je n'avais pas d'anti virus j'en ai donc pris un directement : norton . J'ai activé l'analyse de détection de virus , il m'a detecté : 17pHolmes 1148 exe, downloader . Norton a d'abord essayé de le mettre en quarantaine ce qui a échoué , il a ensuite essayé de le supprimer ce qui à également échoué . J'ai parcourue les forum et il m'était conseillé de télécharger spybot mais celui ci n'a pas pu s'installer . 

Pourriez vous m'aider à supprimer ce virus de mon pc s'il vous plait .

Contaminé par dance dec sur msn

26 réponses

Votre réponse

Discussions similaires

Newsletters