Probleme navigateur (mozilla)
Résolu/Fermé
UrielAsleep
Messages postés
151
Date d'inscription
dimanche 16 mars 2008
Statut
Membre
Dernière intervention
24 février 2010
-
17 mai 2008 à 11:29
sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 - 17 mai 2008 à 13:54
sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 - 17 mai 2008 à 13:54
A voir également:
- Probleme navigateur (mozilla)
- Mozilla thunderbird - Télécharger - Mail
- Navigateur privé - Guide
- Safari navigateur - Télécharger - Navigateurs
- Navigateur opera - Télécharger - Navigateurs
- Qwant navigateur - Télécharger - Navigateurs
7 réponses
sKe69
Messages postés
21360
Date d'inscription
samedi 15 mars 2008
Statut
Contributeur sécurité
Dernière intervention
30 décembre 2012
463
17 mai 2008 à 11:41
17 mai 2008 à 11:41
salut,
Télécharges Vundofix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
!!Ce déconnecter et fermer toute ces applications le temps de la manipe !!
Double-cliquer sur VundoFix.exe afin de le lancer.
Cliquer sur le bouton Scan for Vundo.
Lorsque le scan est complété, cliquer sur le bouton fix Vundo.
Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES
Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.
Le contenu du rapport est situé dans C:\vundofix.txt : postes ce rapport avec aussi un nouveau rapport Hijackthis pour annalyse .
Télécharges Vundofix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
!!Ce déconnecter et fermer toute ces applications le temps de la manipe !!
Double-cliquer sur VundoFix.exe afin de le lancer.
Cliquer sur le bouton Scan for Vundo.
Lorsque le scan est complété, cliquer sur le bouton fix Vundo.
Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES
Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.
Le contenu du rapport est situé dans C:\vundofix.txt : postes ce rapport avec aussi un nouveau rapport Hijackthis pour annalyse .
sKe69
Messages postés
21360
Date d'inscription
samedi 15 mars 2008
Statut
Contributeur sécurité
Dernière intervention
30 décembre 2012
463
17 mai 2008 à 12:05
17 mai 2008 à 12:05
Purges la zone de "Sauvegardes" de Spybot .
Désactives le "Tea Timer" de Spybot --->Tuto : http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
Ensuite fais ce-ci :
Télécharges VirtumundoBegone sur ton bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
!!Ce déconnecter et fermer toute ces applications le temps de la manipe !!
Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau .
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).
Postes le rapport VBG accompagné d'un nouveau rapport Hijackthis pour analyse ...
Désactives le "Tea Timer" de Spybot --->Tuto : http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
Ensuite fais ce-ci :
Télécharges VirtumundoBegone sur ton bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
!!Ce déconnecter et fermer toute ces applications le temps de la manipe !!
Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau .
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).
Postes le rapport VBG accompagné d'un nouveau rapport Hijackthis pour analyse ...
UrielAsleep
Messages postés
151
Date d'inscription
dimanche 16 mars 2008
Statut
Membre
Dernière intervention
24 février 2010
9
17 mai 2008 à 12:10
17 mai 2008 à 12:10
Meme problème rien de detexter je post le rapport VBG au cas ou
[05/17/2008, 12:05:05] - VirtumundoBeGone v1.5 ( "D:\Download\VirtumundoBeGone.exe" )
[05/17/2008, 12:05:15] - Detected System Information:
[05/17/2008, 12:05:15] - Windows Version: 5.1.2600, Service Pack 2
[05/17/2008, 12:05:15] - Current Username: DeadlyUriel (Admin)
[05/17/2008, 12:05:15] - Windows is in NORMAL mode.
[05/17/2008, 12:05:15] - Searching for Browser Helper Objects:
[05/17/2008, 12:05:15] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:05:15] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:05:15] - BHO 3: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUlkIYR
[05/17/2008, 12:05:15] - Found: HKLM\...\Winlogon\Notify\wvUlkIYR - This is probably Virtumundo.
[05/17/2008, 12:05:15] - Assigning {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} MSEvents Object
[05/17/2008, 12:05:15] - BHO list has been changed! Starting over...
[05/17/2008, 12:05:15] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:05:15] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:05:15] - BHO 3: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} (MSEvents Object)
[05/17/2008, 12:05:15] - ALERT: Found MSEvents Object!
[05/17/2008, 12:05:15] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/17/2008, 12:05:15] - BHO 5: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
[05/17/2008, 12:05:15] - BHO 6: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
[05/17/2008, 12:05:15] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[05/17/2008, 12:05:15] - BHO 8: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
[05/17/2008, 12:05:15] - BHO 9: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
[05/17/2008, 12:05:15] - Finished Searching Browser Helper Objects
[05/17/2008, 12:05:15] - *** Detected MSEvents Object
[05/17/2008, 12:05:16] - Trying to remove MSEvents Object...
[05/17/2008, 12:05:17] - Terminating Process: IEXPLORE.EXE
[05/17/2008, 12:05:17] - Terminating Process: RUNDLL32.EXE
[05/17/2008, 12:05:17] - Disabling Automatic Shell Restart
[05/17/2008, 12:05:17] - Terminating Process: EXPLORER.EXE
[05/17/2008, 12:05:17] - Suspending the NT Session Manager System Service
[05/17/2008, 12:05:17] - Terminating Windows NT Logon/Logoff Manager
[05/17/2008, 12:05:18] - Re-enabling Automatic Shell Restart
[05/17/2008, 12:05:18] - File to disable: C:\WINDOWS\system32\wvUlkIYR.dll
[05/17/2008, 12:05:18] - Renaming C:\WINDOWS\system32\wvUlkIYR.dll -> C:\WINDOWS\system32\wvUlkIYR.dll.vir
[05/17/2008, 12:05:18] - File successfully renamed!
[05/17/2008, 12:05:18] - Removing HKLM\...\Browser Helper Objects\{6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
[05/17/2008, 12:05:18] - Removing HKCR\CLSID\{6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
[05/17/2008, 12:05:18] - Adding Kill Bit for ActiveX for GUID: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
[05/17/2008, 12:05:18] - Deleting ATLEvents/MSEvents Registry entries
[05/17/2008, 12:05:18] - Removing HKLM\...\Winlogon\Notify\wvUlkIYR
[05/17/2008, 12:05:18] - Searching for Browser Helper Objects:
[05/17/2008, 12:05:18] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:05:18] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:05:18] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/17/2008, 12:05:18] - BHO 4: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
[05/17/2008, 12:05:18] - BHO 5: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
[05/17/2008, 12:05:18] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[05/17/2008, 12:05:18] - BHO 7: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
[05/17/2008, 12:05:18] - BHO 8: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
[05/17/2008, 12:05:18] - Finished Searching Browser Helper Objects
[05/17/2008, 12:05:18] - Finishing up...
[05/17/2008, 12:05:18] - A restart is needed.
[05/17/2008, 12:05:31] - Attempting to Restart via STOP error (Blue Screen!)
[05/17/2008, 12:07:22] - VirtumundoBeGone v1.5 ( "D:\Download\VirtumundoBeGone.exe" )
[05/17/2008, 12:07:30] - Detected System Information:
[05/17/2008, 12:07:30] - Windows Version: 5.1.2600, Service Pack 2
[05/17/2008, 12:07:30] - Current Username: DeadlyUriel (Admin)
[05/17/2008, 12:07:30] - Windows is in NORMAL mode.
[05/17/2008, 12:07:30] - Searching for Browser Helper Objects:
[05/17/2008, 12:07:30] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:07:30] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:07:30] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/17/2008, 12:07:30] - BHO 4: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
[05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
[05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
[05/17/2008, 12:07:31] - BHO 5: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
[05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
[05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
[05/17/2008, 12:07:31] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[05/17/2008, 12:07:31] - BHO 7: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
[05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
[05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
[05/17/2008, 12:07:31] - BHO 8: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
[05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
[05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
[05/17/2008, 12:07:31] - Finished Searching Browser Helper Objects
[05/17/2008, 12:07:31] - Finishing up...
[05/17/2008, 12:07:31] - Nothing found! Exiting...
S'agissant d'une session commune a plusieurs personnes ( Session XP)
Je ne sais pas ce qui a ete changer recemment sur le pc :s
[05/17/2008, 12:05:05] - VirtumundoBeGone v1.5 ( "D:\Download\VirtumundoBeGone.exe" )
[05/17/2008, 12:05:15] - Detected System Information:
[05/17/2008, 12:05:15] - Windows Version: 5.1.2600, Service Pack 2
[05/17/2008, 12:05:15] - Current Username: DeadlyUriel (Admin)
[05/17/2008, 12:05:15] - Windows is in NORMAL mode.
[05/17/2008, 12:05:15] - Searching for Browser Helper Objects:
[05/17/2008, 12:05:15] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:05:15] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:05:15] - BHO 3: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUlkIYR
[05/17/2008, 12:05:15] - Found: HKLM\...\Winlogon\Notify\wvUlkIYR - This is probably Virtumundo.
[05/17/2008, 12:05:15] - Assigning {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} MSEvents Object
[05/17/2008, 12:05:15] - BHO list has been changed! Starting over...
[05/17/2008, 12:05:15] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:05:15] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:05:15] - BHO 3: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} (MSEvents Object)
[05/17/2008, 12:05:15] - ALERT: Found MSEvents Object!
[05/17/2008, 12:05:15] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/17/2008, 12:05:15] - BHO 5: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
[05/17/2008, 12:05:15] - BHO 6: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
[05/17/2008, 12:05:15] - BHO 7: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[05/17/2008, 12:05:15] - BHO 8: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
[05/17/2008, 12:05:15] - BHO 9: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
[05/17/2008, 12:05:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:15] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
[05/17/2008, 12:05:15] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
[05/17/2008, 12:05:15] - Finished Searching Browser Helper Objects
[05/17/2008, 12:05:15] - *** Detected MSEvents Object
[05/17/2008, 12:05:16] - Trying to remove MSEvents Object...
[05/17/2008, 12:05:17] - Terminating Process: IEXPLORE.EXE
[05/17/2008, 12:05:17] - Terminating Process: RUNDLL32.EXE
[05/17/2008, 12:05:17] - Disabling Automatic Shell Restart
[05/17/2008, 12:05:17] - Terminating Process: EXPLORER.EXE
[05/17/2008, 12:05:17] - Suspending the NT Session Manager System Service
[05/17/2008, 12:05:17] - Terminating Windows NT Logon/Logoff Manager
[05/17/2008, 12:05:18] - Re-enabling Automatic Shell Restart
[05/17/2008, 12:05:18] - File to disable: C:\WINDOWS\system32\wvUlkIYR.dll
[05/17/2008, 12:05:18] - Renaming C:\WINDOWS\system32\wvUlkIYR.dll -> C:\WINDOWS\system32\wvUlkIYR.dll.vir
[05/17/2008, 12:05:18] - File successfully renamed!
[05/17/2008, 12:05:18] - Removing HKLM\...\Browser Helper Objects\{6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
[05/17/2008, 12:05:18] - Removing HKCR\CLSID\{6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
[05/17/2008, 12:05:18] - Adding Kill Bit for ActiveX for GUID: {6C23AB0C-0244-4B01-8253-BEE724D0D2EC}
[05/17/2008, 12:05:18] - Deleting ATLEvents/MSEvents Registry entries
[05/17/2008, 12:05:18] - Removing HKLM\...\Winlogon\Notify\wvUlkIYR
[05/17/2008, 12:05:18] - Searching for Browser Helper Objects:
[05/17/2008, 12:05:18] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:05:18] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:05:18] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/17/2008, 12:05:18] - BHO 4: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
[05/17/2008, 12:05:18] - BHO 5: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
[05/17/2008, 12:05:18] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[05/17/2008, 12:05:18] - BHO 7: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
[05/17/2008, 12:05:18] - BHO 8: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
[05/17/2008, 12:05:18] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:05:18] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
[05/17/2008, 12:05:18] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
[05/17/2008, 12:05:18] - Finished Searching Browser Helper Objects
[05/17/2008, 12:05:18] - Finishing up...
[05/17/2008, 12:05:18] - A restart is needed.
[05/17/2008, 12:05:31] - Attempting to Restart via STOP error (Blue Screen!)
[05/17/2008, 12:07:22] - VirtumundoBeGone v1.5 ( "D:\Download\VirtumundoBeGone.exe" )
[05/17/2008, 12:07:30] - Detected System Information:
[05/17/2008, 12:07:30] - Windows Version: 5.1.2600, Service Pack 2
[05/17/2008, 12:07:30] - Current Username: DeadlyUriel (Admin)
[05/17/2008, 12:07:30] - Windows is in NORMAL mode.
[05/17/2008, 12:07:30] - Searching for Browser Helper Objects:
[05/17/2008, 12:07:30] - BHO 1: {0114B490-0685-491C-915B-EC3941564285} ()
[05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\wvUoOhFU
[05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\wvUoOhFU, continuing.
[05/17/2008, 12:07:30] - BHO 2: {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} ()
[05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\ddcBTNGx
[05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\ddcBTNGx, continuing.
[05/17/2008, 12:07:30] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/17/2008, 12:07:30] - BHO 4: {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} ()
[05/17/2008, 12:07:30] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:30] - Checking for HKLM\...\Winlogon\Notify\qoMfcBQJ
[05/17/2008, 12:07:30] - Key not found: HKLM\...\Winlogon\Notify\qoMfcBQJ, continuing.
[05/17/2008, 12:07:31] - BHO 5: {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} ()
[05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\rynrvkvu
[05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\rynrvkvu, continuing.
[05/17/2008, 12:07:31] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[05/17/2008, 12:07:31] - BHO 7: {B02982FF-CC0C-4247-8275-9A57B8AC86DE} ()
[05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\awtspQHw
[05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\awtspQHw, continuing.
[05/17/2008, 12:07:31] - BHO 8: {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} ()
[05/17/2008, 12:07:31] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/17/2008, 12:07:31] - Checking for HKLM\...\Winlogon\Notify\ssqPffeE
[05/17/2008, 12:07:31] - Key not found: HKLM\...\Winlogon\Notify\ssqPffeE, continuing.
[05/17/2008, 12:07:31] - Finished Searching Browser Helper Objects
[05/17/2008, 12:07:31] - Finishing up...
[05/17/2008, 12:07:31] - Nothing found! Exiting...
S'agissant d'une session commune a plusieurs personnes ( Session XP)
Je ne sais pas ce qui a ete changer recemment sur le pc :s
sKe69
Messages postés
21360
Date d'inscription
samedi 15 mars 2008
Statut
Contributeur sécurité
Dernière intervention
30 décembre 2012
463
17 mai 2008 à 12:18
17 mai 2008 à 12:18
t'inquiete le fix a fait son boulot mais c'est loin d'être finis ;)
Le nouveau rapport Hijackt stp ... ( tu verras , normalement la ligne 20 a du disparaitre ... )
Le nouveau rapport Hijackt stp ... ( tu verras , normalement la ligne 20 a du disparaitre ... )
UrielAsleep
Messages postés
151
Date d'inscription
dimanche 16 mars 2008
Statut
Membre
Dernière intervention
24 février 2010
9
17 mai 2008 à 12:20
17 mai 2008 à 12:20
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:18:19, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\DeadlyUriel\Bureau\Weh\WoWEmuHacker4.3.exe
C:\WINDOWS\DSCoreItem.dsf
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0114B490-0685-491C-915B-EC3941564285} - C:\WINDOWS\system32\wvUoOhFU.dll (file missing)
O2 - BHO: (no name) - {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} - C:\WINDOWS\system32\ddcBTNGx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} - C:\WINDOWS\system32\qoMfcBQJ.dll (file missing)
O2 - BHO: {cc9063d3-d867-99c8-b7f4-df2b039fe5f8} - {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} - C:\WINDOWS\system32\rynrvkvu.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B02982FF-CC0C-4247-8275-9A57B8AC86DE} - C:\WINDOWS\system32\awtspQHw.dll (file missing)
O2 - BHO: (no name) - {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} - C:\WINDOWS\system32\ssqPffeE.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [e46ee959] rundll32.exe "C:\WINDOWS\system32\aphaycbd.dll",b
O4 - HKLM\..\Run: [BMe75ddac5] Rundll32.exe "C:\WINDOWS\system32\xevfstbg.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Scan saved at 12:18:19, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\DeadlyUriel\Bureau\Weh\WoWEmuHacker4.3.exe
C:\WINDOWS\DSCoreItem.dsf
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0114B490-0685-491C-915B-EC3941564285} - C:\WINDOWS\system32\wvUoOhFU.dll (file missing)
O2 - BHO: (no name) - {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} - C:\WINDOWS\system32\ddcBTNGx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} - C:\WINDOWS\system32\qoMfcBQJ.dll (file missing)
O2 - BHO: {cc9063d3-d867-99c8-b7f4-df2b039fe5f8} - {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} - C:\WINDOWS\system32\rynrvkvu.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B02982FF-CC0C-4247-8275-9A57B8AC86DE} - C:\WINDOWS\system32\awtspQHw.dll (file missing)
O2 - BHO: (no name) - {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} - C:\WINDOWS\system32\ssqPffeE.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [e46ee959] rundll32.exe "C:\WINDOWS\system32\aphaycbd.dll",b
O4 - HKLM\..\Run: [BMe75ddac5] Rundll32.exe "C:\WINDOWS\system32\xevfstbg.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
sKe69
Messages postés
21360
Date d'inscription
samedi 15 mars 2008
Statut
Contributeur sécurité
Dernière intervention
30 décembre 2012
463
17 mai 2008 à 12:23
17 mai 2008 à 12:23
maintenant , un coup de massue =)
Télécharges MalwareByte's : ftp://ftp.commentcamarche.com/download/mbam-setup.exe
un tuto sympa : https://forum.pcastuces.com/sujet.asp?f=31&s=3
Instales le et mets le à jour .
Puis redémarres en mode sans échec :
Comment aller en Mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
Lances Malwarebyte's .
Fais un scan dit "complet" et supprimes tout ce qu'il peut trouver ...
Redémarres ton PC (mode normal ).
Postes le rapport sauvegardé après la supression des objets infectés (dans l'onglet "rapport/log") accompagné d'un nouvel hijackthis ...
Télécharges MalwareByte's : ftp://ftp.commentcamarche.com/download/mbam-setup.exe
un tuto sympa : https://forum.pcastuces.com/sujet.asp?f=31&s=3
Instales le et mets le à jour .
Puis redémarres en mode sans échec :
Comment aller en Mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
Lances Malwarebyte's .
Fais un scan dit "complet" et supprimes tout ce qu'il peut trouver ...
Redémarres ton PC (mode normal ).
Postes le rapport sauvegardé après la supression des objets infectés (dans l'onglet "rapport/log") accompagné d'un nouvel hijackthis ...
UrielAsleep
Messages postés
151
Date d'inscription
dimanche 16 mars 2008
Statut
Membre
Dernière intervention
24 février 2010
9
17 mai 2008 à 13:49
17 mai 2008 à 13:49
Donc merci j'ai fais tout ce que tu m'as dis cela fonctionne parfaitement, j'envois quand meme les rapports hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:48:13, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0114B490-0685-491C-915B-EC3941564285} - C:\WINDOWS\system32\wvUoOhFU.dll (file missing)
O2 - BHO: (no name) - {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} - C:\WINDOWS\system32\ddcBTNGx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} - C:\WINDOWS\system32\qoMfcBQJ.dll (file missing)
O2 - BHO: {cc9063d3-d867-99c8-b7f4-df2b039fe5f8} - {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} - C:\WINDOWS\system32\rynrvkvu.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B02982FF-CC0C-4247-8275-9A57B8AC86DE} - C:\WINDOWS\system32\awtspQHw.dll (file missing)
O2 - BHO: (no name) - {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} - C:\WINDOWS\system32\ssqPffeE.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:48:13, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0114B490-0685-491C-915B-EC3941564285} - C:\WINDOWS\system32\wvUoOhFU.dll (file missing)
O2 - BHO: (no name) - {6862F20A-C3E7-4BAA-B5A4-282375EC5CF4} - C:\WINDOWS\system32\ddcBTNGx.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7A54946D-91C1-4A04-B3F9-5849BA99A5EE} - C:\WINDOWS\system32\qoMfcBQJ.dll (file missing)
O2 - BHO: {cc9063d3-d867-99c8-b7f4-df2b039fe5f8} - {8f5ef930-b2fd-4f7b-8c99-768d3d3609cc} - C:\WINDOWS\system32\rynrvkvu.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B02982FF-CC0C-4247-8275-9A57B8AC86DE} - C:\WINDOWS\system32\awtspQHw.dll (file missing)
O2 - BHO: (no name) - {F7F9340D-881C-418F-A3DA-C45EF26F0FDD} - C:\WINDOWS\system32\ssqPffeE.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
sKe69
Messages postés
21360
Date d'inscription
samedi 15 mars 2008
Statut
Contributeur sécurité
Dernière intervention
30 décembre 2012
463
17 mai 2008 à 13:54
17 mai 2008 à 13:54
ce n'est pas finit !
Fait ce-ci :
Télécharges ComboFix (par sUBs) sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide .
Démarrer en mode sans echec :
Comment aller en Mode sans échec
1) Redémarres ton ordi
2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...)
Double cliquer combofix.exe.
Appuyer sur la touche Y (Yes) pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
---> si un message d'erreur windows apparait à un momment , clik sur la croix en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! )
Le rapport sera crée dans: C:\Combofix.txt
Redémarres ton PC ( mode normal )
Postes le rapport combo fix et un nouveau rapport hijackthis pour analyse .
Fait ce-ci :
Télécharges ComboFix (par sUBs) sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide .
Démarrer en mode sans echec :
Comment aller en Mode sans échec
1) Redémarres ton ordi
2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...)
Double cliquer combofix.exe.
Appuyer sur la touche Y (Yes) pour démarrer le scan .
Attention : n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
---> si un message d'erreur windows apparait à un momment , clik sur la croix en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! )
Le rapport sera crée dans: C:\Combofix.txt
Redémarres ton PC ( mode normal )
Postes le rapport combo fix et un nouveau rapport hijackthis pour analyse .
17 mai 2008 à 11:43
17 mai 2008 à 11:54
de meme SpyBot n'a detecter aucun virtumonde