Alertre securité windows - Page 3

Résolu
Précédent
  • 1
  • 2
  • 3
  1. g!rly Messages postés 18462 Statut Contributeur 407
     
    Télécharge VirtumundoBegone sur le bureau:
    http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

    Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.
    Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis.
    Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu
    0
  2. poulette559 Messages postés 59 Statut Membre
     
    voici le dernier rapport de antivir en mode normal (il l'a lancé tout seul arpés avoir redemarrer du mode sans echec

    AntiVir PersonalEdition Classic
    Report file date: jeudi 29 novembre 2007 21:28

    Scanning for 954605 virus strains and unwanted programs.

    Licensed to: Avira AntiVir PersonalEdition Classic
    Serial number: 0000149996-ADJIE-0001
    Platform: Windows XP
    Windows version: (Service Pack 2) [5.1.2600]
    Username: SYSTEM
    Computer name: JULIE

    Version information:
    BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
    AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
    AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
    LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
    LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
    ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
    ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
    ANTIVIR2.VDF : 7.0.1.0 1393152 Bytes 23/11/2007 19:44:57
    ANTIVIR3.VDF : 7.0.1.25 188928 Bytes 29/11/2007 19:44:57
    AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 29/11/2007 19:44:57
    AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
    AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
    AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
    AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
    AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
    AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
    AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
    NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
    RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
    RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
    SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

    Configuration settings for the scan:
    Jobname..........................: Complete system scan
    Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
    Logging..........................: low
    Primary action...................: interactive
    Secondary action.................: ignore
    Scan master boot sector..........: off
    Scan boot sector.................: on
    Boot sectors.....................: C:,
    Scan memory......................: on
    Process scan.....................: on
    Scan registry....................: on
    Search for rootkits..............: off
    Scan all files...................: Intelligent file selection
    Scan archives....................: on
    Recursion depth..................: 20
    Smart extensions.................: on
    Macro heuristic..................: on
    File heuristic...................: medium

    Start of the scan: jeudi 29 novembre 2007 21:28

    The scan of running processes will be started
    Scan process 'avscan.exe' - '1' Module(s) have been scanned
    Scan process 'avast.setup' - '1' Module(s) have been scanned
    Scan process 'iexplore.exe' - '1' Module(s) have been scanned
    Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
    Scan process 'guardgui.exe' - '1' Module(s) have been scanned
    Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
    Scan process 'alg.exe' - '1' Module(s) have been scanned
    Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
    Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
    Scan process 'IAANTMon.exe' - '1' Module(s) have been scanned
    Scan process 'CDAC11BA.EXE' - '1' Module(s) have been scanned
    Scan process 'guard.exe' - '0' Module(s) have been scanned
    Scan process 'sched.exe' - '1' Module(s) have been scanned
    Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
    Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
    Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
    Scan process 'SuperCopier2.exe' - '1' Module(s) have been scanned
    Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
    Scan process 'CursorXP.exe' - '1' Module(s) have been scanned
    Scan process 'avgnt.exe' - '1' Module(s) have been scanned
    Scan process 'avgas.exe' - '1' Module(s) have been scanned
    Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
    Scan process 'avguard.exe' - '1' Module(s) have been scanned
    Scan process 'explorer.exe' - '1' Module(s) have been scanned
    Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
    Scan process 'ashServ.exe' - '1' Module(s) have been scanned
    Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'lsass.exe' - '1' Module(s) have been scanned
    Scan process 'services.exe' - '1' Module(s) have been scanned
    Scan process 'winlogon.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'smss.exe' - '1' Module(s) have been scanned
    38 processes with 38 modules were scanned

    Start scanning boot sectors:
    Boot sector 'C:\'
    [NOTE] No virus was found!

    Starting to scan the registry.
    The registry was scanned ( '23' files ).

    Starting the file scan:

    Begin scan in 'C:\'
    C:\hiberfil.sys
    [WARNING] The file could not be opened!
    C:\pagefile.sys
    [WARNING] The file could not be opened!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0044703.exe
    [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045787.exe
    [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045861.dll
    [DETECTION] Is the Trojan horse TR/Vundo.AU
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045862.dll
    [DETECTION] Is the Trojan horse TR/Vundo.AU
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045878.dll
    [DETECTION] Is the Trojan horse TR/Vundo.CA
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045887.dll
    [DETECTION] Is the Trojan horse TR/Vundo.CA
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP297\A0045924.dll
    [DETECTION] Is the Trojan horse TR/Vundo.Gen
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP300\A0048043.dll
    [DETECTION] Is the Trojan horse TR/Vundo.Gen
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP302\A0048658.dll
    [DETECTION] Is the Trojan horse TR/Vundo.CA
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP302\A0048665.dll
    [DETECTION] Is the Trojan horse TR/Vundo.CA
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048705.dll
    [DETECTION] Is the Trojan horse TR/Vundo.AU
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048706.dll
    [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048707.dll
    [DETECTION] Is the Trojan horse TR/Vundo.DRK
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048708.exe
    [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
    [INFO] The file was deleted!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048709.exe
    [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
    [INFO] The file was moved to '477f2d7f.qua'!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048710.dll
    [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
    [INFO] The file was moved to '477f2d81.qua'!
    C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048711.dll
    [DETECTION] Is the Trojan horse TR/Vundo.CA
    [INFO] The file was moved to '477f2d83.qua'!
    C:\WINDOWS\system32\mljgg.dll
    [DETECTION] Is the Trojan horse TR/Vundo.Gen
    [WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
    [WARNING] The file could not be deleted!
    C:\WINDOWS\system32\drivers\dtscsi.sys
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\drivers\sptd.sys
    [WARNING] The file could not be opened!
    C:\WINDOWS\system32\drivers\sptd8157.sys
    [WARNING] The file could not be opened!

    End of the scan: jeudi 29 novembre 2007 22:29
    Used time: 1:01:14 min

    The scan has been done completely.

    4594 Scanning directories
    284095 Files were scanned
    18 viruses and/or unwanted programs were found
    0 Files were classified as suspicious:
    14 files were deleted
    0 files were repaired
    3 files were moved to quarantine
    0 files were renamed
    5 Files cannot be scanned
    284077 Files not concerned
    8457 Archives were scanned
    6 Warnings
    2 Notes
    0
  3. poulette559 Messages postés 59 Statut Membre
     
    voici le rapport hijack:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:56:48, on 29/11/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\savedump.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SuperCopier2\SuperCopier2.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1105EDDA-0BE7-4F40-91D0-369944E296A0} - (no file)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: (no name) - {6365E921-A096-401E-864D-F97874B43D0F} - (no file)
    O2 - BHO: (no name) - {7D8D942E-3E5A-46EB-A6E0-6B959E2DFCAE} - C:\WINDOWS\system32\mljgg.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: {7fecf0c7-9a57-1b38-0414-a06a53b2e96b} - {b69e2b35-a60a-4140-83b1-75a97c0fcef7} - C:\WINDOWS\system32\mgjqfvir.dll (file missing)
    O2 - BHO: (no name) - {E2A9A631-C02F-4B06-9D87-3D7339D32B81} - (no file)
    O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    0
  4. g!rly Messages postés 18462 Statut Contributeur 407
     
    re,

    a l´aide de hijack this coche et fix les lignes suivantes :

    O2 - BHO: (no name) - {1105EDDA-0BE7-4F40-91D0-369944E296A0} - (no file)
    O2 - BHO: (no name) - {6365E921-A096-401E-864D-F97874B43D0F} - (no file)
    O2 - BHO: (no name) - {7D8D942E-3E5A-46EB-A6E0-6B959E2DFCAE} - C:\WINDOWS\system32\mljgg.dll
    O2 - BHO: {7fecf0c7-9a57-1b38-0414-a06a53b2e96b} - {b69e2b35-a60a-4140-83b1-75a97c0fcef7} - C:\WINDOWS\system32\mgjqfvir.dll (file missing)
    O2 - BHO: (no name) - {E2A9A631-C02F-4B06-9D87-3D7339D32B81} - (no file)
    O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)

    comment fixer :

    Tutoriel d´utilisation (video) :

    -> http://pageperso.aol.fr/balltrap34/demohijack.htm

    Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
    http://www.atribune.org/ccount/click.php?id=4

    * Lance Vundofix
    * Ne clique pas sur "Scan for a vundo"
    * Clique droit au milieu de la fenêtre
    * Clique sur Add more files ?
    * Copie/colle les fichiers ci-dessous ( un par case) :

    C:\WINDOWS\system32\mljgg.dll

    * Clique sur Add files
    * Ensuite clique sur Close Windows
    * Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
    * Si l'outils demande un redémarrage, accepte
    * Poste le rapport Vundofix

    Désactive ta restauration système:
    pour cela :
    Click droit sur poste de travail, dans l´arborescence sur propriétés;
    dans la nouvelle fenettre click sur l´onglet restauration système;
    coche la case désactiver la restauration systèm et applique.
    puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés;
    dans la nouvelle fenettre click sur l´onglet restauration systèm
    décoche la case désactiver la restauration systèm et applique.

    desinstal avast et norton

    Desinstalleur Norton:
    http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

    et

    Désinstalleur Avast:
    https://www.avast.com/fr-fr/uninstall-utility

    et instal kerio

    maintenant ca devrait le faire sans norton...

    par feu : kerio

    https://www.vulgarisation-informatique.com/kerio.php

    Poste le rapport Vundofix avec un nouveau hijack this stp

    @+
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. poulette559 Messages postés 59 Statut Membre
     
    voici le nouveau rapoprt hijack:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:48:25, on 30/11/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SuperCopier2\SuperCopier2.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {32433593-88FA-4D35-B1A4-A03DE4937049} - C:\WINDOWS\system32\mljgg.dll (file missing)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: (no name) - {FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [1474aad1] rundll32.exe "C:\WINDOWS\system32\yktesomw.dll",b
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ifpnvrxt.exe (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    0
  7. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut poulette,

    il faut que tu desinstal avast vu que tu as antivir tu voie...

    peux tu remettre un combofix stp

    @+
    0
  8. poulette559 Messages postés 59 Statut Membre
     
    slut
    j'ai désinstaller avast et j'ai mis kerio. Maintenant j'ai: spybot,AVG,Antivir et kerio je peux tout garder?
    Kerio me demande: une application essaie de communiquer avec un ordinateur distant. GENERIC HOST Process for Win32 Services 86.160.219.149 port1219, j'autorise ou je bloque ce truc? lol
    voici le rapport de combofix:
    ComboFix 07-11-19.4B - Moi 2007-11-30 20:26:24.4 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.655 [GMT 1:00]
    Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
    C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
    C:\Documents and Settings\Moi\Favoris\Online Security Guide.lnk

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_DOMAINSERVICE
    -------\DomainService

    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))))))))
    .

    2007-11-30 20:18 <REP> d-------- C:\Program Files\Kerio
    2007-11-30 19:40 <REP> d-------- C:\VundoFix Backups
    2007-11-30 19:22 78,912 --a------ C:\WINDOWS\system32\jawkxcus.dll
    2007-11-29 20:43 <REP> d-------- C:\Program Files\Avira
    2007-11-29 13:10 <REP> d--h----- C:\WINDOWS\PIF
    2007-11-28 22:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
    2007-11-28 19:18 245,975 --ahs---- C:\WINDOWS\system32\ggjlm.ini2
    2007-11-28 19:18 245,975 --ahs---- C:\WINDOWS\system32\ggjlm.ini
    2007-11-28 13:42 <REP> d-------- C:\Program Files\Sunbelt Software
    2007-11-28 13:05 <REP> d-------- C:\WINDOWS\BDOSCAN8
    2007-11-27 19:30 <REP> d-------- C:\Documents and Settings\Moi\Application Data\Grisoft
    2007-11-27 19:30 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-11-27 19:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-11-27 19:26 <REP> d-------- C:\Program Files\Trend Micro
    2007-11-26 19:07 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
    2007-11-26 19:07 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
    2007-11-26 19:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
    2007-11-26 19:07 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
    2007-11-26 19:07 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
    2007-11-26 19:07 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
    2007-11-26 19:07 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
    2007-11-26 19:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver
    2007-11-26 19:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
    2007-11-26 19:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Jasc Software Inc
    2007-11-24 20:13 <REP> d-------- C:\Program Files\Doom 3
    2007-11-24 20:11 38,912 --a------ C:\WINDOWS\system32\ddcdbcb.dll.vir
    2007-11-24 19:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES
    2007-11-18 21:24 <REP> d-------- C:\Program Files\ViaMichelin
    2007-11-18 21:23 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys
    2007-11-18 21:21 <REP> d-------- C:\Program Files\Microsoft ActiveSync
    2007-11-18 21:21 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
    2007-11-18 21:21 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
    2007-11-18 21:20 <REP> d-------- C:\WINDOWS\Downloaded Installations
    2007-10-27 14:25 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
    2007-10-27 14:25 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2007-10-09 00:23 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe
    2007-10-09 00:23 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
    2007-10-08 21:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-11-29 11:43 --------- d-----w C:\Program Files\Nero Burning ROM v6.0.0.23 Ultra Edition Incl keygen-CORE-Pleasuredome101
    2007-11-28 20:57 --------- d-----w C:\Program Files\PowerArchiver
    2007-11-28 18:26 --------- d-----w C:\Documents and Settings\Moi\Application Data\Samsung
    2007-11-28 18:17 --------- d-----w C:\Documents and Settings\Moi\Application Data\Skype
    2007-11-24 23:58 --------- d-----w C:\Documents and Settings\Moi\Application Data\Azureus
    2007-11-24 18:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-11-24 18:37 --------- d-----w C:\Program Files\Ubisoft
    2007-11-17 16:15 --------- d-----w C:\Program Files\FoxTarot4
    2007-10-28 11:59 --------- d-----w C:\Program Files\GUILD WARS
    2007-10-27 13:25 --------- d-----w C:\Program Files\Picasa2
    2007-01-18 17:33 1,127,307 ----a-w C:\Program Files\wrar362fr.exe
    2006-10-03 19:08 9,998,384 ----a-w C:\Program Files\nero_nero_6.6.1.4_language_pack_francais_francais_10297.exe
    2006-09-11 17:17 8,799,656 ----a-w C:\Program Files\Azureus_2.5.0.0_Win32.setup.exe
    1999-04-06 13:27 99,840 ----a-w C:\Program Files\Fichiers communs\IRAABOUT.DLL
    1998-12-09 03:53 70,144 ----a-w C:\Program Files\Fichiers communs\IRAMDMTR.DLL
    1998-12-09 03:53 48,640 ----a-w C:\Program Files\Fichiers communs\IRALPTTR.DLL
    1998-12-09 03:53 31,744 ----a-w C:\Program Files\Fichiers communs\IRAWEBTR.DLL
    1998-12-09 03:53 186,368 ----a-w C:\Program Files\Fichiers communs\IRAREG.DLL
    1998-12-09 03:53 17,920 ----a-w C:\Program Files\Fichiers communs\IRASRIAL.DLL
    .

    ((((((((((((((((((((((((((((( snapshot@2007-11-28_12.42.42.17 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
    + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll
    + 2006-05-25 00:22:06 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
    + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll
    + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll
    + 2007-08-09 12:04:11 40,768 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
    + 2007-07-18 13:22:19 21,312 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
    + 2007-11-29 19:44:57 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
    + 2004-04-15 10:02:56 147,456 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys
    + 2007-03-01 09:34:36 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32433593-88FA-4D35-B1A4-A03DE4937049}]
    C:\WINDOWS\system32\mljgg.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" []
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
    "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 18:17]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="RUNDLL32.exe" [2004-08-05 13:00 C:\WINDOWS\system32\rundll32.exe]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-11 10:28]
    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-29 20:44]
    "1474aad1"="C:\WINDOWS\system32\yktesomw.dll" []

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]
    "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" []
    "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"= 0 (0x0)

    R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys
    R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
    R1 SSHDRV76;SSHDRV76;\??\C:\WINDOWS\system32\drivers\SSHDRV76.sys
    R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys
    R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS\tansgt.sys
    S3 Netdmin;Netdmin;C:\WINDOWS\system32\drivers\rasacd.sys
    S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys
    S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
    S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
    S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
    S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys

    .
    Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
    "2005-11-18 19:15:04 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job"
    .
    **************************************************************************

    catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-11-30 20:30:12
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-11-30 20:31:25 - machine was rebooted
    C:\ComboFix2.txt ... 2007-11-28 19:16
    C:\ComboFix3.txt ... 2007-11-28 12:43
    .
    --- E O F ---
    0
  9. g!rly Messages postés 18462 Statut Contributeur 407
     
    re,

    cool pour antivir et kerio ;-)

    oui accepte : une application essaie de communiquer avec un ordinateur distant. GENERIC HOST Process for Win32 Services 86.160.219.149 port1219,

    Copie le texte se situant dans le cadre ci-dessous :

    File::
    C:\WINDOWS\system32\jawkxcus.dll
    C:\WINDOWS\system32\mljgg.dll
    C:\WINDOWS\system32\ggjlm.ini2
    C:\WINDOWS\system32\ggjlm.ini
    C:\WINDOWS\system32\ddcdbcb.dll.vir
    C:\WINDOWS\system32\yktesomw.dll

    Folder::
    C:\VundoFix Backups
    C:\WINDOWS\PIF
    C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32433593-88FA-4D35-B1A4-A03DE4937049}]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "1474aad1"=-

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt.

    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

    http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

    Cela va relancer Combofix,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Combofix.txt (C:\ComboFix4) accompagné d'un rapport Hijackthis.

    S'il n'y a pas de rédémarrage, poste quand même les rapports.

    @+
    0
  10. poulette559 Messages postés 59 Statut Membre
     
    voici le rapport de combofix (j'ai du refaire la 1ere fois je l'ai suppirmé en faisant 2 au lieu de 1!! lol)
    ComboFix 07-11-19.4C - Moi 2007-11-30 22:58:12.5 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.613 [GMT 1:00]
    Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Moi\Bureau\CFScript.txt
    * Created a new restore point

    FILE
    C:\WINDOWS\system32\ddcdbcb.dll.vir
    C:\WINDOWS\system32\ggjlm.ini
    C:\WINDOWS\system32\ggjlm.ini2
    C:\WINDOWS\system32\jawkxcus.dll
    C:\WINDOWS\system32\mljgg.dll
    C:\WINDOWS\system32\yktesomw.dll
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver
    C:\WINDOWS\PIF
    C:\WINDOWS\system32\ddcdbcb.dll.vir
    C:\WINDOWS\system32\ggjlm.ini
    C:\WINDOWS\system32\ggjlm.ini2
    C:\WINDOWS\system32\jawkxcus.dll

    .
    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))))))))
    .

    2007-11-30 20:18 <REP> d-------- C:\Program Files\Kerio
    2007-11-29 20:43 <REP> d-------- C:\Program Files\Avira
    2007-11-28 22:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
    2007-11-28 13:42 <REP> d-------- C:\Program Files\Sunbelt Software
    2007-11-28 13:05 <REP> d-------- C:\WINDOWS\BDOSCAN8
    2007-11-27 19:30 <REP> d-------- C:\Documents and Settings\Moi\Application Data\Grisoft
    2007-11-27 19:30 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-11-27 19:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-11-27 19:26 <REP> d-------- C:\Program Files\Trend Micro
    2007-11-26 19:07 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
    2007-11-26 19:07 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
    2007-11-26 19:07 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
    2007-11-26 19:07 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
    2007-11-26 19:07 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
    2007-11-26 19:07 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
    2007-11-26 19:07 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
    2007-11-26 19:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
    2007-11-26 19:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Jasc Software Inc
    2007-11-24 20:13 <REP> d-------- C:\Program Files\Doom 3
    2007-11-24 19:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES
    2007-11-18 21:24 <REP> d-------- C:\Program Files\ViaMichelin
    2007-11-18 21:21 <REP> d-------- C:\Program Files\Microsoft ActiveSync
    2007-11-18 21:21 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
    2007-11-18 21:21 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
    2007-11-18 21:20 <REP> d-------- C:\WINDOWS\Downloaded Installations
    2007-10-27 14:25 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
    2007-10-27 14:25 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2007-10-09 00:23 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
    2007-10-08 21:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-11-29 11:43 --------- d-----w C:\Program Files\Nero Burning ROM v6.0.0.23 Ultra Edition Incl keygen-CORE-Pleasuredome101
    2007-11-28 20:57 --------- d-----w C:\Program Files\PowerArchiver
    2007-11-28 18:26 --------- d-----w C:\Documents and Settings\Moi\Application Data\Samsung
    2007-11-28 18:17 --------- d-----w C:\Documents and Settings\Moi\Application Data\Skype
    2007-11-24 23:58 --------- d-----w C:\Documents and Settings\Moi\Application Data\Azureus
    2007-11-24 18:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-11-24 18:37 --------- d-----w C:\Program Files\Ubisoft
    2007-11-17 16:15 --------- d-----w C:\Program Files\FoxTarot4
    2007-10-28 11:59 --------- d-----w C:\Program Files\GUILD WARS
    2007-10-27 13:25 --------- d-----w C:\Program Files\Picasa2
    2007-01-18 17:33 1,127,307 ----a-w C:\Program Files\wrar362fr.exe
    2006-10-03 19:08 9,998,384 ----a-w C:\Program Files\nero_nero_6.6.1.4_language_pack_francais_francais_10297.exe
    2006-09-11 17:17 8,799,656 ----a-w C:\Program Files\Azureus_2.5.0.0_Win32.setup.exe
    1999-04-06 13:27 99,840 ----a-w C:\Program Files\Fichiers communs\IRAABOUT.DLL
    1998-12-09 03:53 70,144 ----a-w C:\Program Files\Fichiers communs\IRAMDMTR.DLL
    1998-12-09 03:53 48,640 ----a-w C:\Program Files\Fichiers communs\IRALPTTR.DLL
    1998-12-09 03:53 31,744 ----a-w C:\Program Files\Fichiers communs\IRAWEBTR.DLL
    1998-12-09 03:53 186,368 ----a-w C:\Program Files\Fichiers communs\IRAREG.DLL
    1998-12-09 03:53 17,920 ----a-w C:\Program Files\Fichiers communs\IRASRIAL.DLL
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32433593-88FA-4D35-B1A4-A03DE4937049}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" []
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
    "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 18:17]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="RUNDLL32.exe" [2004-08-05 13:00 C:\WINDOWS\system32\rundll32.exe]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-11 10:28]
    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-29 20:44]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]
    "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" []
    "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"= 0 (0x0)

    R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys
    R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
    R1 SSHDRV76;SSHDRV76;\??\C:\WINDOWS\system32\drivers\SSHDRV76.sys
    R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys
    R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS\tansgt.sys
    S3 Netdmin;Netdmin;C:\WINDOWS\system32\drivers\rasacd.sys
    S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys
    S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys
    S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys
    S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys
    S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys

    .
    Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
    "2005-11-18 19:15:04 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job"
    .
    **************************************************************************

    catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-11-30 23:01:35
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-11-30 23:02:54 - machine was rebooted
    C:\ComboFix2.txt ... 2007-11-30 20:31
    C:\ComboFix3.txt ... 2007-11-28 19:16
    .
    --- E O F ---
    et le hijack:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:05:15, on 30/11/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SuperCopier2\SuperCopier2.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    0
  11. g!rly Messages postés 18462 Statut Contributeur 407
     
    re,

    comment ca va maintenant?
    0
  12. poulette559 Messages postés 59 Statut Membre
     
    écoutes, ca va bcp bcp mieux!! oserai'je m'avancer au point de dire que tout est ok..oui je me lance:tout est ok!! Merci bcp pour ton aide!! puis je virer, ou sauvegarder ailleurs tout les petits programme que j'ai téléchargé?
    Je peux garder les 2 en meme temps entre spybot et avg?
    0
  13. g!rly Messages postés 18462 Statut Contributeur 407
     
    bonjour poulette,

    et bien je suis bien contente que tes soucis soient terminés

    oui tu peux supprimer les outils que nous avons utilisés, tu peux garder spybot et avg.

    pour parfaire le nettoyge, je te propose ces deux logiciels, l´un (ccleaner) sert a nettoyer les fichiers temporaires et les erreures, et l´autre (regcleaner) sert a nettoyer le registre : tu peux passer ccleaner asser regulierement et regcleaner une fois par mois par exemple.

    Ccleaner:

    -> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):

    http://www.commentcamarche.net/telecharger/telechargement 168 ccleaner

    -> L´installer.

    -> Une fois installé et lancé :

    Dans la colonne de gauche, click sur :

    ->"erreurs" :

    Coches toutes les cases dans les propriétés du nettoyeur de l´onglet "windows" et "applications", puis click en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs", tu auras un message pour sauvegarder ta base de registre, tu click "oui" puis tu recommence jusqu'à ce qu'il ne trouve plus rien.

    ps : les sauvegardes que tu auras faites, pourront etre supprimées ulterieurement si tout va bien.

    ->"nettoyeur"

    quitte ton navigateur avant de le lancer, décoche la derniere case (Avancé si elle est cochée) puis click sur "lancer le nettoyage" qunand il aura terminé le scan click en bas a droite sur "lancer le nettoyage" et accepte par oui.

    -> Tutoriel en image :

    https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

    -> Pour ceux qui voudraient aller plus loin en compagnie de jesses (fonctions avancés) :

    http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

    telecharge et instal regcleaner:

    http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html

    tutorial :

    http://www.softastuces.com/tuto/maint/regcleaner/

    bonne continuation``
    0
  14. poulette559 Messages postés 59 Statut Membre
     
    salut
    j'ai fait ccleaner
    J'ai installé et accepter le texte pour regcleaner mais aprés rien ne se passe...
    0
  15. g!rly Messages postés 18462 Statut Contributeur 407
     
    tu as bien regarder le tuto?
    0
  16. poulette559 Messages postés 59 Statut Membre
     
    salut.
    Je pensais le probleme résolu mais antivir m'a trouvé encore des trojans vundo qq chose comme ca. Je poste le rapport et un nouveau hijack?
    a+
    0
  17. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut poulette,

    et bien...

    oui post un nouveau hijack this

    @+
    0
  18. poulette559 Messages postés 59 Statut Membre
     
    salut salut voici le rapport hijack:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:29:14, on 12/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SuperCopier2\SuperCopier2.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    0
  19. g!rly Messages postés 18462 Statut Contributeur 407
     
    re,

    tu n´as rien ;-)

    ce que antivir a detecté etait la quarantaine de combofix alors supprime la ainsi que combofix et tous les outils que nous avions utilisés

    puis l´autre manifestation concerne ta restauration system, alors fais ceci :

    Désactive ta restauration système:
    pour cela :
    Click droit sur poste de travail, dans l´arborescence sur propriétés;
    dans la nouvelle fenettre click sur l´onglet restauration système;
    coche la case désactiver la restauration systèm et applique.
    puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés;
    dans la nouvelle fenettre click sur l´onglet restauration systèm
    décoche la case désactiver la restauration systèm et applique.

    voila

    @+
    0
  20. g!rly Messages postés 18462 Statut Contributeur 407
     
    --
    mouvement de non entraide a suivre très prochainement...
    0
Précédent
  • 1
  • 2
  • 3