Message d'erreur DLL Résolu

Question

Bonjour,

J'ai depuis quelques temps l'apparition systématique d'un message d'erreur au démarrage de mon ordinateur qui marhce sous windows vista.

Le message est le suivant : erreur c:\windows\system32\khfDtSmj.dll le module spécifié est introuvable.

Comment puis-je résoudre ce problème?

Cordialement

pierre.d51 · Answer

Bonjour. 


Il existe un site pour telecharger les dll. 

https://www.fichier-dll.fr/

Mais je n'ai pas trouvée la tienne...

Es tu sur du nom ?

sandul · Answer

Salut,

Il s'agit là d'un fichier ayant appartenu à un virus/malware; il n'est plus présent car l'infection en cause a probablement été viré partiellement/totalement par un antivirus/antimalware.

Peux-tu poster un log HijackThis?

++

maryo971 · Answer

Oui je viens juste de vérifier il s'agit bien du bon nom d'erreur.

pierre.d51 · Answer

je me disait aussi le nom me paraissait bizzare...

sandul · Answer

Ok, quelques soucis sont présents. Exemple:

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\khfDtSmj.dll,#1
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

Fais la manip suivante:
1) Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :
https://www.malwarebytes.com/

3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

4) Installe MBAM à partir du programme téléchargé sur ton bureau

5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche

7) Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

12) Ferme MBAM en cliquant sur Quitter.
(Merci à ^^Marie^^ pour ces instructions)

++

maryo971 · Answer

L'analyse a mis pas mal de temps mais finalement le problème est résolu.

Merci beaucoup pour votre aide.

maryo971 · Answer

VOICI le log après MBAM


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:02:12, on 29/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Windows\System32undll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVW32.exe
C:\HJT\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://qc.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://qc.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\Windows\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [{08F0B490-68D1-262B-0008-040600080806}] C:\Users\Yoyo\AppData\Roaming\pcomputer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

sandul · Answer

Nan, toujours infecté.

Réouvre MBAM et coche les lignes suivantes:
 	O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
 	O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Clique sur le bouton Fix Checked et redémarre ton PC. Reposte par la suite un autre scan HijackThis.

sandul · Answer

[EDIT] Pardon, réouvre HijackThis et non MBAM, pour faire la manip. ;-)

maryo971 · Answer

Rien à faire ces deux ligne ne disparaissent pas du scan

maryo971 · Answer

Ok pas de soucis merci bonne soirée je posterai le rapport.

maryo971 · Answer

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.7.29.1 2008.07.29 - 
AntiVir 7.8.1.12 2008.07.29 - 
Authentium 5.1.0.4 2008.07.29 - 
Avast 4.8.1195.0 2008.07.29 - 
AVG 8.0.0.130 2008.07.29 - 
BitDefender 7.2 2008.07.29 - 
CAT-QuickHeal 9.50 2008.07.29 - 
ClamAV 0.93.1 2008.07.29 - 
DrWeb 4.44.0.09170 2008.07.29 - 
eSafe 7.0.17.0 2008.07.29 - 
eTrust-Vet 31.6.5992 2008.07.29 - 
Ewido 4.0 2008.07.29 - 
F-Prot 4.4.4.56 2008.07.28 - 
F-Secure 7.60.13501.0 2008.07.29 - 
Fortinet 3.14.0.0 2008.07.29 - 
GData 2.0.7306.1023 2008.07.29 - 
Ikarus T3.1.1.34.0 2008.07.29 - 
Kaspersky 7.0.0.125 2008.07.29 - 
McAfee 5349 2008.07.29 - 
Microsoft 1.3704 2008.07.28 - 
NOD32v2 3307 2008.07.29 - 
Norman 5.80.02 2008.07.28 - 
Panda 9.0.0.4 2008.07.29 - 
PCTools 4.4.2.0 2008.07.29 - 
Prevx1 V2 2008.07.29 - 
Rising 20.55.12.00 2008.07.29 - 
Sophos 4.31.0 2008.07.29 - 
Sunbelt 3.1.1537.1 2008.07.29 - 
Symantec 10 2008.07.29 - 
TheHacker 6.2.96.389 2008.07.25 - 
TrendMicro 8.700.0.1004 2008.07.29 - 
VBA32 3.12.8.1 2008.07.29 suspected of Win32.BrokenEmbeddedSignature  (paranoid heuristics) 
ViRobot 2008.7.29.1315 2008.07.29 Trojan.Win32.Agent.44168 
VirusBuster 4.5.11.0 2008.07.29 - 
Webwasher-Gateway 6.6.2 2008.07.29 - 
Information additionnelle 
File size: 44128 bytes 
MD5...: 50ecaa360582260acc5e1495cc34a22e 
SHA1..: 49ac00e85310e4ca0004dcfd89d49b8f864f42c7 
SHA256: f9d3eb40b802b7092b34b636b89258934420cda7daaa1497312fcd11b5a91490 
SHA512: 76c29d4bf3593098ce941bf1f898645c02fafdd7c599905fee17d5cd3b084f61
85657c97f7b5e50f537cd34f3ebeca6015322279af693d3b87c03fcee818250b 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x404858
timedatestamp.....: 0x454f2771 (Mon Nov 06 12:15:45 2006)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x41c9 0x5000 5.38 5c5a7f6e4e9784110db25bddcc6dee3c
.rdata 0x6000 0x1458 0x2000 3.03 ae638035d8f027226689b7c38288aca2
.data 0x8000 0xb30 0x1000 2.60 90612eb9fcc7c59a48e1552b7ea3bb65
.rsrc 0x9000 0x3b0 0x1000 0.96 3b4d5d544aab5d57e8e6f20740ea399c

( 7 imports ) 
> MFC42u.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> msvcrt.dll: __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _cexit, _XcptFilter, _exit, __p__fmode, __1type_info@@UAE@XZ, _onexit, __dllonexit, __set_app_type, _ltow, __CxxFrameHandler, wcscmp, wcslen, _terminate@@YAXXZ, _controlfp, _c_exit, _except_handler3, _wgetenv, _wcsicmp
> KERNEL32.dll: CreateFileW, DeleteFileW, SetFileAttributesW, SetLastError, FormatMessageW, GetLastError, GlobalFree, GlobalUnlock, GetPrivateProfileStringW, GlobalAlloc, GetModuleFileNameW, GetVersionExW, GetModuleHandleA, GetStartupInfoA, GetPrivateProfileIntW, GetCurrentDirectoryW, GlobalLock, GetExitCodeProcess, CloseHandle, WaitForSingleObject, CreateProcessW
> USER32.dll: wvsprintfW
> ADVAPI32.dll: RegSetValueExW, RegCloseKey, RegOpenKeyW
> VERSION.dll: VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
> SHLWAPI.dll: PathStripPathW

( 0 exports )

maryo971 · Answer

J'ai fait ce que tu m'as indiqué au post 19 mais je n'ai pas trouvé de service ou de process launcher et lorsque j'exécute HijackThis à nouveau certaines des lignes que tu m'as dit de cocher ne sont plus là :

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

O4 - Startup: RK Launcher.lnk = ?

Chiquitine29 · Answer

Salut

je prend la suite :

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

-> Double clique sur combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

maryo971 · Answer

Bonjour, voilà le rapport combo fix ComboFix 08-07-28.6 - Yoyo 2008-07-30 9:23:26.3 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1006 [GMT 2:00] Endroit: C:\Users\Yoyo\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))))))) . 2008-07-29 22:09 . 2008-07-29 22:09 d-------- C:\Users\All Users\LightScribe 2008-07-29 22:09 . 2008-07-29 22:09 d-------- C:\ProgramData\LightScribe 2008-07-29 16:35 . 2008-07-29 16:35 d-------- C:\Users\Yoyo\AppData\Roaming\Malwarebytes 2008-07-29 16:35 . 2008-07-29 16:35 d-------- C:\Users\All Users\Malwarebytes 2008-07-29 16:35 . 2008-07-29 16:35 d-------- C:\ProgramData\Malwarebytes 2008-07-29 16:35 . 2008-07-29 16:35 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-29 16:35 . 2008-07-23 20:09 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys 2008-07-29 16:35 . 2008-07-23 20:09 17,144 --a------ C:\Windows\System32\drivers\mbam.sys 2008-07-29 16:11 . 2008-07-29 20:46 d-------- C:\HJT 2008-07-29 15:15 . 2008-07-29 15:15 d-------- C:\Program Files\Windows Live Safety Center 2008-07-29 14:20 . 2000-06-23 12:46 37,916 --a------ C:\Windows\WMPrfFRA.prx 2008-07-29 13:26 . 2008-07-29 13:26 d-------- C:\Program Files\Common Files\LightScribe 2008-07-28 12:49 . 2008-07-28 12:49 d-------- C:\Users\All Users\DFX 2008-07-28 12:49 . 2008-07-28 12:49 d-------- C:\ProgramData\DFX 2008-07-28 12:49 . 2008-07-29 11:56 d-------- C:\Program Files\DFX 2008-07-28 12:49 . 2008-07-28 12:49 d-------- C:\Program Files\Common Files\DFX 2008-07-28 08:17 . 2008-07-28 08:17 d-------- C:\Windows\USB Vibration 2008-07-28 08:16 . 2008-07-28 08:16 d-------- C:\Program Files\USB Vibration 2008-07-26 13:14 . 2008-07-26 13:14 d-------- C:\Users\Yoyo\AppData\Roaming\GTek 2008-07-26 13:10 . 2008-07-26 13:10 d-------- C:\Users\Yoyo\AppData\Roaming\InstallShield 2008-07-26 12:25 . 2008-07-26 12:25 507,904 --a------ C:\Windows\TMUPDATE.DLL 2008-07-26 12:25 . 2008-07-26 12:25 286,720 --a------ C:\Windows\PATCH.EXE 2008-07-26 12:25 . 2008-07-26 12:25 69,689 --a------ C:\Windows\UNZIP.DLL 2008-07-22 21:32 . 2008-05-27 06:59 106,605 --a------ C:\Windows\System32\StructuredQuerySchema.bin 2008-07-22 21:32 . 2008-05-27 07:17 34,816 --a------ C:\Windows\System32\msscb.dll 2008-07-22 21:32 . 2008-05-27 06:59 18,904 --a------ C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2008-07-22 21:32 . 2008-05-27 07:17 11,776 --a------ C:\Windows\System32\msshooks.dll 2008-07-12 10:19 . 2008-07-12 10:19 d-------- C:\Program Files\iTunes 2008-07-12 10:19 . 2008-07-12 10:19 d-------- C:\Program Files\iPod 2008-07-12 10:17 . 2008-07-12 10:17 d-------- C:\Program Files\Bonjour 2008-07-12 10:16 . 2008-07-12 10:17 d-------- C:\Program Files\QuickTime 2008-07-10 18:01 . 2008-07-10 18:01 d-------- C:\Users\Yoyo\AppData\Roaming\ArcSoft 2008-07-10 18:00 . 2008-07-10 18:01 d-------- C:\Users\Yoyo\AppData\Roaming\Nikon 2008-07-10 17:33 . 2008-07-10 17:33 d-------- C:\Users\All Users\Nikon 2008-07-10 17:33 . 2008-07-10 17:33 d-------- C:\ProgramData\Nikon 2008-07-10 17:33 . 2008-07-10 17:33 d-------- C:\Program Files\Nikon 2008-07-10 17:33 . 2008-07-10 18:01 d-------- C:\Program Files\Common Files\Nikon 2008-07-10 17:32 . 2008-07-10 17:32 d-------- C:\Users\All Users\Ultima_T15 2008-07-10 17:32 . 2008-07-10 17:32 d-------- C:\Users\All Users\EnterNHelp 2008-07-10 17:32 . 2008-07-10 17:32 d-------- C:\ProgramData\Ultima_T15 2008-07-10 17:32 . 2008-07-10 17:32 d-------- C:\ProgramData\EnterNHelp 2008-07-10 17:32 . 2008-07-10 18:00 20 ---h----- C:\Users\All Users\PKP_DLdu.DAT 2008-07-10 17:32 . 2008-07-10 18:00 20 ---h----- C:\ProgramData\PKP_DLdu.DAT 2008-07-10 17:30 . 2008-07-10 17:30 d-------- C:\Program Files\ArcSoft 2008-07-08 20:08 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-07-08 20:07 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll 2008-07-08 20:07 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll 2008-06-27 08:19 . 2008-06-27 08:19 d-------- C:\Program Files\Rockstar Games 2008-06-20 17:53 . 2008-04-26 10:08 1,314,816 --a------ C:\Windows\System32\quartz.dll 2008-06-20 17:53 . 2008-04-23 06:42 428,544 --a------ C:\Windows\System32\EncDec.dll 2008-06-20 17:53 . 2008-04-23 06:42 293,376 --a------ C:\Windows\System32\psisdecd.dll 2008-06-20 17:53 . 2008-04-29 03:42 220,160 --a------ C:\Windows\System32\drivers\bthport.sys 2008-06-20 17:53 . 2008-04-23 06:41 218,624 --a------ C:\Windows\System32\psisrndr.ax 2008-06-20 17:53 . 2008-04-29 05:54 181,760 --a------ C:\Windows\System32\fsquirt.exe 2008-06-20 17:53 . 2008-05-10 03:33 113,664 --a------ C:\Windows\System32\drivers mcast.sys 2008-06-20 17:53 . 2008-04-23 06:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax 2008-06-20 17:53 . 2008-04-29 03:42 29,184 --a------ C:\Windows\System32\drivers\BTHUSB.SYS 2008-06-20 17:52 . 2008-04-25 04:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb 2008-06-20 17:52 . 2008-04-25 06:35 826,880 --a------ C:\Windows\System32\wininet.dll 2008-06-14 20:00 . 2008-06-14 20:00 d-------- C:\Users\Yoyo\AppData\Roaming\Games 2008-06-14 19:59 . 2008-06-14 19:59 d-------- C:\Users\All Users\InstallShield 2008-06-14 19:59 . 2008-06-14 19:59 d-------- C:\ProgramData\InstallShield 2008-06-14 19:51 . 2008-06-14 19:51 d-------- C:\Program Files\Focus 2008-06-14 19:51 . 2004-08-09 06:04 73,728 --a------ C:\Windows\System32\ISUSPM.cpl 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Videos 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Searches 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Saved Games 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Pictures 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Music 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Links 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Downloads 2008-06-14 19:27 . 2008-06-14 19:27 dr------- C:\Windows\System32\config\systemprofile\Documents 2008-06-14 19:16 . 2008-06-14 19:16 d-------- C:\Users\All Users\Age of Empires 3 2008-06-14 19:16 . 2008-06-14 19:16 d-------- C:\ProgramData\Age of Empires 3 2008-06-14 19:14 . 2008-06-14 19:44 d-------- C:\Program Files\Common Files\Microsoft Games . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-30 07:21 --------- d-----w C:\Users\Yoyo\AppData\Roaming\uTorrent 2008-07-29 19:50 --------- d-----w C:\Users\Yoyo\AppData\Roaming\Image Zone Express 2008-07-29 12:38 --------- d-----w C:\Program Files\Hp 2008-07-29 12:31 --------- d-----w C:\Program Files\Hewlett-Packard 2008-07-29 12:25 --------- d-----w C:\Users\Yoyo\AppData\Roaming\Hewlett-Packard 2008-07-29 12:18 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-29 10:52 --------- d-----w C:\ProgramData\Hewlett-Packard 2008-07-28 19:22 145,736 ----a-w C:\Users\Yoyo\AppData\Roaming vModes.dat 2008-07-26 11:10 --------- d-----w C:\ProgramData\Symantec 2008-07-26 10:03 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-26 10:03 --------- d-----w C:\Program Files\Common Files\SureThing Shared 2008-07-26 10:02 --------- d-----w C:\ProgramData\Microsoft Help 2008-07-26 10:02 --------- d-----w C:\Program Files\Microsoft Works 2008-07-23 10:50 --------- d-----w C:\Program Files\Java 2008-07-14 20:04 --------- d-----w C:\Program Files\Rail Simulator 2008-07-08 18:15 --------- d-----w C:\Program Files\Windows Mail 2008-06-27 06:34 --------- d-----w C:\Program Files\Micro Application 2008-06-19 20:42 --------- d-----w C:\Program Files\Safari 2008-06-14 17:58 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-06-14 17:58 --------- d-----w C:\Program Files\AGEIA Technologies 2008-06-14 17:56 278,984 ----a-w C:\Windows\system32\drivers\atksgt.sys 2008-06-14 17:51 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-06-14 16:57 --------- d-----w C:\Program Files\Microsoft Games 2008-06-11 12:41 21,248 ----a-w C:\Windows\Help\OEM\scripts\HPScript.exe 2008-05-30 21:53 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF 2008-05-30 21:53 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS 2008-05-30 21:53 10,671 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT 2008-05-30 21:53 --------- d-----w C:\Program Files\Symantec 2008-05-30 21:53 --------- d-----w C:\Program Files\Norton Internet Security 2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32 query.dll 2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe 2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll 2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll 2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll 2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll 2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll 2008-05-27 05:17 313,344 ----a-w C:\Windows\System32 hawbrkr.dll 2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll 2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll 2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll 2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll 2008-05-14 17:17 174 --sha-w C:\Program Files\desktop.ini 2008-05-14 14:55 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-05-14 14:55 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll 2008-05-08 21:59 90,112 ----a-w C:\Windows\System32\wshext.dll 2008-05-08 21:59 430,080 ----a-w C:\Windows\System32\vbscript.dll 2008-05-08 21:59 180,224 ----a-w C:\Windows\System32\scrobj.dll 2008-05-08 21:59 172,032 ----a-w C:\Windows\System32\scrrun.dll 2008-05-08 21:59 155,648 ----a-w C:\Windows\System32\wscript.exe 2008-05-08 21:58 135,168 ----a-w C:\Windows\System32\cscript.exe 2008-05-07 07:37 21,760 ----a-w C:\Windows\Help\OEM\scripts\HPHS_Launcher.exe 2008-04-26 08:25 3,600,952 ----a-w C:\Windows\System32 tkrnlpa.exe 2008-04-26 08:25 3,549,240 ----a-w C:\Windows\System32 toskrnl.exe 2008-04-12 03:32 784,896 ----a-w C:\Windows\System32 pcrt4.dll 2008-04-05 03:34 15,360 ----a-w C:\Windows\System32\pacerprf.dll 2007-11-07 07:59 186 ----a-w C:\Users\Yoyo\AppData\Roaming\wklnhst.dat 2008-04-17 04:58 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-04-17 04:58 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-04-17 17:24 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat 2008-04-17 17:24 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\index.dat 2008-04-17 17:24 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat 2008-04-17 04:58 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-07-29_19.46.09.49 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-29 17:35:07 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-07-29 18:52:33 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2008-07-29 17:35:07 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2008-07-29 18:52:33 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-07-29 17:35:53 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService tuser.dat + 2008-07-29 19:01:07 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService tuser.dat + 2008-07-29 19:01:07 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService tuser.dat.LOG1 - 2008-07-29 17:35:53 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService tuser.dat + 2008-07-29 19:01:12 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService tuser.dat + 2008-07-29 19:01:12 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService tuser.dat.LOG1 - 2008-07-29 17:11:52 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-07-30 07:20:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-07-29 17:11:52 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-07-30 07:20:04 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-07-29 17:11:52 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-07-30 07:20:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-07-29 17:19:36 109,442 ----a-w C:\Windows\System32\perfc009.dat + 2008-07-29 19:00:16 109,442 ----a-w C:\Windows\System32\perfc009.dat - 2008-07-29 17:19:36 133,086 ----a-w C:\Windows\System32\perfc00C.dat + 2008-07-29 19:00:16 133,086 ----a-w C:\Windows\System32\perfc00C.dat - 2008-07-29 17:19:36 600,200 ----a-w C:\Windows\System32\perfh009.dat + 2008-07-29 19:00:16 600,200 ----a-w C:\Windows\System32\perfh009.dat - 2008-07-29 17:19:36 678,956 ----a-w C:\Windows\System32\perfh00C.dat + 2008-07-29 19:00:16 678,956 ----a-w C:\Windows\System32\perfh00C.dat - 2008-07-29 17:38:00 12,698 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2221398618-2752045498-2917600635-1000_UserData.bin + 2008-07-29 19:02:00 12,698 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2221398618-2752045498-2917600635-1000_UserData.bin - 2008-07-29 17:37:59 71,450 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-07-29 19:01:59 71,450 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-07-29 17:13:45 51,622 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-07-29 19:01:58 51,710 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-08-09 06:03 221184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 06:43 729088] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 02:05 1045800] "ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 05:59 115816] "HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 13:42 70912] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "CognizanceTS"="c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 21:12 17920] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 02:05 200704] "PinnacleDriverCheck"="C:\Windows\system32\PSDrvCheck.exe" [2003-11-10 16:06 406016] "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 02:29 102400] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB ealsched.exe" [2007-12-28 22:39 185896] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048] "NvSvc"="C:\Windows\system32 vsvc.dll" [2007-11-07 03:35 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-11-07 03:35 8534560] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-11-07 03:35 81920] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-12-19 19:27 468264] "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 07:44 488752] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840] "RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 15:38 4390912 C:\Windows\RtHDVCpl.exe] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 06:37:56 217194] BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-12-20 12:27:40 719664] HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10 210520] Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 20:10:42 479232] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=APSHook.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{7185E1F1-DA4F-4369-8ED7-CF96380E64D6}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{48941A1A-977D-4D80-8C5D-915709DB91C8}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{B802F451-35B9-4135-B99F-28B148DDA843}"= UDP:C:\Program Files\uTorrent\utorrent.exe:µTorrent "{52D61DF6-AE80-4636-97FA-8F117259FDDD}"= TCP:C:\Program Files\uTorrent\utorrent.exe:µTorrent "{437B618C-7407-4DAA-B6D5-228DD58989E1}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{02DD5C5A-A526-47DB-ACAC-84E44C87D2A6}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{217C44FB-74F2-4EEA-B539-FD15F8994E79}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{F716FDE3-3ED4-4D15-A6D6-F6DE0152C228}"= UDP:C:\Program Files\Pinnacle\MediaCenter\PMC.exe:Pmc.exe "{42960988-CFB9-4E9C-904E-A9EAE64B3DB7}"= TCP:C:\Program Files\Pinnacle\MediaCenter\PMC.exe:Pmc.exe "{CF44EC44-9486-4AF2-B3A3-8E2EABF7B779}"= UDP:C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe:PMC.Service.Main.exe "{2E5142F0-E674-4AEE-BBFB-EAA08726E1C4}"= TCP:C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe:PMC.Service.Main.exe "{C18A1C11-51E3-455B-9829-7D4B041D04A8}"= UDP:C:\Program Files\Pinnacle\MediaCenter\PMSInstallInit.exe:PMSInstallInit.exe "{10B7482E-AC23-4A3F-8EBF-8543A95D974C}"= TCP:C:\Program Files\Pinnacle\MediaCenter\PMSInstallInit.exe:PMSInstallInit.exe "{FF5E743B-0E70-4CAB-8B54-D81030DDAB4E}"= UDP:C:\Program Files\Pinnacle\MediaCenter\PSST.exe:PSST.exe "{C99EE64C-81E2-4373-AAA6-7A2E491E4F07}"= TCP:C:\Program Files\Pinnacle\MediaCenter\PSST.exe:PSST.exe "{29DB55EC-0ACA-4524-A55F-7DA5ACC9FF3F}"= UDP:C:\Program Files\uTorrent\utorrent.exe:µTorrent "{CF2E8D2E-0137-43D9-BE95-ECBF5927EDCC}"= TCP:C:\Program Files\uTorrent\utorrent.exe:µTorrent "{5D451CC3-5D8E-422C-B597-60545E12F1A9}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{BC075F2A-2621-4887-8CB8-C6B5D7F88757}"= UDP:C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "{3CDCC31D-9218-4083-BB68-7ED89825E9AD}"= TCP:C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III "{DAD0B93D-38A3-4EE7-A0C6-6A679DDDA90B}"= UDP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{9C7755A9-2CB8-44AF-9193-F9447DDA3AA7}"= TCP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{D4A87622-A525-420E-A9A9-1BD519C934F3}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{4C3877BD-6253-407D-820D-33F20044BABA}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{7A8E7252-124F-4382-9605-75B672E7FDCD}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{01C7E2E0-A779-42BA-8325-09FAAEA3CF96}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{B886AD0D-2EC6-4525-8B27-B7F2DC03BEA6}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play "{6148693E-1A7B-4289-8FDE-ECC14A6F3873}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080729.001\IDSvix86.sys [2008-02-13 18:18] R2 ASBroker;Courtier de session de connexion;C:\Windows\System32\svchost.exe [2008-01-19 09:33] R2 ASChannel;Canal de communication local;C:\Windows\System32\svchost.exe [2008-01-19 09:33] R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [2007-12-19 19:28] R2 QPSched;QuickPlay Task Scheduler (QTS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [2007-12-19 19:28] R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2008-03-07 14:39] S3 btwaudio;Périphérique audio Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-01-02 12:45] S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-01-02 12:45] S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-01-02 12:45] S3 USB28xxBGA;Pinnacle PCTV DVB-T USB Stick;C:\Windows\system32\DRIVERS\emBDA.sys [2005-11-22 19:04] S3 USB28xxOEM;USB 28xx OEM Filter;C:\Windows\system32\DRIVERS\emOEM.sys [2005-11-22 19:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ Cognizance REG_MULTI_SZ ASBroker ASChannel HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \shell\AutoRun\command - F:\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ff55916-bfa1-11dc-8879-001a6be3f3e4}] \shell\AutoRun\command - G:\ONSPCLCK.exe *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' 2008-07-02 C:\Windows\Tasks\Norton Internet Security - Analyse système complète - Yoyo.job - c:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-01-14 09:09] 2008-07-29 C:\Windows\Tasks\User_Feed_Synchronization-{9DF66A58-01EC-43C8-AB1F-DAC93635E9C3}.job - C:\Windows\system32\msfeedssync.exe [2008-01-19 09:33] . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/ R0 -: HKLM-Main,Start Page = hxxp://cf.yahoo.com R1 -: HKCU-Internet Settings,ProxyOverride = *.local O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 -: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O8 -: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-30 09:26:44 Windows 6.0.6001 Service Pack 1 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-07-30 9:28:12 ComboFix-quarantined-files.txt 2008-07-30 07:28:00 ComboFix2.txt 2008-07-29 17:57:20 ComboFix3.txt 2008-07-29 17:46:57 Pre-Run: 16,473,354,240 octets libres Post-Run: 16,437,170,176 octets libres 330 --- E O F --- 2008-07-22 19:33:49

maryo971 · Answer

Salut Sandul,

effectivement mon ordi est un HP.

maryo971 · Answer

Pas de soucis tu as fait ça pour m'aider.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:49, on 30/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Windows\System32undll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\System32undll32.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\HJT\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://qc.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\Windows\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

maryo971 · Answer

Ok merci Sandul.

++

Chiquitine29 · Answer

Salut sandul effectivement : launcher.exe est légitime sur un hp 


maryo

désinstal adobe reader car pas a jours et telecharge et instal cette version :

http://ardownload.adobe.com/pub/adobe/reader/win/9.x/9.0/fra/AdbeRdr90_fr_FR.exe

* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> 
ftp://ftp.commentcamarche.com/download/ToolsCleaner2.exe
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
http://pc-system.fr/ 

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

maryo971 · Answer

Salut Chiquitine,
J'ai fait ce que tu m'as dit mais lorsque je veux quitter toolscleaner il me mets un message d'erreur car il n'arrive pas à accéder à la racine de mon disque donc je n'ai pas de rapport.

maryo971 · Answer

Salut Chiquitine,
J'ai fait ce que tu m'as dit mais je n'arrive pas à avoir de rapport toolscleaner à la fin lorsque je veux quitter j'ai un message d'erreur concernant l'accès à la racine de mon disque.

Chiquitine29 · Answer

dis nous juste si hijackthis combofix ont disparu

maryo971 · Answer

Après vérification tout à été enlevé.

Chiquitine29 · Answer

OK Donc c good

@++

maryo971 · Answer

Merci pour votre aide à tous les 2.

++

Message d'erreur DLL - Page 2

Discussions similaires

Newsletters