Win32 Trojano-1165 !! Résolu

Question

Bonjour,

Tout à commencé ce matin lorsque j'ai eu un message d'erreur des mises a jours windows " il se peut que votre ordinateur court un risque". Ca ma interpellé car mes mises a jours sont mise en mode automatique et là mon ordi me prétent qu'elles ne le sont pas, je n'ai toujours pas su réglé ce pblem. 

Il y a une heure avast à reperé un virus appelé WIN32 trojano 1165 je le supprime mais il revient sans arrêt. 


J'aimerais rapidement corriger et supprimer ces problemes car j'ai l'impression que mon ordi a de plus en plus de mal. J'ai passé ma journée a faire des scans avec avast, spybot et ad-aware, cc cleaner sans succès. 


Je suis novice en pc donc si qqn pourrait m'aider ce serais grandement apprécié, j'ai bcp de travaux à rendre pour le moment et si mon pc me lache mnt ca sera très compliqué.


Merci d'avance

Aurélien

Utilisateur anonyme · Answer

bonjour

Télécharge SmitfraudFix
Utilitaire de S!Ri: Moe et balltrap34
http://siri.urz.free.fr/Fix/SmitfraudFix.php
et télécharge SmitfraudFix.exe.

Regarde le tuto

Exécute le en choisissant l’option 1,
il va générer un rapport
Copie/colle le sur le poste stp.

nikitabe · Answer

merci pour ta réponse,

je viens de faire un rapport avec hijackthis je sais pas si c pareille, je le colle ici, ensuite je ferais pareille avec smitfraud
(sauf si tu me dis que c inutile)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:15:50, on 18/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
I:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows TaskManager] tskmngr.exe
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\Run: [BMc3f3881e] Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s
O4 - HKLM\..\RunServices: [Windows TaskManager] tskmngr.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingA5661] command /c del "C:\WINDOWS\system32\efcCvWPI.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7485] cmd /c del "C:\WINDOWS\system32\efcCvWPI.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2786] command /c del "C:\WINDOWS\system32\pmnnMcDS.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6651] cmd /c del "C:\WINDOWS\system32\pmnnMcDS.dll_old"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

nikitabe · Answer

Salut,

voila j'ai fait un scan avec smitfraud, 

voila le rapport ci dessous!



SmitFraudFix v2.320

Rapport fait à 17:38:43,03, dim. 18/05/2008
Executé à partir de I:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Aur‚


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Aur‚\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\AUR~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: IEEE 802.11g Wireless Cardbus/PCI Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.2.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{8196ABCF-145A-48C7-BD91-F38ADD39FC7A}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8196ABCF-145A-48C7-BD91-F38ADD39FC7A}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{8196ABCF-145A-48C7-BD91-F38ADD39FC7A}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

relance smitfraud en mode sans echec et fait option 2

tuto pour le mode sans echec


http://www.coupdepoucepc.com/modules/news/article.php?storyid=253
https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

nikitabe · Answer

je l'ai fait, j'ai reçu un genre de rapport vraiment vraiment très long, tu veu que je le post? 

sinon là mon pc est en mode sans échec et est en train d'être scanné par antivir, tu me conseil d'attendre?


je te mets mon dernier rapport hijackthis: 

suis je encore infecté ?




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:23:57, on 18/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\WINDOWS\explorer.exe
I:\monjack.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - C:\WINDOWS\system32\wvUoLfcy.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A1625BB5-1E3F-4A3C-8DD6-2C5D23DA5362} - (no file)
O2 - BHO: (no name) - {A626164C-2DCB-4E3D-80C0-53D502F02B72} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {C30AC983-FAC3-456E-8BBA-4BDFD319D9DD} - (no file)
O2 - BHO: (no name) - {C72118C7-E382-44B9-A0EA-34C6B9B0717A} - C:\WINDOWS\system32\efcAsQJc.dll
O2 - BHO: (no name) - {CB4B70CE-EDC9-47B3-B922-FE9CB4A41B9C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows TaskManager] tskmngr.exe
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\Run: [BMc3f3881e] Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunServices: [Windows TaskManager] tskmngr.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingA5661] command /c del "C:\WINDOWS\system32\efcCvWPI.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7485] cmd /c del "C:\WINDOWS\system32\efcCvWPI.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2786] command /c del "C:\WINDOWS\system32\pmnnMcDS.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6651] cmd /c del "C:\WINDOWS\system32\pmnnMcDS.dll_old"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O20 - Winlogon Notify: wvUoLfcy - C:\WINDOWS\SYSTEM32\wvUoLfcy.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

oui envoie le rapport stp

Utilisateur anonyme · Answer

fixe ces lignes

O4 - HKLM\..\RunOnce: [SpybotDeletingA5661] command /c del "C:\WINDOWS\system32\efcCvWPI.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7485] cmd /c del "C:\WINDOWS\system32\efcCvWPI.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2786] command /c del "C:\WINDOWS\system32\pmnnMcDS.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6651] cmd /c del "C:\WINDOWS\system32\pmnnMcDS.dll_old"

Utilisateur anonyme · Answer

ensuite fait ceci

bitdefender online

uniquement avec internet explorer

http://www.bitdefender.fr/scan_fr/scan8/ie.html

et poste le rapport

mais java a jour

https://www.java.com/fr/download/manual.jsp 

desinstalle deamon tool il comporte un adaware
et surtout vire bitcomet tu as surment pris cette saloperie par ce biais

nikitabe · Answer

j'ai fixer mes ligne avec hijackthis, 

puis j'ai redemarrer, et j'ai denouveau eu mon msg d'alerte de antivir  qui me dit que le fichier suivant est un cheval TR/Crypt.XPACK.Gen et qu'il est placé dans C:/Windows/System32/efcAsQJc.dll 

ca me bloque tout mon ordi, ce msg aparait toutes les 15 sec sans possibilté de le supprimer,

impossible davoir une page internet, je vous écrit de mon portable qui heureusement est sain. 

donc je passe un Sdfix en mode sans echec puis je mets le rapport hijackthis en ligne, 


désoler de pomper votre temps mais c'est très important. 


daemon tool et bit comet seront supprimer des que mon ordi m'autorise a l'utiliser, 

il n'y a que le mode sans échec qui fonctionne pour le moment c vraiment la galere

nikitabe · Answer

VOila!


ci joint le rapport du SD fix plus le Nouveau HijackThis!

Merci de me tenir au courant de la suite des opérations,

ps: lorsque mon ordi s'est ralumé toujours ce meme msd de contamination de antivir, le cheval s'appelle visiblement, TR/Crypt.XPACK.Gen et il est dans le fichier de C:/Windows/system32/efcAsQJc.dll

evidement il n'y a pas moyen de le supprimer, ni manuellement, ni avec antivir!


merci de votre aide,

rapport SDFIX




[b]SDFix: Version 1.183 /b
Run by Aur‚ on dim. 18/05/2008 at 22:00

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files /b:

No Trojan Files Found






Removing Temp Files

[b]ADS Check /b:



[b]Final Check /b:

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-18 22:12:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C­53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:22,9e,00,aa,dc,07,07,10,d1,ca,08,45,f8,a0,99,87,0c,6a,33,5f,f0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C­53EA4\00000001]
"a0"=hex:20,01,00,00,35,6a,bc,53,c2,f8,10,d5,fd,72,79,30,13,87,b1,c2,cb,..
"khjeh"=hex:c4,51,40,df,cc,50,65,f7,b2,11,fa,35,46,66,66,c0,85,d2,0d,1a,49,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C­53EA4\00000001\0Jf40]
"khjeh"=hex:c2,96,4b,d1,22,a1,ac,97,27,bc,c7,78,e1,b6,14,31,95,54,ec,95,a4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C­53EA4\00000001\0Jf41]
"khjeh"=hex:88,fd,98,8a,1d,c6,e9,72,2f,5a,cd,32,ae,88,60,e7,fd,11,76,2a,f2,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA­4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:22,9e,00,aa,dc,07,07,10,d1,ca,08,45,f8,a0,99,87,0c,6a,33,5f,f0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA­4\00000001]
"a0"=hex:20,01,00,00,35,6a,bc,53,c2,f8,10,d5,fd,72,79,30,13,87,b1,c2,cb,..
"khjeh"=hex:c4,51,40,df,cc,50,65,f7,b2,11,fa,35,46,66,66,c0,85,d2,0d,1a,49,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA­4\00000001\0Jf40]
"khjeh"=hex:c2,96,4b,d1,22,a1,ac,97,27,bc,c7,78,e1,b6,14,31,95,54,ec,95,a4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA­4\00000001\0Jf41]
"khjeh"=hex:88,fd,98,8a,1d,c6,e9,72,2f,5a,cd,32,ae,88,60,e7,fd,11,76,2a,f2,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpoli­cy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enable­d:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe"="C:\WINDOWS\­\system32\ZoneLabs\avsys\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\GRAW.exe"="C:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\GRAW.exe:*:Enabled:GRAW"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe"="C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe"="C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Game.exe"="C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Game.exe:*:Enabled:Rainbow Six Vegas"
"C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Launcher.exe"="C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas\Binaries\R6Vegas_Launcher.exe:*:Enabled:Rainbow Six Vegas Updater"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpoli­cy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enable­d:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files /b:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes /b:

Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Aug 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 6 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 21 Mar 2008 1,301 ...HR --- "C:\Documents and Settings\Aur‚\Application Data\SecuROM\UserData\securom_v7_01.bak"

[b]Finished!/b







RAPPORT HIJACKTHIS






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:22:04, on 18/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
I:\monjack.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - C:\WINDOWS\system32\wvUoLfcy.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A1625BB5-1E3F-4A3C-8DD6-2C5D23DA5362} - (no file)
O2 - BHO: (no name) - {A626164C-2DCB-4E3D-80C0-53D502F02B72} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {C30AC983-FAC3-456E-8BBA-4BDFD319D9DD} - (no file)
O2 - BHO: (no name) - {CA72A96A-DB17-45CF-BE2A-23A5E4A84125} - C:\WINDOWS\system32\efcAsQJc.dll
O2 - BHO: (no name) - {CB4B70CE-EDC9-47B3-B922-FE9CB4A41B9C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BMc3f3881e] Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s
O4 - HKLM\..\RunServices: [Windows TaskManager] tskmngr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O20 - Winlogon Notify: wvUoLfcy - C:\WINDOWS\SYSTEM32\wvUoLfcy.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

nikitabe · Answer

help!

Utilisateur anonyme · Answer

slt

je suis au boulot je te reprend ce soir si tu veux fait le scan avec bitdefender
sur ton log hijackthis fixe toutes les lignes ou a la fin il y as (no file) mais tu es encore infecter car dans ton rapport il y as encore 2 lignes qui le dit

nikitabe · Answer

Merci, 

la mise à jour de bitdefender se bloque toujours aux alentours de 70% as tu une solution? 

au sinon à ce soir! 

si j'arrive à obtenir un scan avec bitdefender je posterais le rapport ainsi qu'un récent hijackthis


Nikita

Utilisateur anonyme · Answer

essaye ceci 

> Télécharge, puis installe MSNFix (de !aur3n7) : http://sosvirus.changelog.fr/MSNFix.zip , tuto de Malekal : https://www.malekal.com/supprimer-virus-desinfecter-pc/ (si tu as besion).
- Décompresse donc le dossier zip MSNFix et lance le fichier "MSNFix.bat". Une fenêtre bleue doit apparaitre.
- Mets l'interface en français en appuyant sur la touche F puis sur Entrée.
- Lance la recherche de virus en appuyant sur la touche R puis sur Entrée.
Si un virus est détecté, il te sera alors demandé de nettoyer l'ordinateur.
Un message d'erreur concernant la suppression impossible d'un fichier sera résolu par un redémarrage.
Après le nettoyage, la barre "Démarrer" s'efface puis réapparait, cela fait partie de la procédure de nettoyage.
- Poste le rapport qui s'ouvre en fin de nettoyage sur le forum stp.

Si ta barre "Démarrer" ne s'affiche toujours pas, il suffit de faire :
Ctrl + Alt + Suppr (sous Windows XP), ou Ctrl + Maj + Echap (sous Windows Vista) pour ouvrir le Gestionnaire de tâches Windows.
- Fais ensuite "Fichier", puis "Nouvelle tâche" et entre explorer.exe dans la fenêtre qui apparait et finis par "OK".

- redémarre ton ordinateur pour achever le nettoyage !

dou-l · Answer

salut sur la demande de shion-aires je vien donner un coup de main ^^

Oublie msnfix stp .

Puis fais ca :



Telecharge malwarebytes

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.


A+

Utilisateur anonyme · Answer

merci j'avais pas penser a cela

nikitabe · Answer

Bonjour dou-l,

Merci pour le relais ;) 


WOaw il a l'aire plutôt efficace ton petit programme!

j'ai fais un scan, il m'a trouver 11 infections, voila le rapport ci joint,


tiens moi au courant de la suite des événements! 


nikita

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 767

Type de recherche: Examen complet (C:\|)
Eléments examinés: 267265
Temps écoulé: 1 hour(s), 2 minute(s), 13 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 11
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\qoMgheeC.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\wvUoLfcy.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1d4be829-54c7-4c7b-98d3-e16837ee5cb1} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{1d4be829-54c7-4c7b-98d3-e16837ee5cb1} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6c23ab0c-0244-4b01-8253-bee724d0d2ec} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6c23ab0c-0244-4b01-8253-bee724d0d2ec} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvuolfcy (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMc3f3881e (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6c23ab0c-0244-4b01-8253-bee724d0d2ec} (Trojan.Vundo) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\qomgheec -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\qomgheec  -> Delete on reboot.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\eeutlvsf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fsvltuee.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hnagpjbl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lbjpganh.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qoMgheeC.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\CeehgMoq.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\CeehgMoq.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bppiescu.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\wvUoLfcy.dll (Trojan.Vundo) -> Delete on reboot.

dou-l · Answer

Tu as redémarer le PC ? Si tu ne la pas fait redémarre le puis dis tes soucis actuel !!

nikitabe · Answer

oui j'ai redémarré lorsque malewarebyte me l'a demandé, 

mais bisarement au reboot je n'ai eu aucune nouvelles du programme,

 alors j'ai pensé  que les infections ont été supprimée silencieusement? ce n'est pas le cas?

dou-l · Answer

Recolle un rapport hijackthis stp

nikitabe · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:12:07, on 19/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Hijackthis\monjack.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07B4938A-E6E1-43BF-8018-3EA5D530C381} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {E545846B-F484-446C-9F09-063B01CD777C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O20 - Winlogon Notify: wvUoLfcy - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

nikitabe · Answer

Je dois fixer les " (no file)" je suppose, et il y a autre chose? 

Merci de ton aide!

dou-l · Answer

Attend je suis allez demandé quelque chose car il y a quelquechose qui me chagrine sur ton rapport.

nikitabe · Answer

argh :s 

ok, j'attends

dou-l · Answer

re,

On ma donné la marche a suivre


Télécharger OAD (Outil d'Aide au Diagnostic) < http://sosvirus.changelog.fr/OAD.exe >
&#8594; Enregistre-le sur ton bureau
&#8594; Lancer 'OAD.exe' en faisant un double clique sur le fichier
&#8594; Saisir la valeur recherchée -> svehost.exe ( fait un copier/coller )
&#8594; Type de recherche : sélectionner l'option 6 puis valide [entrée]
&#8594; OAD va maintenant rechercher le fichier.
&#8594; Laisse-le travailler jusqu'à ce qu'il en ait terminé.
&#8594; Suivant la taille des disques durs, cette recherche peut prendre plusieurs minutes.

------------- Patienter. --------------

&#8594; Le rapport de recherche s'affichera automatiquement dès qu'il en aura terminé.
&#8594; Faire un copier/coller de ce rapport dans ton prochain post.


(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note: Certains Antivirus peuvent émettre une alerte lors du téléchargement / utilisation > ignore

nikitabe · Answer

VOila voila, 


 lun. 19/05/2008 ---- 17:37:19,60  

----------------------------------
§§§§§§ [svehost.exe] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Updates"="svehost.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Updates"="svehost.exe"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

nikitabe · Answer

je fais quoi ensuite? 

désolé de pousser; j'imagine que tes appelés dans tout les coins et que ta du boulot, mais j'ai énormément de travail en retard, mon pc plante est infecté depuis dimanche matin et je veus être sur que tout est en ordre avant de me lancer.

merci de me dire ce que je dois faire, :-)

nik,

dou-l · Answer

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\

Crée un nouveau document texte : clic droit de souris sur le bureau, "Nouveau"> "Document Texte". Ouvre-le et copie-colle dedans de ce qui est en citation en gras ci-dessous, (copie tout d'un trait) : ( y compris Regedit4, et la ligne vide en dessous )

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Updates"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Updates"=-




Puis "fichier" -> "enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

Cela doit ressembler à ça

Double clique sur fix.reg

&#8594; tu dois OBLIGATOIREMENT* avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

*Prevenir si le message n'apparait pas. 

Puis reposte un hijackthis stp


a+

nikitabe · Answer

j'ai vu que t'avais répondus à mon message, sur la page du forum,

mais dans la discussion ici il n'apparait pas chez moi, tu sais le renvoyer?

dou-l · Answer

Moi aussi ca me la fait mais maintenant c'est bon la manip y est c'est juste un petit bug !!

nikitabe · Answer

okok, scuz le forum dois etre busy! 


voila les démarche se sont bien passée comme prévu, donc ci joint un nouveau hijackthis




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:14:47, on 19/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Hijackthis\monjack.exe
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWSegedit.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07B4938A-E6E1-43BF-8018-3EA5D530C381} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {E545846B-F484-446C-9F09-063B01CD777C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O20 - Winlogon Notify: wvUoLfcy - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

nikitabe · Answer

ps: lorsque j'ai fais la manip, spybot ma demander de confirmer une changement important dans le registre, j'ai accpepter,
puis directement après un autre message s'est affiché ; 

catégorie : system start up global entry
modif : valeur supprimée 
element: microsoft updates
ancienne valeurs; svehost.exe


je confirme la modification du registre ou pas? depuis ce qui m'est arrivé je me méfie, (peu etre un peu trop!)

dou-l · Answer

Ok

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: (no name) - {07B4938A-E6E1-43BF-8018-3EA5D530C381} - (no file)  
O2 - BHO: (no name) - {6C23AB0C-0244-4B01-8253-BEE724D0D2EC} - (no file)
O2 - BHO: (no name) - {E545846B-F484-446C-9F09-063B01CD777C} - (no file) 
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install 

et dit tes soucis actuel

nikitabe · Answer

voila j'ai fixer mes lignes, 

puis j'ai redemarrer, et toujours le message d'erreur des mises a jours automatiques comme au début du probleme, j'ai pas l'impression d'etre totalement sain, je reposte un hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:38:56, on 19/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\monjack.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O20 - Winlogon Notify: wvUoLfcy - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

dou-l · Answer

confirme stp puis dis moi

nikitabe · Answer

ok, j'ai l'impression que je me suis tromper dans divers modifications, je ne sais plus ce qui est bon de ce qui ne l'est pas. 

Peut me dire si il y a des choses à autoriser/refuser? 

et comment savoir si les modifications registres sont normal ou néfaste? des fois j'en ai 10 d'un coup qui viennent alors je les refuse toutes c bien trop suspect. 


enfin si ça t'intéresse jette y un œil et dis moi ;)








18/05/2008 16:11:14 Autorisé(e) (based on user decision) value "Spybot - Search & Destroy" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:11:29 Refusé(e) (based on user decision) value "SpybotDeletingA5661" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:11:31 Refusé(e) (based on user decision) value "SpybotDeletingC7485" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:11:35 Refusé(e) (based on user decision) value "SpybotDeletingA2786" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:11:37 Refusé(e) (based on user decision) value "SpybotDeletingC6651" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:14:46 Autorisé(e) (based on user decision) value "{A1625BB5-1E3F-4A3C-8DD6-2C5D23DA5362}" (new data: "") ajouté(e) in Browser Helper Object!
18/05/2008 16:15:41 Refusé(e) (based on user decision) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:42 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:43 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:44 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:45 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:46 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:47 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:48 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:49 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:50 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:52 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:53 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:54 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:55 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:56 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:57 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:58 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:15:59 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:18 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:21 Refusé(e) (based on user blacklist) value "SpybotDeletingA5661" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:19:23 Refusé(e) (based on user blacklist) value "SpybotDeletingC7485" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:19:23 Refusé(e) (based on user blacklist) value "SpybotDeletingA2786" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:19:24 Refusé(e) (based on user blacklist) value "SpybotDeletingC6651" (new data: "") supprimé(e) in System Startup global entry!
18/05/2008 16:19:25 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:27 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:28 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:29 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:32 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:33 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:36 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:37 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:39 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:40 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:42 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:43 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:44 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:46 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:47 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:48 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:49 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:50 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:51 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:52 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:54 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:56 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:57 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:58 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:19:59 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:00 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:01 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:02 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:04 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:05 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:06 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:07 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:08 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:09 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:10 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:11 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:12 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:13 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:14 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:15 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:16 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:17 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:18 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:19 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:20 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:21 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:22 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:23 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:24 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:25 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:26 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:27 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:28 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:29 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:30 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:31 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:32 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:33 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:34 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:35 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:36 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:37 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:38 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:39 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:41 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:42 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:43 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:44 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:45 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:46 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:47 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:48 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:49 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:50 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:51 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:52 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:53 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:54 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:55 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:57 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:58 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:20:59 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:00 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:01 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:02 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:03 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:04 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:06 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:07 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:08 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:09 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:10 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:11 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:21:12 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:31 Refusé(e) (based on user decision) value "c0c0bb82" (new data: "rundll32.exe "C:\WINDOWS\system32\eeutlvsf.dll",b") ajouté(e) in System Startup global entry!
18/05/2008 16:22:32 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:33 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:34 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:35 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:36 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:37 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:38 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:39 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:40 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:41 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:42 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:43 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:44 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:45 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:46 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:47 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:49 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:50 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:51 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:53 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:54 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:55 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:56 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:57 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:58 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:22:59 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:00 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:01 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:02 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:03 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:04 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:05 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:06 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:07 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:08 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:09 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:10 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:11 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:12 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:13 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:14 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:15 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:16 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:17 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:18 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:19 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:20 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:21 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:22 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:23 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:24 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:25 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:26 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:27 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:28 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:29 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:30 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:31 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:32 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:33 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:35 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:36 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:37 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:38 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:39 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:40 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:41 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:42 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:43 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:44 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:45 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:46 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:47 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:48 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:49 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:50 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:51 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:52 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:53 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:54 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:55 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:56 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:57 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:58 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:23:59 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:00 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:01 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:02 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:04 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:05 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:06 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:07 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:08 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:09 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:10 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:11 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:12 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:13 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:14 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:15 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:16 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:17 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:18 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:19 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:20 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:21 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:22 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:23 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:24 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:25 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:26 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:27 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:28 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:29 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:30 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:31 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:32 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:33 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:34 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:35 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:36 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:37 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:39 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:40 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:41 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:42 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:43 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:44 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:45 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:46 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:47 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:48 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:49 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:50 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:51 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:52 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:53 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:54 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:55 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:56 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:57 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:58 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:24:59 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:00 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:01 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:02 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:03 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:04 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:05 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:08 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:09 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:11 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:12 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:13 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:14 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:15 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:16 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:17 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:18 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:19 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:20 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:22 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:23 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:24 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:25 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:26 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:27 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:28 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:29 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:30 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:31 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:32 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:33 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:34 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/2008 16:25:35 Refusé(e) (based on user blacklist) value "BMc3f3881e" (new data: "Rundll32.exe "C:\WINDOWS\system32\qhjoasjt.dll",s") modifié(e) in System Startup global entry!
18/05/20

dou-l · Answer

Ca te pose des probleme ou il revienne sans cesse ces demande de modif ?

nikitabe · Answer

j'ai plutôt l'impression que c'est chaque fois des différentes, et çà me pose problème d'autoriser qqch dont je ne suis pas sur, donc j'ai plutôt tendance a refuser,

Est ce que ça peut être mauvais de refuser une modification normal?

Avant d'avoir cette attaque les messages de modification de registre étaient relativement rares, donc si elle venait pendant une install j'acceptais, si elle sortait de nulle part je refusait. Mais là je doit dire que j'hésite souvent...

jacques.gache · Answer

nikitabe, comme je te le dis sur ton autre tropic tu as une infection SD, comme je ne sais pas si tu as suivi les démarche que je te donnais ici http://www.commentcamarche.net/forum/affich 6466007 rapport smitfraud et hijackthis ce qui expliquerais que sur ton dernier hijacthis sur celui-ci  je retrouves toujours l'infection je te laisse donc régler ton infection car si tu t'amuses sur plusieur sujet pour le même proplème tu ne feras rien de bon

dou-l · Answer

Ouh la deux fois les memes operations pas cooll !!

nikitabe · Answer

Vraiment je suis désoler j'ignorais que c'était mauvais, ne m'en voulez pas je voulais bien faire, c juste que je voyais hier matin mon ordi perdre la raison, et face au stress j'ai créer un autre poste pour obtenir réponse. 

enfin excusez moi,

Jacques, les lignes que tu m'avais conseillé de fixé avait été faite, je pense qu'on est sur le chemin de la guérison 

voici mon dernier hijackthis, tenez moi au courant si j'ai encore des infections. 


merci

nik 

ps: c plus simple que je marque un des postes comme résolu comme ça on termine que sur un? 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:49:32, on 19/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Hijackthis\monjack.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.1.5.19.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - https://bitdefender.solutions-antivirus.com/scan8/oscan8.cab
O20 - Winlogon Notify: wvUoLfcy - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

nikitabe · Answer

VOila je pense que je suis nettoyé!


un tout grand merci à commentcamarche, c super!

plus spécifiquement à dou-l et jaques-gache ainsi que tous les autres qui m'ont aider a rétablire l'ordre dans mon ordinateur!
 


Exellent soirée à tout le monde,

je file du boulot m'attend!  

je classe le poste comme résolus!


à plus 



nikita

dou-l · Answer

ok

a+ et bon surf !

Win32 Trojano-1165 !!

43 réponses

Discussions similaires

Newsletters