Virus, virus, je n'en ai jamais vu autant..Résolu/Fermé

Question

Bonjour, ou Bonsoir,
 
Je ne sais pas comment vous le demander, mais j'ai besoin d'aide s'agissant de mon PC  
Je pense (j’en suis sur) d'avoir des gêneurs sur mon ordi et impossible de les enlever.. pourtant j'ai essayer de passer tout mes logiciel : adaware, Ccleaner, spybot, arovax, avira antivir ... même le logiciel clean
Et pourtant c'est sans résultats ...
En fait mon problème c'est surtout que des fenêtres s'ouvre a chaque fois que je me connecte, avec bien sûr lorsque je navigue sur le web [Mozilla firefox, internet explorer 7 ( pour lire les messages hotmail) et OperaTor] (exemple, skyblog, vu que tout le monde connait) la publicité est remplacé par un faux antivirus qui " scan " mon PC.. et impossible de l'enlever

Puis vient virus StorageProtector, qui bien sûr ne s'efface pas de mon bureau, sans compter les centaines de fichier installer dans mes documents qui ne s'effacent pas non plus..

comme si sa ne suffisait pas, a chaque démarrage de mon PC, je reçois un message disant qu'il me manque un composant dll et aussi que mon ordinateur est infecté ..

En bref, je n'ai jamais eu autant de probleme avec mon PC, sauf maintenant..

Pourais-je bénéficier de votre aide s'il-vous-plaît ?

jlpjlp · Answer

slt,



scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.

__________________

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

_________________


colle un rapport hijackthis 
 

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."

electrodeb · Answer

Bonjour,

Essayer de démarrer en mode sans échec et de refaire les scans.

Electrodeb

just-berni · Answer

Merci beaucoup de votre aide, j'apprécie beaucoup et j'espère être l'un des nombreux inscrits à vous féliciter, particulièrement pour la rapidité de la réponse ! =) Voici mon rapport VundoFix : VundoFix V6.7.8 Checking Java version... Java version is 1.5.0.10 Java version is 1.5.0.11 Scan started at 20:06:16 14/02/2008 Listing files found while scanning.... C:\WINDOWS\system32\bnavkhyy.dll C:\WINDOWS\system32\bqttrewx.dll C:\WINDOWS\system32\bxfojskm.dll C:\WINDOWS\system32\cbeeg.ini C:\WINDOWS\system32\cbeeg.ini2 C:\WINDOWS\system32\ctkqknyo.dll C:\WINDOWS\system32\cwannnuh.dll C:\WINDOWS\system32\dtrmaukv.dll C:\WINDOWS\system32\dyssjlpp.dll C:\WINDOWS\system32\ewaktbur.dll C:\WINDOWS\system32\exgjhvem.dll C:\WINDOWS\system32\fcuhjlmt.dll C:\WINDOWS\system32\fqvgdnyq.dll C:\WINDOWS\system32\frxujnbt.dll C:\WINDOWS\system32\geebc.dll C:\WINDOWS\system32\gigqedxy.dll C:\WINDOWS\system32\gyypdeyx.dll C:\WINDOWS\system32\hitluftt.dll C:\WINDOWS\system32\ifbjslse.dll C:\WINDOWS\system32\jijpobhw.dll C:\WINDOWS\system32\kfxwpjqa.dll C:\WINDOWS\system32\kymetjgn.dll C:\WINDOWS\system32\lphhfmgn.dll C:\WINDOWS\system32\lwhaenwq.dll C:\WINDOWS\system32\meifnles.dll C:\WINDOWS\system32\mvaopsem.dll C:\WINDOWS\system32\mwtvuerb.dll C:\WINDOWS\system32\ohnnvwtb.dll C:\WINDOWS\system32\oqtdgkha.dll C:\WINDOWS\system32\pdybwsqn.dll C:\WINDOWS\system32\qcwwtbfd.dll C:\windows\system32\qcwwtbfd.dllbox C:\WINDOWS\system32 mbqltsi.dll C:\WINDOWS\system32 tsbcrbc.dll C:\WINDOWS\system32\secfhxni.dll C:\WINDOWS\system32\seqlcovx.dll C:\WINDOWS\system32\shhnbgel.dll C:\WINDOWS\system32\slhtcibc.dll C:\WINDOWS\system32\svqugdep.dll C:\WINDOWS\system32 fvociyl.dll C:\WINDOWS\system32 lrqbqcw.dll C:\WINDOWS\system32 mljhucf.ini C:\WINDOWS\system32\uaeibwwi.dll C:\WINDOWS\system32\ubuumghp.dll C:\WINDOWS\system32\udkdcrvw.dll C:\WINDOWS\system32\uidpebta.dll C:\WINDOWS\system32\uiqtapua.dll C:\WINDOWS\system32\veoxnwxj.dll C:\WINDOWS\system32\vrwetfkb.dll C:\WINDOWS\system32\vtmtofyu.dll C:\WINDOWS\system32\wfygopeo.dll C:\WINDOWS\system32\wgqstwgl.dll C:\WINDOWS\system32\wovpuagu.dll C:\WINDOWS\system32\yblegjyx.dll C:\WINDOWS\system32\yjevpxnp.dll C:\WINDOWS\system32\yqabxlrp.dll C:\WINDOWS\system32\yvywflui.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\bnavkhyy.dll C:\WINDOWS\system32\bnavkhyy.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\bqttrewx.dll C:\WINDOWS\system32\bqttrewx.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\bxfojskm.dll C:\WINDOWS\system32\bxfojskm.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\cbeeg.ini C:\WINDOWS\system32\cbeeg.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\cbeeg.ini2 C:\WINDOWS\system32\cbeeg.ini2 Has been deleted! Attempting to delete C:\WINDOWS\system32\ctkqknyo.dll C:\WINDOWS\system32\ctkqknyo.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\cwannnuh.dll C:\WINDOWS\system32\cwannnuh.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\dtrmaukv.dll C:\WINDOWS\system32\dtrmaukv.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\dyssjlpp.dll C:\WINDOWS\system32\dyssjlpp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ewaktbur.dll C:\WINDOWS\system32\ewaktbur.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\exgjhvem.dll C:\WINDOWS\system32\exgjhvem.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\fcuhjlmt.dll C:\WINDOWS\system32\fcuhjlmt.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\fqvgdnyq.dll C:\WINDOWS\system32\fqvgdnyq.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\frxujnbt.dll C:\WINDOWS\system32\frxujnbt.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\geebc.dll C:\WINDOWS\system32\geebc.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\gigqedxy.dll C:\WINDOWS\system32\gigqedxy.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\gyypdeyx.dll C:\WINDOWS\system32\gyypdeyx.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\hitluftt.dll C:\WINDOWS\system32\hitluftt.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ifbjslse.dll C:\WINDOWS\system32\ifbjslse.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\jijpobhw.dll C:\WINDOWS\system32\jijpobhw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\kfxwpjqa.dll C:\WINDOWS\system32\kfxwpjqa.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\kymetjgn.dll C:\WINDOWS\system32\kymetjgn.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\lphhfmgn.dll C:\WINDOWS\system32\lphhfmgn.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\lwhaenwq.dll C:\WINDOWS\system32\lwhaenwq.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\meifnles.dll C:\WINDOWS\system32\meifnles.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mvaopsem.dll C:\WINDOWS\system32\mvaopsem.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\mwtvuerb.dll C:\WINDOWS\system32\mwtvuerb.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ohnnvwtb.dll C:\WINDOWS\system32\ohnnvwtb.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\oqtdgkha.dll C:\WINDOWS\system32\oqtdgkha.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\pdybwsqn.dll C:\WINDOWS\system32\pdybwsqn.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\qcwwtbfd.dll C:\WINDOWS\system32\qcwwtbfd.dll Has been deleted! Attempting to delete C:\windows\system32\qcwwtbfd.dllbox C:\windows\system32\qcwwtbfd.dllbox Has been deleted! Attempting to delete C:\WINDOWS\system32 mbqltsi.dll C:\WINDOWS\system32 mbqltsi.dll Has been deleted! Attempting to delete C:\WINDOWS\system32 tsbcrbc.dll C:\WINDOWS\system32 tsbcrbc.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\secfhxni.dll C:\WINDOWS\system32\secfhxni.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\seqlcovx.dll C:\WINDOWS\system32\seqlcovx.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\shhnbgel.dll C:\WINDOWS\system32\shhnbgel.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\slhtcibc.dll C:\WINDOWS\system32\slhtcibc.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\svqugdep.dll C:\WINDOWS\system32\svqugdep.dll Has been deleted! Attempting to delete C:\WINDOWS\system32 fvociyl.dll C:\WINDOWS\system32 fvociyl.dll Has been deleted! Attempting to delete C:\WINDOWS\system32 lrqbqcw.dll C:\WINDOWS\system32 lrqbqcw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32 mljhucf.ini C:\WINDOWS\system32 mljhucf.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\uaeibwwi.dll C:\WINDOWS\system32\uaeibwwi.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\ubuumghp.dll C:\WINDOWS\system32\ubuumghp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\udkdcrvw.dll C:\WINDOWS\system32\udkdcrvw.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\uidpebta.dll C:\WINDOWS\system32\uidpebta.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\uiqtapua.dll C:\WINDOWS\system32\uiqtapua.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\veoxnwxj.dll C:\WINDOWS\system32\veoxnwxj.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\vrwetfkb.dll C:\WINDOWS\system32\vrwetfkb.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\vtmtofyu.dll C:\WINDOWS\system32\vtmtofyu.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\wfygopeo.dll C:\WINDOWS\system32\wfygopeo.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\wgqstwgl.dll C:\WINDOWS\system32\wgqstwgl.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\wovpuagu.dll C:\WINDOWS\system32\wovpuagu.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\yblegjyx.dll C:\WINDOWS\system32\yblegjyx.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\yjevpxnp.dll C:\WINDOWS\system32\yjevpxnp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\yqabxlrp.dll C:\WINDOWS\system32\yqabxlrp.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\yvywflui.dll C:\WINDOWS\system32\yvywflui.dll Has been deleted! Performing Repairs to the registry. Done! Beginning removal... Attempting to delete C:\WINDOWS\system32\vtmtofyu.dll C:\WINDOWS\system32\vtmtofyu.dll Has been deleted! Performing Repairs to the registry. Done! Et voila le rapport combofix : ComboFix 08-02-14.3 - GERARD 2008-02-14 21:10:04.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.352.1036.18.117 [GMT 3:00] Endroit: C:\Documents and Settings\GERARD\Mes documents\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\GERARD avmonlog C:\WA6P C:\WINDOWS\system32\apjnnpae.ini C:\WINDOWS\system32\aupatqiu.ini C:\WINDOWS\system32\dubamwmm.ini C:\WINDOWS\system32\dvnbcpqh.ini C:\WINDOWS\system32\pnxpvejy.ini C:\WINDOWS\system32\setqtqqc.ini C:\WINDOWS\system32\stera.log C:\WINDOWS\system32\ugaupvow.ini C:\WINDOWS\system32\vsvqlndp.ini C:\WINDOWS\system32\xoeiultx.ini C:\WINDOWS\system32\ynrckfgd.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\LEGACY_FOPN ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-14 to 2008-02-14 )))))))))))))))))))))))))))))))))))) . 2008-02-14 20:06 . 2008-02-14 21:00 d-------- C:\VundoFix Backups 2008-02-11 00:23 . 2008-02-11 00:07 691,545 --a------ C:\WINDOWS\unins000.exe 2008-02-11 00:23 . 2008-02-11 00:23 3,450 --a------ C:\WINDOWS\unins000.dat 2008-02-09 22:34 . 2008-02-09 22:38 d-------- C:\WINDOWS\system32\fr-fr 2008-02-09 22:21 . 2007-12-07 05:08 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-02-09 22:21 . 2007-07-01 06:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-02-09 22:21 . 2007-07-01 06:36 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-02-09 22:21 . 2007-12-07 05:08 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-02-09 22:21 . 2007-12-07 05:08 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-02-09 22:21 . 2007-12-07 05:08 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-02-09 22:21 . 2007-12-07 05:08 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-02-09 22:21 . 2007-12-07 05:08 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-02-09 22:21 . 2007-12-06 14:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-09 00:16 . 2008-02-09 00:26 d-------- C:\Program Files\RegCleaner 2008-02-08 21:10 . 2008-02-08 21:10 1,134 ---hs---- C:\WINDOWS\system32\iwwbieau.ini 2008-02-07 21:26 . 2008-02-07 21:26 d-------- C:\Documents and Settings\GERARD\Application Data\Grisoft 2008-02-07 21:25 . 2008-02-07 21:25 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-07 19:49 . 2008-02-08 21:04 1,074 ---hs---- C:\WINDOWS\system32 ednyynt.ini 2008-02-07 12:41 . 2008-02-07 20:02 d-------- C:\Program Files\Anti Tracks FR 2008-02-07 12:41 . 2000-01-24 06:01 2,023,424 --a------ C:\WINDOWS\system32\vcl50.bpl 2008-02-07 12:41 . 2003-12-25 19:00 1,873,920 --a------ C:\WINDOWS\system32\Rz30Ctls50.bpl 2008-02-07 12:41 . 2000-01-31 05:00 1,496,064 --a------ C:\WINDOWS\system32\cc3250mt.dll 2008-02-07 12:41 . 2000-01-24 06:01 248,832 --a------ C:\WINDOWS\system32\vclx50.bpl 2008-02-07 12:41 . 2001-08-11 17:50 158,720 --a------ C:\WINDOWS\system32\DM15_50.bpl 2008-02-07 12:41 . 2000-01-30 22:00 147,456 --a------ C:\WINDOWS\system32\Bcbsmp50.bpl 2008-02-07 12:41 . 2000-01-31 06:00 25,600 --a------ C:\WINDOWS\system32\BORLNDMM.DLL 2008-02-07 12:41 . 2000-01-31 05:00 9,087 --a------ C:\WINDOWS\system32\wininet.lib 2008-02-05 19:00 . 2008-02-07 19:47 834 ---hs---- C:\WINDOWS\system32 wgeygcy.ini 2008-02-04 14:31 . 2008-02-05 18:54 414 ---hs---- C:\WINDOWS\system32\qbktwocd.ini 2008-02-02 14:26 . 2008-02-06 19:01 143 --a------ C:\WINDOWS\BM77a6257a.xml 2008-02-02 14:26 . 2008-02-14 19:35 22 --a------ C:\WINDOWS\pskt.ini 2008-02-02 14:13 . 2008-02-02 14:13 8,192 --ahs---- C:\WINDOWS\Thumbs.db 2008-01-20 16:49 . 2008-01-20 16:49 2,524 --a------ C:\WINDOWS\FSMAUNIN.MIF 2008-01-17 23:54 . 2008-01-17 23:54 d-------- C:\Documents and Settings\GERARD\Application Data\ThemesCreator 2008-01-15 23:13 . 1998-01-14 22:06 304,128 --a------ C:\WINDOWS\IsUn0411.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-13 21:12 --------- d--h--w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-13 21:08 --------- d-----w C:\Program Files\Arovax AntiSpyware 2008-02-10 21:29 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-02-07 18:04 --------- d-----w C:\Documents and Settings\GERARD\Application Data\uTorrent 2008-02-02 11:34 --------- d-----w C:\Program Files\eMule 2008-01-30 16:54 --------- d-----w C:\Documents and Settings\GERARD\Application Data\OpenOffice.org2 2008-01-20 13:50 --------- d-----w C:\Program Files\F-Secure 2008-01-09 22:37 --------- d-----w C:\Program Files\AviSynth 2.5 2008-01-09 21:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-01-04 19:26 --------- d-----w C:\Program Files\Sony Ericsson 2008-01-03 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Arovax 2008-01-03 10:04 --------- d-----w C:\Program Files\Wanadoo 2007-12-21 19:30 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2007-12-15 18:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-15 18:39 147,456 ----a-w C:\WINDOWS\system32\vbzip10.dll 2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-10-21 21:24 192,022 ----a-w C:\Documents and Settings\All Users\Application Data\mainlsp.reg.dat 2007-10-09 09:50 180,066 ----a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat 2007-03-05 20:22 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2007-02-24 09:05 34,024,360 ----a-w C:\Documents and Settings\GERARD\qc848fra.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20ec1d7f-dc80-4d47-9278-ab33aedc53be}] C:\WINDOWS\system32\jijpobhw.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31BDF943-6DFD-479F-AD0F-116713B0FAD3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{324769B0-BDDB-4734-9E9A-1AC46C8910A3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84B2D9D2-C3B2-43BB-84D8-482785C358F8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEC7D00B-B0B3-4942-A5D2-21488FA947BF}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F89A32A6-439D-49EC-B9B3-C71BFADEC14A}] C:\WINDOWS\system32\geebc.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:54 15360] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 02:37 1057280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:32 208952] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 09:52 1368064] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-03-26 13:40 794624] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23 75520] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32 455168] "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-07-25 21:22 1115728] "avgnt"="C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" [2007-04-02 10:35 327720] "749516e6"="C:\WINDOWS\system32\hqpcbnvd.dll" [ ] "BM77a6257a"="C:\WINDOWS\system32\vtmtofyu.dll" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 14:50 122880] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "^SetupICWDesktop"="" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\jkkkkhh] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool] --a------ 2005-06-20 17:53 1056768 C:\Program Files\VIA\RAID aid_tool.exe R2 AntiVirMailService;AntiVir PersonalEdition Premium MailGuard;"C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe" [2007-04-04 11:57] R2 AVEService;AntiVir PersonalEdition Premium MailGuard helper service;"C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe" [2007-02-26 11:33] R2 BackWeb Client - 174112;Securitoo AntiVirus;C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE [2006-10-16 19:22] R3 3xHybrid;TerraTec BDA capture service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-04-15 06:50] S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [] S3 Camdrv30;Philips ToUcam XS;C:\WINDOWS\system32\Drivers\camdrv30.sys [2001-08-17 22:04] S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2005-12-22 14:45] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-14 21:18:26 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE C:\WINDOWS\system32\LVComsX.exe C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe C:\Program Files\Logitech\Video\FxSvr2.exe . ************************************************************************** . Temps d'accomplissement: 2008-02-14 21:22:24 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-14 18:22:13 . 2008-02-13 17:11:39 --- E O F --- Et enfin le rapport Hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:38:43, on 14/02/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Logitech\Video\LogiTray.exe C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE C:\Program Files\Comodo\Firewall\cmdagent.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\SuperCopier2\SuperCopier2.exe C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE C:\WINDOWS\system32\LVComsX.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32 otepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\DOCUME~1\GERARD\LOCALS~1\Temp\Répertoire temporaire 1 pour eden.exe.zip\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file) O2 - BHO: {eb35cdea-33ba-8729-74d4-08cdf7d1ce02} - {20ec1d7f-dc80-4d47-9278-ab33aedc53be} - C:\WINDOWS\system32\jijpobhw.dll (file missing) O2 - BHO: (no name) - {31BDF943-6DFD-479F-AD0F-116713B0FAD3} - (no file) O2 - BHO: (no name) - {324769B0-BDDB-4734-9E9A-1AC46C8910A3} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {84B2D9D2-C3B2-43BB-84D8-482785C358F8} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {CEC7D00B-B0B3-4942-A5D2-21488FA947BF} - (no file) O2 - BHO: (no name) - {F89A32A6-439D-49EC-B9B3-C71BFADEC14A} - C:\WINDOWS\system32\geebc.dll (file missing) O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [749516e6] rundll32.exe "C:\WINDOWS\system32\hqpcbnvd.dll",b O4 - HKLM\..\Run: [BM77a6257a] Rundll32.exe "C:\WINDOWS\system32\vtmtofyu.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe O4 - HKUS\S-1-5-18\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] (User 'Default user') O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab O20 - Winlogon Notify: jkkkkhh - C:\WINDOWS\ O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

jlpjlp · Answer

desactive le tea timer le temps de la desisnfection

______________________

analyse ces fichiers sur virus total et si inféctés tu les mets dans la citation OTMOVIT:  https://www.virustotal.com/gui/

C:\WINDOWS\system32\iwwbieau.ini
 C:\WINDOWS\system32
ednyynt.ini
C:\WINDOWS\system32\wininet.lib
C:\WINDOWS\system32	wgeygcy.ini
C:\WINDOWS\system32\qbktwocd.ini
C:\WINDOWS\system32\hqpcbnvd.dll
C:\WINDOWS\system32\vtmtofyu.dll

________________


télécharge OTMoveIt 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.  Ou sur  https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 




clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

___________________



Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: {eb35cdea-33ba-8729-74d4-08cdf7d1ce02} - {20ec1d7f-dc80-4d47-9278-ab33aedc53be} - C:\WINDOWS\system32\jijpobhw.dll (file missing)
O2 - BHO: (no name) - {31BDF943-6DFD-479F-AD0F-116713B0FAD3} - (no file)
O2 - BHO: (no name) - {324769B0-BDDB-4734-9E9A-1AC46C8910A3} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {84B2D9D2-C3B2-43BB-84D8-482785C358F8} - (no file)
O2 - BHO: (no name) - {CEC7D00B-B0B3-4942-A5D2-21488FA947BF} - (no file)
O2 - BHO: (no name) - {F89A32A6-439D-49EC-B9B3-C71BFADEC14A} - C:\WINDOWS\system32\geebc.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [749516e6] rundll32.exe "C:\WINDOWS\system32\hqpcbnvd.dll",b
O4 - HKLM\..\Run: [BM77a6257a] Rundll32.exe "C:\WINDOWS\system32\vtmtofyu.dll",s
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O20 - Winlogon Notify: jkkkkhh - C:\WINDOWS\

____________________

mets a jour JAVA: DEMARRER puis PANNEAU DE CONFIGURATION puis JAVA puis MISE A JOUR

___________________
mets a jour adobe:
https://get2.adobe.com/reader/otherversions/

_____________________


utilise  pour supprimer tes traces 

CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo 

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
_______________________



Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

&#61623;  Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean 
&#61623;  Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec 
&#61623;  Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
Manuel de clean :
http://kerio.probb.fr/tuto-Clean-h37.html
https://kerio.probb.fr/
_______________________

installe spywarebaster pour te proteger en partie contre vundo que tu avais

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/28872.html

_______________________

navigue avec firefox a la place d'internet explorer car moins touché par les infections ou opera ou safari

http://www.mozilla-europe.org/fr/products/firefox/
______________________

colle un rapport avec antivir et un nouveau hiackthis et dis tes soucis








voila tu as du boulot mais je risque de pas etre dispo quelques jour

a plus

just-berni · Answer

Salut,

Encore une fois, merci beaucoup !!! mon PC est vraiment très clean ! et tout ça grace a VOUS, MERCI !! ;)


Voici le rapport Hijackthis : 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:32:19, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe
C:\Program Files\Fichiers communs\TerraTec\Scheduler\TTTimer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\hijackthis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

just-berni · Answer

En revanche on dirais que unplug ne peut plus prendre les vidéo sur Dailymotion ... mais pour youtube sa marche toujours, est-ce normal ?

jlpjlp · Answer

si tu as f secure et antivir vire un des deux, antivir si tu paye f secure
_______________
essaye de reinstaller unplug pour voir si ca persiste

_________________

le rapport hiajkchtis etait incomplet refais en un

__________________
 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

just-berni · Answer

Re bonjour,

Voici mon rapport Hijackthis, j'éspère qu'il est complet cette fois-ci : 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:49:08, on 21/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\GERARD\LOCALS~1\Temp\Rar$EX00.016\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: (no name) - {20ec1d7f-dc80-4d47-9278-ab33aedc53be} - (no file)
O2 - BHO: (no name) - {31BDF943-6DFD-479F-AD0F-116713B0FAD3} - (no file)
O2 - BHO: (no name) - {324769B0-BDDB-4734-9E9A-1AC46C8910A3} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {84B2D9D2-C3B2-43BB-84D8-482785C358F8} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {CEC7D00B-B0B3-4942-A5D2-21488FA947BF} - (no file)
O2 - BHO: (no name) - {F89A32A6-439D-49EC-B9B3-C71BFADEC14A} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKUS\S-1-5-18\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop]  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop]  (User 'Default user')
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - 
O20 - Winlogon Notify: jkkkkhh - C:\WINDOWS\
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

jlpjlp · Answer

vire ces deux fichiers si presents, en allant dans poste de travail puis 

C:\Documents and Settings\GERARD\Local Settings\Application Data\Comodo\    à virer:       Comodo 


C:\Documents and Settings\GERARD\Mes documents\               a virer:   Lphant-v3.00-Installer.exe=

_________________


vire ce qui est dans vundofix backups:

C:\VundoFix Backups

_________________

désactive la restauration système pour purger les virus qui seraient dedans
puis redemarre ton ordi
 puis réactive là
 (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

___________________

recolle un rapport bitdefender et hiajkchtis et dis tes soucis

just-berni · Answer

Bonjour,

voici le rapport bitdefender :


BitDefender Online Scanner
	

 
	

 

Scan report generated at: Sat, Mar 01, 2008 - 15:00:17

 
	

 
	

 

Scan path: A:\;C:\;D:\;E:\;F:\;G:\;H:\;
	

 
	

 

 
	

 
	

 

Statistics

Time
	

01:07:03

Files
	

212971

Folders
	

6088

Boot Sectors
	

2

Archives
	

1607

Packed Files
	

8078
	

 
	

 

Results

Identified Viruses
	

1

Infected Files
	

1

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

1
	

 
	

 

Engines Info

Virus Definitions
	

984672

Engine build
	

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
	

16

Archive plugins
	

41

Unpack plugins
	

7

E-mail plugins
	

6

System plugins
	

5
	

 
	

 

Scan Settings

First Action
	

Désinfecté

Second Action
	

Supprimé

Heuristics
	

Oui

Enable Warnings
	

Oui

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Oui

Scan Archives
	

Oui

Scan Packed
	

Oui

Scan Files
	

Oui

Scan Boot
	

Oui
	

 
	

 
 

Scanned File
	

 Status

C:\System Volume Information\_restore{60389939-D25D-475D-A4FC-DE03E3A9890D}\RP1\A0000004.exe=>(Instyler o)=>(Instyler Module 54)
	

Détecté avec: Application.Adware.Savenow.G

C:\System Volume Information\_restore{60389939-D25D-475D-A4FC-DE03E3A9890D}\RP1\A0000004.exe=>(Instyler o)=>(Instyler Module 54)
	

Echec de la désinfection

C:\System Volume Information\_restore{60389939-D25D-475D-A4FC-DE03E3A9890D}\RP1\A0000004.exe=>(Instyler o)=>(Instyler Module 54)
	

Supprimé

C:\System Volume Information\_restore{60389939-D25D-475D-A4FC-DE03E3A9890D}\RP1\A0000004.exe=>(Instyler o)
	

Echec de la mise à jour
	

 

 
	

 ----------------------------------
	
Et voila le rapport hijackthis :



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:12:45, on 02/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\GERARD\LOCALS~1\Temp\Rar$EX00.781\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: (no name) - {20ec1d7f-dc80-4d47-9278-ab33aedc53be} - (no file)
O2 - BHO: (no name) - {31BDF943-6DFD-479F-AD0F-116713B0FAD3} - (no file)
O2 - BHO: (no name) - {324769B0-BDDB-4734-9E9A-1AC46C8910A3} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {84B2D9D2-C3B2-43BB-84D8-482785C358F8} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {CEC7D00B-B0B3-4942-A5D2-21488FA947BF} - (no file)
O2 - BHO: (no name) - {F89A32A6-439D-49EC-B9B3-C71BFADEC14A} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKUS\S-1-5-18\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop]  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop]  (User 'Default user')
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - 
O20 - Winlogon Notify: jkkkkhh - C:\WINDOWS\
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

---
End of file - 8087 bytes




Pour les soucis, mon ordinateur a bloqué la semaine derniere faisant aparraître l'écran bleu disant " si vous voyez cet écran..." ( ou quelque chose comme ça ) en tout cas il a fallut redémarrer deux ou trois fois..

et Hier soir la plupart des publicités du web étaient remplacés par des pub pour des jeux ou l'on peut gagner de l'argent ( jeux de flechettes etc... ) mais aujourd'hui en regardant de nouveau je vois qu'ils ne sont plus là  =s

Et pour finir, depuis quelques temps l'heure de mon ordi n'est plus réglé lorsque je l'allume

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: (no name) - {20ec1d7f-dc80-4d47-9278-ab33aedc53be} - (no file)
O2 - BHO: (no name) - {31BDF943-6DFD-479F-AD0F-116713B0FAD3} - (no file)
O2 - BHO: (no name) - {324769B0-BDDB-4734-9E9A-1AC46C8910A3} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {84B2D9D2-C3B2-43BB-84D8-482785C358F8} - (no file)
O2 - BHO: (no name) - {CEC7D00B-B0B3-4942-A5D2-21488FA947BF} - (no file)
O2 - BHO: (no name) - {F89A32A6-439D-49EC-B9B3-C71BFADEC14A} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O20 - Winlogon Notify: jkkkkhh - C:\WINDOWS\

__________________

recolle un rapport vundofix et combofix 
________________

désactive la restauration système pour purger les virus qui seraient dedans
puis redemarre ton ordi
puis réactive là
(dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)
____________________
Et pour finir, depuis quelques temps l'heure de mon ordi n'est plus réglé lorsque je l'allume

cela peut venir de la pile de ta carte mere qu'il faut peut etre remplacée je pense

just-berni · Answer

Bonjour !, voici le rapport Vundofix : VundoFix V6.7.8 Checking Java version... Java version is 1.5.0.10 Java version is 1.5.0.11 Scan started at 16:14:41 09/03/2008 Listing files found while scanning.... No infected files were found. Beginning removal... Et enfin le rapport Combofix : ComboFix 08-03-08.2 - GERARD 2008-03-09 16:51:33.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.352.1036.18.201 [GMT 0:00] Endroit: C:\Documents and Settings\GERARD\Mes documents\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\pskt.ini . ((((((((((((((((((((((((((((( Fichiers créés 2008-02-09 to 2008-03-09 )))))))))))))))))))))))))))))))))))) . 2008-03-09 16:14 . 2008-03-09 16:14 d-------- C:\VundoFix Backups 2008-02-20 07:31 . 2008-03-01 13:53 d-------- C:\WINDOWS\BDOSCAN8 2008-02-15 09:07 . 2008-03-02 15:41 d-------- C:\Program Files\SpywareBlaster 2008-02-15 09:07 . 2005-08-25 15:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-02-15 08:56 . 2007-09-24 20:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-15 08:34 . 2008-02-15 08:34 d-------- C:\_OTMoveIt 2008-02-14 18:35 . 2008-02-15 16:32 d-------- C:\hijackthis 2008-02-10 21:23 . 2008-02-10 21:07 691,545 --a------ C:\WINDOWS\unins000.exe 2008-02-10 21:23 . 2008-02-10 21:23 3,450 --a------ C:\WINDOWS\unins000.dat 2008-02-09 19:34 . 2008-02-09 19:38 d-------- C:\WINDOWS\system32\fr-fr 2008-02-09 19:21 . 2007-12-07 02:08 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-02-09 19:21 . 2007-07-01 03:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-02-09 19:21 . 2007-07-01 03:36 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-02-09 19:21 . 2007-12-07 02:08 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-02-09 19:21 . 2007-12-07 02:08 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-02-09 19:21 . 2007-12-07 02:08 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-02-09 19:21 . 2007-12-07 02:08 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-02-09 19:21 . 2007-12-07 02:08 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-02-09 19:21 . 2007-12-06 11:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-09 03:20 --------- d-----w C:\Program Files\Wanadoo 2008-03-09 01:08 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-03-09 01:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-03-06 19:55 --------- d-----w C:\Program Files\eMule 2008-02-16 13:07 --------- d--h--w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-15 08:59 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-02-15 08:56 --------- d-----w C:\Program Files\Java 2008-02-13 21:08 --------- d-----w C:\Program Files\Arovax AntiSpyware 2008-02-10 21:29 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-02-08 21:26 --------- d-----w C:\Program Files\RegCleaner 2008-02-07 18:26 --------- d-----w C:\Documents and Settings\GERARD\Application Data\Grisoft 2008-02-07 18:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-07 18:04 --------- d-----w C:\Documents and Settings\GERARD\Application Data\uTorrent 2008-02-07 17:02 --------- d-----w C:\Program Files\Anti Tracks FR 2008-01-30 16:54 --------- d-----w C:\Documents and Settings\GERARD\Application Data\OpenOffice.org2 2008-01-20 13:50 --------- d-----w C:\Program Files\F-Secure 2008-01-17 20:54 --------- d-----w C:\Documents and Settings\GERARD\Application Data\ThemesCreator 2008-01-09 22:37 --------- d-----w C:\Program Files\AviSynth 2.5 2008-01-09 21:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-12-15 18:39 147,456 ----a-w C:\WINDOWS\system32\vbzip10.dll 2007-10-09 09:50 180,066 ----a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat 2007-03-05 20:22 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2007-02-24 09:05 34,024,360 ----a-w C:\Documents and Settings\GERARD\qc848fra.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 20:54 15360] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 08:43 2097488] "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-13 23:37 1057280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 18:32 208952] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 06:52 1368064] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2004-03-26 10:40 794624] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 12:24 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 12:14 217088] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 18:32 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 18:32 455168] "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-07-25 18:22 1115728] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 11:50 122880] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "^SetupICWDesktop"="" [] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool] --a------ 2005-06-20 14:53 1056768 C:\Program Files\VIA\RAID aid_tool.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= R2 BackWeb Client - 174112;Securitoo AntiVirus;C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE [2006-10-16 16:22] R3 3xHybrid;TerraTec BDA capture service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-04-15 03:50] S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [] S3 Camdrv30;Philips ToUcam XS;C:\WINDOWS\system32\Drivers\camdrv30.sys [2001-08-17 19:04] S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2005-12-22 11:45] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 16:55:05 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv] "ImagePath"="\??\C:\DOCUME~1\GERARD\LOCALS~1\Temp\mc21.tmp" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant] "ImagePath"="" . Temps d'accomplissement: 2008-03-09 16:56:30 ComboFix-quarantined-files.txt 2008-03-09 16:56:01 . 2008-02-13 17:11:39 --- E O F --- ----------------- Et si la pile doit être remplacée, ça signifie que ma carte mère peut " mourrir " ?

jlpjlp · Answer

Et si la pile doit être remplacée, ça signifie que ma carte mère peut " mourrir " ?

non il suufit de changer la pile mais je ne suis pas specialiste dans le domaine


renseingne toi dans la partie materiel du site

just-berni · Answer

Merci Beaucoup Jlpjlp !! Tout mes problemes sont résolu grace a vous !!

anand · Answer

I experienced the same problem. There is no issue. Copy your important documents in a pen drive, then re format your pc completely. This has worked in my pc. After formatted our pc, re install all drivers and office. all problems will be solved. just try it

Virus, virus, je n'en ai jamais vu autant..

15 réponses

Discussions similaires

Newsletters