Probleme navigateur (mozilla)

Résolu
UrielAsleep -  
Bonjour,
J'ai recemment eu un probleme avec mozilla, je ne peux plus utiliser les recherches google (je peux cependant avec IE)
je suspecte donc un mechant petit spyware de me causer des ennui
j'ai donc fais un rapport Hijackthis que je vous mets ci-dessous

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:22:22, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\DeadlyUriel\Bureau\Weh\WoWEmuHacker4.3.exe
C:\WINDOWS\DSCoreItem.dsf
D:\wxw\wow.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\DeadlyUriel\Bureau\VundoFix.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0114B490-0685-491C-915B-EC3941564285} - C:\WINDOWS\system32\wvUoOhFU.dll (file missing)
O2 - BHO: (no name) - {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} - C:\WINDOWS\system32\ddcBTNGx.dll (file missing)
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - C:\WINDOWS\system32\wvUlkIYR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} - C:\WINDOWS\system32\qoMfcBQJ.dll (file missing)
O2 - BHO: {cc9063d3-d867-99c8-b7f4-df2b039fe5f8} - {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} - C:\WINDOWS\system32\rynrvkvu.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B02982FF-CC0C-4247-8275-9A57B8AC86DE} - C:\WINDOWS\system32\awtspQHw.dll (file missing)
O2 - BHO: (no name) - {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} - C:\WINDOWS\system32\ssqPffeE.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [BMe75ddac5] Rundll32.exe "C:\WINDOWS\system32\xevfstbg.dll",s
O4 - HKLM\..\Run: [e46ee959] rundll32.exe "C:\WINDOWS\system32\aphaycbd.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA4833] command /c del "C:\WINDOWS\system32\ssqPffeE.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2537] cmd /c del "C:\WINDOWS\system32\ssqPffeE.dll_old"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - Winlogon Notify: wvUlkIYR - C:\WINDOWS\SYSTEM32\wvUlkIYR.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

La ligne 020 me semble étrange m'enfin je prefere attendre l'avis d'un pro
Configuration: Windows XP
Firefox 2.0.0.14

7 réponses

  1.  sKe69 Contributeur sécurité
    salut,
    Télécharges Vundofix.exe (par Atribune) sur ton Bureau.
    http://www.atribune.org/ccount/click.php?id=4

    !!Ce déconnecter et fermer toute ces applications le temps de la manipe !!

    Double-cliquer sur VundoFix.exe afin de le lancer.
    Cliquer sur le bouton Scan for Vundo.

    Lorsque le scan est complété, cliquer sur le bouton fix Vundo.

    Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES

    Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers.
    Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.

    Le contenu du rapport est situé dans C:\vundofix.txt : postes ce rapport avec aussi un nouveau rapport Hijackthis pour annalyse .
    1. UrielAsleep Auteur
      Merci je fais ca de suite, j'envois le rapport des que le scan est terminé
    2. UrielAsleep Auteur
      Donc, apres avoir effectué ce que tu m'as dis je suis toujours autant dans le noir, en effet VundoFix n'a rien detecter,
      de meme SpyBot n'a detecter aucun virtumonde
  2. sKe69 Contributeur sécurité
    Purges la zone de "Sauvegardes" de Spybot .
    Désactives le "Tea Timer" de Spybot --->Tuto : http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

    Ensuite fais ce-ci :
    Télécharges VirtumundoBegone sur ton bureau:
    http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

    !!Ce déconnecter et fermer toute ces applications le temps de la manipe !!

    Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
    Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau .
    (Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).

    Postes le rapport VBG accompagné d'un nouveau rapport Hijackthis pour analyse ...
    1. UrielAsleep Auteur
      Meme problème rien de detexter je post le rapport VBG au cas ou

      [05/17/2008, 12:05:05] - VirtumundoBeGone v1.5 ( "D:\Download\VirtumundoBeGone.exe" )
      [05/17/2008, 12:05:15] - Detected System Information:
      [05/17/2008, 12:05:15] - Windows Version: 5.1.2600, Service Pack 2
      [05/17/2008, 12:05:15] - Current Username: DeadlyUriel (Admin)
      [05/17/2008, 12:05:15] - Windows is in NORMAL mode.
      [05/17/2008, 12:05:15] - Searching for Browser Helper Objects:
      [05/17/2008, 12:05:15] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
      [05/17/2008, 12:05:15] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
      [05/17/2008, 12:05:15] - BHO 3: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUlkIYR
      [05/17/2008, 12:05:15] - Found: HKLM\...\Winlogon\Notify\wvUlkIYR - This is probably Virtumundo.
      [05/17/2008, 12:05:15] - Assigning {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} MSEvents Object
      [05/17/2008, 12:05:15] - BHO list has been changed! Starting over...
      [05/17/2008, 12:05:15] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
      [05/17/2008, 12:05:15] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
      [05/17/2008, 12:05:15] - BHO 3: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} (MSEvents Object)
      [05/17/2008, 12:05:15] - ALERT: Found MSEvents Object!
      [05/17/2008, 12:05:15] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
      [05/17/2008, 12:05:15] - BHO 5: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
      [05/17/2008, 12:05:15] - BHO 6: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
      [05/17/2008, 12:05:15] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
      [05/17/2008, 12:05:15] - BHO 8: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
      [05/17/2008, 12:05:15] - BHO 9: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
      [05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
      [05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
      [05/17/2008, 12:05:15] - Finished Searching Browser Helper Objects
      [05/17/2008, 12:05:15] - *** Detected MSEvents Object
      [05/17/2008, 12:05:16] - Trying to remove MSEvents Object...
      [05/17/2008, 12:05:17] - Terminating Process: IEXPLORE.EXE
      [05/17/2008, 12:05:17] - Terminating Process: RUNDLL32.EXE
      [05/17/2008, 12:05:17] - Disabling Automatic Shell Restart
      [05/17/2008, 12:05:17] - Terminating Process: EXPLORER.EXE
      [05/17/2008, 12:05:17] - Suspending the NT Session Manager System Service
      [05/17/2008, 12:05:17] - Terminating Windows NT Logon/Logoff Manager
      [05/17/2008, 12:05:18] - Re-enabling Automatic Shell Restart
      [05/17/2008, 12:05:18] - File to disable: C:\WINDOWS\system32\wvUlkIYR.dll
      [05/17/2008, 12:05:18] - Renaming C:\WINDOWS\system32\wvUlkIYR.dll -> C:\WINDOWS\system32\wvUlkIYR.dll.vir
      [05/17/2008, 12:05:18] - File successfully renamed!
      [05/17/2008, 12:05:18] - Removing HKLM\...\Browser Helper Objects\{6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
      [05/17/2008, 12:05:18] - Removing HKCR\CLSID\{6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
      [05/17/2008, 12:05:18] - Adding Kill Bit for ActiveX for GUID: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
      [05/17/2008, 12:05:18] - Deleting ATLEvents/MSEvents Registry entries
      [05/17/2008, 12:05:18] - Removing HKLM\...\Winlogon\Notify\wvUlkIYR
      [05/17/2008, 12:05:18] - Searching for Browser Helper Objects:
      [05/17/2008, 12:05:18] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
      [05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
      [05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
      [05/17/2008, 12:05:18] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
      [05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
      [05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
      [05/17/2008, 12:05:18] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
      [05/17/2008, 12:05:18] - BHO 4: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
      [05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
      [05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
      [05/17/2008, 12:05:18] - BHO 5: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
      [05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
      [05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
      [05/17/2008, 12:05:18] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
      [05/17/2008, 12:05:18] - BHO 7: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
      [05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
      [05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
      [05/17/2008, 12:05:18] - BHO 8: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
      [05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
      [05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
      [05/17/2008, 12:05:18] - Finished Searching Browser Helper Objects
      [05/17/2008, 12:05:18] - Finishing up...
      [05/17/2008, 12:05:18] - A restart is needed.
      [05/17/2008, 12:05:31] - Attempting to Restart via STOP error (Blue Screen!)

      [05/17/2008, 12:07:22] - VirtumundoBeGone v1.5 ( "D:\Download\VirtumundoBeGone.exe" )
      [05/17/2008, 12:07:30] - Detected System Information:
      [05/17/2008, 12:07:30] - Windows Version: 5.1.2600, Service Pack 2
      [05/17/2008, 12:07:30] - Current Username: DeadlyUriel (Admin)
      [05/17/2008, 12:07:30] - Windows is in NORMAL mode.
      [05/17/2008, 12:07:30] - Searching for Browser Helper Objects:
      [05/17/2008, 12:07:30] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
      [05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
      [05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
      [05/17/2008, 12:07:30] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
      [05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
      [05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
      [05/17/2008, 12:07:30] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
      [05/17/2008, 12:07:30] - BHO 4: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
      [05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
      [05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
      [05/17/2008, 12:07:31] - BHO 5: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
      [05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
      [05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
      [05/17/2008, 12:07:31] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
      [05/17/2008, 12:07:31] - BHO 7: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
      [05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
      [05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
      [05/17/2008, 12:07:31] - BHO 8: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
      [05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
      [05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
      [05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
      [05/17/2008, 12:07:31] - Finished Searching Browser Helper Objects
      [05/17/2008, 12:07:31] - Finishing up...
      [05/17/2008, 12:07:31] - Nothing found! Exiting...

      S'agissant d'une session commune a plusieurs personnes ( Session XP)
      Je ne sais pas ce qui a ete changer recemment sur le pc :s
  3. sKe69 Contributeur sécurité
    t'inquiete le fix a fait son boulot mais c'est loin d'être finis ;)
    Le nouveau rapport Hijackt stp ... ( tu verras , normalement la ligne 20 a du disparaitre ... )
    1. UrielAsleep Auteur
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 12:18:19, on 17/05/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\wdfmgr.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\SOUNDMAN.EXE
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
      C:\WINDOWS\system32\Rundll32.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\SuperCopier2\SuperCopier2.exe
      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
      C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
      C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Documents and Settings\DeadlyUriel\Bureau\Weh\WoWEmuHacker4.3.exe
      C:\WINDOWS\DSCoreItem.dsf
      C:\Program Files\Windows Live\Messenger\usnsvc.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
      C:\WINDOWS\System32\wbem\wmiprvse.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: (no name) - {0114B490-0685-491C-915B-EC3941564285} - C:\WINDOWS\system32\wvUoOhFU.dll (file missing)
      O2 - BHO: (no name) - {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} - C:\WINDOWS\system32\ddcBTNGx.dll (file missing)
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} - C:\WINDOWS\system32\qoMfcBQJ.dll (file missing)
      O2 - BHO: {cc9063d3-d867-99c8-b7f4-df2b039fe5f8} - {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} - C:\WINDOWS\system32\rynrvkvu.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: (no name) - {B02982FF-CC0C-4247-8275-9A57B8AC86DE} - C:\WINDOWS\system32\awtspQHw.dll (file missing)
      O2 - BHO: (no name) - {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} - C:\WINDOWS\system32\ssqPffeE.dll (file missing)
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
      O4 - HKLM\..\Run: [e46ee959] rundll32.exe "C:\WINDOWS\system32\aphaycbd.dll",b
      O4 - HKLM\..\Run: [BMe75ddac5] Rundll32.exe "C:\WINDOWS\system32\xevfstbg.dll",s
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
      O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
      O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
      O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      2. sKe69 Contributeur sécurité
        maintenant , un coup de massue =)

        Télécharges MalwareByte's : ftp://ftp.commentcamarche.com/download/mbam-setup.exe
        un tuto sympa : https://forum.pcastuces.com/sujet.asp?f=31&s=3

        Instales le et mets le à jour .

        Puis redémarres en mode sans échec :
        Comment aller en Mode sans échec
        1) Redémarre ton ordi
        2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
        3) Tu verras un écran avec options de démarrage apparaître
        4) Choisis la première option : Sans Échec, et valide avec "Entrée"
        5) Choisis ton compte habituel, et non Administrateur (si besoin ... )

        Lances Malwarebyte's .

        Fais un scan dit "complet" et supprimes tout ce qu'il peut trouver ...

        Redémarres ton PC (mode normal ).

        Postes le rapport sauvegardé après la supression des objets infectés (dans l'onglet "rapport/log") accompagné d'un nouvel hijackthis ...
        1. UrielAsleep Auteur
          Donc merci j'ai fais tout ce que tu m'as dis cela fonctionne parfaitement, j'envois quand meme les rapports hijackthis

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 13:48:13, on 17/05/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\WINDOWS\SOUNDMAN.EXE
          C:\Program Files\Winamp\winampa.exe
          C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\SuperCopier2\SuperCopier2.exe
          C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
          C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
          C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
          C:\WINDOWS\System32\nvsvc32.exe
          C:\WINDOWS\System32\wdfmgr.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\Program Files\Windows Live\Messenger\usnsvc.exe
          C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
          C:\WINDOWS\System32\wbem\wmiprvse.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: (no name) - {0114B490-0685-491C-915B-EC3941564285} - C:\WINDOWS\system32\wvUoOhFU.dll (file missing)
          O2 - BHO: (no name) - {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} - C:\WINDOWS\system32\ddcBTNGx.dll (file missing)
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O2 - BHO: (no name) - {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} - C:\WINDOWS\system32\qoMfcBQJ.dll (file missing)
          O2 - BHO: {cc9063d3-d867-99c8-b7f4-df2b039fe5f8} - {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} - C:\WINDOWS\system32\rynrvkvu.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: (no name) - {B02982FF-CC0C-4247-8275-9A57B8AC86DE} - C:\WINDOWS\system32\awtspQHw.dll (file missing)
          O2 - BHO: (no name) - {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} - C:\WINDOWS\system32\ssqPffeE.dll (file missing)
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
          O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
          O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
          O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
          1. sKe69 Contributeur sécurité
            ce n'est pas finit !
            Fait ce-ci :
            Télécharges ComboFix (par sUBs) sur ton Bureau :
            http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide .

            Démarrer en mode sans echec :
            Comment aller en Mode sans échec
            1) Redémarres ton ordi
            2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
            3) Tu verras un écran avec options de démarrage apparaître
            4) Choisis la première option : Sans Échec, et valide avec "Entrée"
            5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
            (attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...)
            Double cliquer combofix.exe.

            Appuyer sur la touche Y (Yes) pour démarrer le scan .

            Attention : n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
            ---> si un message d'erreur windows apparait à un momment , clik sur la croix en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! )

            Le rapport sera crée dans: C:\Combofix.txt

            Redémarres ton PC ( mode normal )
            Postes le rapport combo fix et un nouveau rapport hijackthis pour analyse .

            Discussions similaires

            Navigateur web sur Hisense 43A7100F
            Zadeck

            7 réponses