Plusieur infections - Page 2

  1.  geoffrey5 Contributeur sécurité
    Vas les supprimer dans system32 en mode sans échec
    0
    1. nini421
      Hello,
      ce serais super si je pouvais y aller en mode sans échec mais c est impossible.
      0
      1. geoffrey5 Contributeur sécurité
        voici un lien qui t expliquera comment aller en mode sans échec par msconfig :

        http://membres.lycos.fr/realbeaulieu/echec.html
        0
        1. nini421
          Hello,
          comme j'ai pu enfin allé en mode sans échec j'en ai profité pour faire l'analyse avec SDFix et voici pas la même ocasion le rapport.
          Et je m'excuse vraiment pour tout ces problèmes.
          Nini

          [b]SDFix: Version 1.221 [/b]
          Run by Nathalie Rolland on 2008-09-07 at 18:11

          Microsoft Windows XP [version 5.1.2600]
          Running From: C:\Documents and Settings\Nathalie Rolland\Bureau\Mes racourcis\sdfix\SDFix

          [b]Checking Services [/b]:

          Restoring Default Security Values
          Restoring Default Hosts File

          Rebooting

          [b]Checking Files [/b]:

          No Trojan Files Found

          Removing Temp Files

          [b]ADS Check [/b]:

          [b]Final Check [/b]:

          catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-09-07 18:30:18
          Windows 5.1.2600 Service Pack 2 NTFS

          scanning hidden processes ...

          scanning hidden services & system hive ...

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
          "khjeh"=hex:20,02,00,00,72,a5,cd,35,1e,0b,af,e8,b6,b1,c8,2e,b8,08,d4,10,ea,..
          "hj34z0"=hex:54,ba,bd,84,09,ed,de,5a,c9,54,c3,64,7e,77,6e,5d,8e,72,da,05,94,..
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf41]
          "khjeh"=hex:20,02,00,00,72,a5,cd,35,2b,7a,46,44,b6,b1,c8,2e,a7,08,d4,10,ea,..
          "hj34z0"=hex:4b,ba,bd,84,09,ed,de,5a,c9,54,c3,64,7e,77,6e,5d,8e,72,da,05,94,..
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf42]
          "khjeh"=hex:20,02,00,00,c6,75,68,bc,60,1a,63,e3,03,14,6c,14,fa,5c,2d,a7,c5,..
          "hj34z0"=hex:c8,ee,9b,b3,2e,0e,0b,ec,24,9c,7c,37,3d,f2,43,e7,e3,37,d0,cd,f9,..
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf43]
          "khjeh"=hex:20,02,00,00,4d,7a,68,bc,e5,85,75,ec,e4,ad,37,2c,77,08,08,00,de,..
          "hj34z0"=hex:4a,5d,02,62,09,c4,62,1c,c9,31,6a,30,7e,b4,5e,d6,8e,27,40,a5,78,..
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
          "s0"=dword:dae56762
          "s1"=dword:5bbd2b11
          "s2"=dword:99e62412
          "h0"=dword:00000001

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
          "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
          "h0"=dword:00000000
          "ujdew"=hex:bc,93,f1,29,37,96,c7,a6,0e,d5,4d,ef,cb,4e,a9,73,80,ab,68,e0,d7,..
          [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
          "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
          "h0"=dword:00000000
          "ujdew"=hex:bc,93,f1,29,37,96,c7,a6,0e,d5,4d,ef,cb,4e,a9,73,80,ab,68,e0,d7,..

          scanning hidden registry entries ...

          scanning hidden files ...

          scan completed successfully
          hidden processes: 0
          hidden services: 0
          hidden files: 0

          [b]Remaining Services [/b]:

          Authorized Application Key Export:

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
          "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
          "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
          "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
          "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
          "C:\\Program Files\\MSN\\MSNCoreFiles\\msn6.exe"="C:\\Program Files\\MSN\\MSNCoreFiles\\msn6.exe:*:Enabled:msn"
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
          "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
          "C:\\Program Files\\MSN Messenger\\msrr.exe"="C:\\Program Files\\MSN Messenger\\msrr.exe:*:Enabled:Messenger"
          "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
          "C:\\Program Files\\Paltalk Messenger\\paltalk.exe"="C:\\Program Files\\Paltalk Messenger\\paltalk.exe:*:Enabled:PaltalkScene"
          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
          "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
          "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

          [b]Remaining Files [/b]:

          [b]Files with Hidden Attributes [/b]:

          Thu 8 Mar 2007 258,560 A..H. --- "C:\Program Files\Adobe\upx.exe"
          Thu 27 Mar 2008 6,104,632 A..H. --- "C:\Program Files\Picasa2\setup.exe"
          Sat 16 Aug 2008 817,664 ...H. --- "C:\WINDOWS\system32\wodfamoh.dll"
          Sat 16 Feb 2008 1,122,304 ...H. --- "C:\WINDOWS\system32\wodfamop.dll"
          Sat 22 Oct 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
          Sun 26 Aug 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
          Sat 22 Oct 2005 4,348 A..H. --- "C:\Documents and Settings\Nathalie Rolland\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
          Sat 22 Oct 2005 20 A..H. --- "C:\Documents and Settings\Nathalie Rolland\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
          Sat 22 Oct 2005 400 A..H. --- "C:\Documents and Settings\Nathalie Rolland\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"
          Sat 22 Oct 2005 1,536 A..H. --- "C:\Documents and Settings\Nathalie Rolland\Mes documents\Ma musique\Sauvegarde de la licence\drmv2lic.bak"

          [b]Finished![/b]
          0
      2. geoffrey5 Contributeur sécurité
        ok...refais un nouveau rapport hijackthis stp
        0
        1. nini421
          Salut,
          voici le rapport
          Nini
          Ps: j'ai toujours l infection relié a winlogon.exe

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 19:09:29, on 2008-09-07
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
          C:\WINDOWS\system32\CTsvcCDA.EXE
          c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
          C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
          C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
          C:\WINDOWS\system32\SearchIndexer.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\WINDOWS\system32\wscntfy.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\SearchProtocolHost.exe
          C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
          C:\Program Files\Dell\Media Experience\DMXLauncher.exe
          C:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE
          C:\WINDOWS\system32\dla\tfswctrl.exe
          C:\Program Files\D-Tools\daemon.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\WINDOWS\system32\ICO.EXE
          C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
          C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
          C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
          C:\WINDOWS\system32\CTHELPER.EXE
          C:\Program Files\Creative\SBAudigy2ZS\Mixer\CTSVolFE.exe
          C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
          C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
          C:\Program Files\Wallpaper\Wallpaper.exe
          C:\Program Files\RocketDock\RocketDock.exe
          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
          C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe
          C:\Program Files\Digital Line Detect\DLG.exe
          C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe
          C:\Program Files\Logitech\SetPoint\SetPoint.exe
          C:\Program Files\Google\Google Updater\GoogleUpdater.exe
          C:\Program Files\Aliant\Net Assistant\bin\mpbtn.exe
          C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
          C:\Program Files\Mozilla Firefox\firefox.exe
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
          C:\Program Files\Windows Live\Messenger\usnsvc.exe
          C:\Program Files\Windows Live\Mail\wlmail.exe
          C:\Documents and Settings\Nathalie Rolland\Bureau\Mes racourcis\HiJackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.comodo.com/search/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
          O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - (no file)
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: (no name) - {a057a204-bacc-4d26-9990-79a187e2698e} - (no file)
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
          O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
          O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
          O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
          O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
          O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
          O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
          O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
          O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
          O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
          O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
          O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [CtxfiReg] CTXFIREG.EXE
          O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
          O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
          O4 - HKLM\..\Run: [CTSVolFE] "C:\Program Files\Creative\SBAudigy2ZS\Mixer\CTSVolFE.exe" /r
          O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
          O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKCU\..\Run: [Gadwin PrintScreen 3.0] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
          O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
          O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [RegistryBooster 2 d’Uniblue ] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
          O4 - HKCU\..\Run: [Netlog 24] "C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe"
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
          O4 - Global Startup: Icatch(VI) SnapDetect.lnk = ?
          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
          O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
          O4 - Global Startup: Net Assistant.lnk = C:\Program Files\Aliant\Net Assistant\bin\matcli.exe
          O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
          O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
          O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
          O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
          O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O11 - Options group: [searching] Search from the Address bar
          O15 - Trusted Zone: http://www.secuser.com
          O16 - DPF: {193c772a-87be-4b19-a7bb-445b226fe9a1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
          O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://labarbiefullsex.spaces.live.com//PhotoUpload/MsnPUpld.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
          O16 - DPF: {74d05d43-3236-11d4-bdcd-00c04f9a3b61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
          O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://nini421.spaces.live.com/PhotoUpload/MsnPUpld.cab
          O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
          O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/crusher-kiwen.cab
          O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game04.zylom.com/activex/zylomgamesplayer.cab
          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{131CE4E9-DABD-444D-95EA-47C4D3A147EC}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CS1\Services\Tcpip\..\{131CE4E9-DABD-444D-95EA-47C4D3A147EC}: NameServer = 208.67.220.220,208.67.222.222
          O17 - HKLM\System\CS3\Services\Tcpip\..\{131CE4E9-DABD-444D-95EA-47C4D3A147EC}: NameServer = 208.67.220.220,208.67.222.222
          O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
          O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
          O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
          O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: Gestion d'applications (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
          O23 - Service: Audio Windows (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
          O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Explorateur d'ordinateur (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
          O23 - Service: Creative Labs Licensing Service (creative labs licensing service) - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
          O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
          O23 - Service: Services de cryptographie (CryptSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Lanceur de processus serveur DCOM (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Client DHCP (Dhcp) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
          O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
          O23 - Service: Gestionnaire de disque logique (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Client DNS (Dnscache) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
          O23 - Service: Système d'événements de COM+ (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Compatibilité avec le Changement rapide d'utilisateur (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: Aide et support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: HID Input Service (HidServ) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: Serveur (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Station de travail (lanmanworkstation) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
          O23 - Service: Assistance TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
          O23 - Service: Connexions réseau (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
          O23 - Service: NLA (Network Location Awareness) (Nla) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Stockage amovible (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
          O23 - Service: Gestionnaire de connexion automatique d'accès distant (RasAuto) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Gestionnaire de connexions d'accès distant (RasMan) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Accès à distance au Registre (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Appel de procédure distante (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Planificateur de tâches (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
          O23 - Service: Connexion secondaire (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Notification d'événement système (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Pare-feu Windows / Partage de connexion Internet (SharedAccess) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Détection matériel noyau (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Service de restauration système (srservice) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Service de découvertes SSDP (SSDPSRV) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Acquisition d'image Windows (WIA) (stisvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Téléphonie (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Services Terminal Server (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Thèmes (Themes) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Client de suivi de lien distribué (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Hôte de périphérique universel Plug-and-Play (upnphost) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Windows Time (w32time) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: WebClient - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Infrastructure de gestion Windows (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Service de numéro de série du lecteur multimédia portable (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Extensions du pilote WMI (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Centre de sécurité (wscsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Mises à jour automatiques (wuauserv) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe
          O23 - Service: Configuration automatique sans fil (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          O23 - Service: Service d'approvisionnement réseau (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe
          0
      4. geoffrey5 Contributeur sécurité
        comment se fait il que tu as 2 antivirus sur ton pc ??^^

        il ne faut jamais installer 2 antivirus sur le meme pc sinon il risque d y avoir des conflits entres les 2

        désinstalles en un (avg par exemple)

        ensuite vas faire une analyse complete avec ton antivirus en mode sans échec stp
        0
        1. nini421
          mais je n'ai pas deux antivirus..j ai voulu installé avg oui mais il n as pas voulu s installé j ai alors installé avast..je ne comprend pas la...
          0
      5. geoffrey5 Contributeur sécurité
        télécharges regcleaner à cette adresse : https://www.androidworld.fr/

        cherches avg et désinstalle le
        0
        1. nini421
          Bon et bien c est fait et tout ce qu il me reste d avg c est l anti spy.Alors maintenant ya t il une solution pour l exécutable winlogon.
          merci
          Nini
          0
      6. geoffrey5 Contributeur sécurité
        vas faire une analyse complete avec avast en mode sans échec stp
        0
        1. nini421
          Ok j 'y vais,on se reparle plus tard
          et merci encore
          Nini
          0
      7. geoffrey5 Contributeur sécurité
        mais de rien ;-)

        @+
        0
        1. nini421
          hello,
          Bon j'ai fait un scan en mode sans échec il m'a suprimé trois virus mais les trois principaux sont toujours là, je t'envoie donc le journal d'erreur si ça peut aidé.
          Nini

          2008-09-07 00:22:52 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 00:22:57 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 00:27:19 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 00:38:19 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 00:57:38 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 00:58:02 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\services.exe" file.
          2008-09-07 01:23:59 Nathalie Rolland 464 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\services.exe" file.
          2008-09-07 01:25:46 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 01:29:09 SYSTEM 1620 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 02:01:31 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 02:01:33 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 02:01:57 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 02:46:01 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 08:28:15 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 13:17:24 Nathalie Rolland 3864 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\services.exe" file.
          2008-09-07 13:18:11 Nathalie Rolland 3864 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\svchost.exe" file.
          2008-09-07 13:19:45 Nathalie Rolland 984 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\services.exe" file.
          2008-09-07 13:24:42 Nathalie Rolland 984 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\svchost.exe" file.
          2008-09-07 13:25:25 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 13:26:19 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 13:26:38 Nathalie Rolland 3884 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 13:27:05 Nathalie Rolland 3932 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 14:16:58 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 14:18:28 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 14:22:33 Nathalie Rolland 1804 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 14:24:22 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 17:19:54 SYSTEM 1632 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\services.exe" file.
          2008-09-07 17:30:30 Nathalie Rolland 1316 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\services.exe" file.
          2008-09-07 18:23:48 SYSTEM 1624 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 18:23:49 SYSTEM 1624 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 19:09:07 SYSTEM 1624 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\services.exe" file.
          2008-09-07 19:54:29 Nathalie Rolland 1148 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\services.exe" file.
          2008-09-07 19:54:45 Nathalie Rolland 1148 Sign of "Win32:Patched-CK [Trj]" has been found in "c:\windows\system32\svchost.exe" file.
          2008-09-07 19:56:00 Nathalie Rolland 1328 Function setifaceUpdatePackages() has failed. Return code is 0x000004C7, dwRes is 000004C7.
          2008-09-07 20:01:07 Nathalie Rolland 1328 Sign of "Win32:Hupigon-LZV [Trj]" has been found in "C:\Documents and Settings\Nathalie Rolland\Bureau\Abrosoft.FantaMorph.Professional.Edition.v3.6.2.Multilingual.WinALL.Incl.Keygen-BRD\keygen\keygen.exe" file.
          2008-09-07 21:19:51 Nathalie Rolland 1328 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP1\A0003047.sys" file.
          2008-09-07 21:30:24 Nathalie Rolland 1328 Sign of "Win32:Hupigon-LZV [Trj]" has been found in "C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP15\A0009656.exe" file.
          2008-09-07 22:49:24 Nathalie Rolland 1328 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\services.exe" file.
          2008-09-07 22:50:36 Nathalie Rolland 1328 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 22:51:27 Nathalie Rolland 1328 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 22:55:27 SYSTEM 1624 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\winlogon.exe" file.
          2008-09-07 22:55:30 SYSTEM 1624 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\svchost.exe" file.
          2008-09-07 22:56:44 SYSTEM 1624 Sign of "Win32:Patched-CK [Trj]" has been found in "C:\WINDOWS\system32\services.exe" file.
          0
      8. geoffrey5 Contributeur sécurité
        Salut !!

        Vas aussi faire des analyses en ligne à cette adresse :

        http://www.zebulon.fr/outils/antivirus/antivirus-en-ligne.php

        Les deux premiers savent désinfecter.
        0
        1. nini421
          Bon me revoici.... Premièrement je tient a te remercié pour les efforts que tu as fais pour me venir en aide.
          Après avoir utilisié les liens sur les scan en ligne j ai du formaté puisque j ai fais une mauvaise manipulation et j ai suprimé un fichier exe de windows.Mais tout es ok maintenant.
          Et encore merci pour ton soutient.
          Nini
          0
          1. geoffrey5 Contributeur sécurité
            Salut !!

            ok...Un formatage ne fait jamais du tort...au contraire.

            Bonne fin de soirée @+
            0
            Précédent
            • 1
            • 2

            Discussions similaires

            Aide pour infections multiples
            Akilae94

            11 réponses
            rapport MBAM 6 infections
            Tamarin

            21 réponses
            Infections virus fichier .EXE à 0 octet
            levieux5

            58 réponses