Rapport HijackThis

Question

Bonjour,Depuis quelques jours, mon PC est plus lent, et des pages WEB s'affichent , sans raison. J'ai scanné mon disque via Spybot. 3 erreurs s'affichent :  Allcybersearch, DSO exploit et WebDialer.Je les supprime mais ils reviennent à chaque fois.En cherchant sur Internet,  j'ai découvert que je pouvais résoudre ces problèmes grâce à Hijackthis.J'ai donc scanné mon pc mais je ne sais pas quoi faire avec le rapport émis.Voici ce rapport:D'avance, merci beaucoup.Logfile of HijackThis v1.99.1Scan saved at 16:46:56, on 05/03/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\drivers\KodakCCS.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEC:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEC:\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\apps\ABoard\ABoard.exeC:\Program Files\Virtual CD v4 SDK\system\vcsplay.exeC:\Program Files\Canon\MultiPASS4\MPTBox.exeC:\apps\ABoard\AOSD.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\WINDOWS\system32\slserv.exeC:\WINDOWS\System32	vegvq.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\Program Files\Virtual CD v4 SDK\system\vcssecs.exeC:\WINDOWS\System32undll32.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\WINDOWS\System32undll32.exeC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exeC:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Winamp3\winamp3.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Canon\MultiPASS4\MPDBMgr.exeC:\Antispyware\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll/sp.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll/sp.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shop.private.com/dvd_entry.asp?prod=dsam007_dpmo001R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet ExplorerR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exeO1 - Hosts: 127.0.0.0 localhostO1 - Hosts: 127.0.0.2 auditmypc.comO1 - Hosts: 127.0.0.3 boards.cexx.orgO1 - Hosts: 127.0.0.4 bulletproofsoft.netO1 - Hosts: 127.0.0.5 camtech2000.netO1 - Hosts: 127.0.0.6 cexx.orgO1 - Hosts: 127.0.0.7 computercops.usO1 - Hosts: 127.0.0.8 ct7support.comO1 - Hosts: 127.0.0.9 doxdesk.comO1 - Hosts: 127.0.0.20 kellys-korner-xp.comO1 - Hosts: 127.0.0.21 kephyr.comO1 - Hosts: 127.0.0.22 lavasoft.deO1 - Hosts: 127.0.0.23 lavasoftusa.comO1 - Hosts: 127.0.0.24 lurkhere.comO1 - Hosts: 127.0.0.25 majorgeeks.comO1 - Hosts: 127.0.0.26 merijn.orgO1 - Hosts: 127.0.0.27 mjc1.comO1 - Hosts: 127.0.0.28 moosoft.comO1 - Hosts: 127.0.0.29 mvps.orgO1 - Hosts: 127.0.0.30 net-integration.netO1 - Hosts: 127.0.0.31 noadware.netO1 - Hosts: 127.0.0.32 no-spybot.comO1 - Hosts: 127.0.0.33 onlinepcfix.comO1 - Hosts: 127.0.0.34 pchell.comO1 - Hosts: 127.0.0.35 pestpatrol.comO1 - Hosts: 127.0.0.36 safer-networking.orgO1 - Hosts: 127.0.0.37 secure.spykiller.comO1 - Hosts: 127.0.0.38 secureie.comO1 - Hosts: 127.0.0.39 security.kolla.deO1 - Hosts: 127.0.0.40 spybot.infoO1 - Hosts: 127.0.0.41 spychecker.comO1 - Hosts: 127.0.0.42 spychecker.comO1 - Hosts: 127.0.0.43 spycop.comO1 - Hosts: 127.0.0.44 spyguard.comO1 - Hosts: 127.0.0.45 spykiller.comO1 - Hosts: 127.0.0.46 spyware.co.ukO1 - Hosts: 127.0.0.47 spyware-cop.comO1 - Hosts: 127.0.0.48 spywareinfo.comO1 - Hosts: 127.0.0.49 spywarenuker.comO1 - Hosts: 127.0.0.50 spywareremove.comO1 - Hosts: 127.0.0.51 spywareremove.comO1 - Hosts: 127.0.0.52 stopzillapro.comO1 - Hosts: 127.0.0.53 sunbelt-software.comO1 - Hosts: 127.0.0.54 thiefware.comO1 - Hosts: 127.0.0.55 tomcoyote.orgO1 - Hosts: 127.0.0.56 unwantedlinks.comO1 - Hosts: 127.0.0.57 webattack.comO1 - Hosts: 127.0.0.58 wilders.orgO1 - Hosts: 127.0.0.59 www.auditmypc.comO1 - Hosts: 127.0.0.60 www.bulletproofsoft.netO1 - Hosts: 127.0.0.61 www.cexx.orgO1 - Hosts: 127.0.0.62 www.computercops.usO1 - Hosts: 127.0.0.63 www.ct7support.comO1 - Hosts: 127.0.0.64 www.doxdesk.comO1 - Hosts: 127.0.0.65 www.eblocs.comO1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.comO1 - Hosts: 127.0.0.67 www.free-spyware-scan.comO1 - Hosts: 127.0.0.68 www.free-web-browsers.comO1 - Hosts: 127.0.0.69 www.grc.comO1 - Hosts: 127.0.0.70 www.grisoft.comO1 - Hosts: 127.0.0.71 www.hackfaq.orgO1 - Hosts: 127.0.0.72 www.hazeleger.netO1 - Hosts: 127.0.0.73 www.javacoolsoftware.comO1 - Hosts: 127.0.0.74 www.kellys-korner-xp.comO1 - Hosts: 127.0.0.75 www.kephyr.comO1 - Hosts: 127.0.0.76 www.lavasoft.deO1 - Hosts: 127.0.0.77 www.lavasoftusa.comO1 - Hosts: 127.0.0.78 www.lurkhere.comO1 - Hosts: 127.0.0.79 www.majorgeeks.comO1 - Hosts: 127.0.0.80 www.merijn.orgO1 - Hosts: 127.0.0.81 www.mjc1.comO1 - Hosts: 127.0.0.82 www.moosoft.comO1 - Hosts: 127.0.0.83 www.mvps.orgO1 - Hosts: 127.0.0.84 www.net-integration.netO1 - Hosts: 127.0.0.85 www.noadware.netO1 - Hosts: 127.0.0.86 www.no-spybot.comO1 - Hosts: 127.0.0.87 www.onlinepcfix.comO1 - Hosts: 127.0.0.88 www.pchell.comO1 - Hosts: 127.0.0.89 www.pestpatrol.comO1 - Hosts: 127.0.0.94 www.spychecker.comO1 - Hosts: 127.0.0.95 www.spychecker.comO1 - Hosts: 127.0.0.96 www.spycop.comO1 - Hosts: 127.0.0.97 www.spyguard.comO1 - Hosts: 127.0.0.98 www.spykiller.comO1 - Hosts: 127.0.0.99 www.spyware.co.ukO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr\msntb.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {E323AE7D-4AC3-47F4-B6D0-32DA232657E6} - C:\WINDOWS\System32\mbdp.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr\msntb.dllO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exeO4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exeO4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [seyyyucir] C:\WINDOWS\System32	vegvq.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBarO4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll,DllInstallO4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScanO4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exeO4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.fr/downloads/BUM/BUM_WIN_IE_1/axofupld.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{32AFBE6E-8225-4FA9-A5D9-53C554FA0436}: NameServer = 212.151.136.254 130.244.127.161O18 - Filter: text/html - {37CE9164-AF44-41AE-9225-24BB696EC2D7} - C:\WINDOWS\System32\mbdp.dllO18 - Filter: text/plain - {37CE9164-AF44-41AE-9225-24BB696EC2D7} - C:\WINDOWS\System32\mbdp.dllO21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dllO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exeO23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXEO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exeO23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exeBouli

tufs · Answer

salutscanne hijack<config<misc  tools< open  process  managerselectionne: tvegvq.exe<< kill  processselectionne: se.dll,DllInstall<<  kill  processclique  sur  back  puis  sur  scan  et  coche  ses  lignesR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shop.private.com/dvd_entry.asp?prod=dsam007_dpmo001 O1 - Hosts: 127.0.0.0 localhostO1 - Hosts: 127.0.0.2 auditmypc.comO1 - Hosts: 127.0.0.3 boards.cexx.orgO1 - Hosts: 127.0.0.4 bulletproofsoft.netO1 - Hosts: 127.0.0.5 camtech2000.netO1 - Hosts: 127.0.0.6 cexx.orgO1 - Hosts: 127.0.0.7 computercops.usO1 - Hosts: 127.0.0.8 ct7support.comO1 - Hosts: 127.0.0.9 doxdesk.comO1 - Hosts: 127.0.0.20 kellys-korner-xp.comO1 - Hosts: 127.0.0.21 kephyr.comO1 - Hosts: 127.0.0.22 lavasoft.deO1 - Hosts: 127.0.0.23 lavasoftusa.comO1 - Hosts: 127.0.0.24 lurkhere.comO1 - Hosts: 127.0.0.25 majorgeeks.comO1 - Hosts: 127.0.0.26 merijn.orgO1 - Hosts: 127.0.0.27 mjc1.comO1 - Hosts: 127.0.0.28 moosoft.comO1 - Hosts: 127.0.0.29 mvps.orgO1 - Hosts: 127.0.0.30 net-integration.netO1 - Hosts: 127.0.0.31 noadware.netO1 - Hosts: 127.0.0.32 no-spybot.comO1 - Hosts: 127.0.0.33 onlinepcfix.comO1 - Hosts: 127.0.0.34 pchell.comO1 - Hosts: 127.0.0.35 pestpatrol.comO1 - Hosts: 127.0.0.36 safer-networking.orgO1 - Hosts: 127.0.0.37 secure.spykiller.comO1 - Hosts: 127.0.0.38 secureie.comO1 - Hosts: 127.0.0.39 security.kolla.deO1 - Hosts: 127.0.0.40 spybot.infoO1 - Hosts: 127.0.0.41 spychecker.comO1 - Hosts: 127.0.0.42 spychecker.comO1 - Hosts: 127.0.0.43 spycop.comO1 - Hosts: 127.0.0.44 spyguard.comO1 - Hosts: 127.0.0.45 spykiller.comO1 - Hosts: 127.0.0.46 spyware.co.ukO1 - Hosts: 127.0.0.47 spyware-cop.comO1 - Hosts: 127.0.0.48 spywareinfo.comO1 - Hosts: 127.0.0.49 spywarenuker.comO1 - Hosts: 127.0.0.50 spywareremove.comO1 - Hosts: 127.0.0.51 spywareremove.comO1 - Hosts: 127.0.0.52 stopzillapro.comO1 - Hosts: 127.0.0.53 sunbelt-software.comO1 - Hosts: 127.0.0.54 thiefware.comO1 - Hosts: 127.0.0.55 tomcoyote.orgO1 - Hosts: 127.0.0.56 unwantedlinks.comO1 - Hosts: 127.0.0.57 webattack.comO1 - Hosts: 127.0.0.58 wilders.orgO1 - Hosts: 127.0.0.59 www.auditmypc.comO1 - Hosts: 127.0.0.60 www.bulletproofsoft.netO1 - Hosts: 127.0.0.61 www.cexx.orgO1 - Hosts: 127.0.0.62 www.computercops.usO1 - Hosts: 127.0.0.63 www.ct7support.comO1 - Hosts: 127.0.0.64 www.doxdesk.comO1 - Hosts: 127.0.0.65 www.eblocs.comO1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.comO1 - Hosts: 127.0.0.67 www.free-spyware-scan.comO1 - Hosts: 127.0.0.68 www.free-web-browsers.comO1 - Hosts: 127.0.0.69 www.grc.comO1 - Hosts: 127.0.0.70 www.grisoft.comO1 - Hosts: 127.0.0.71 www.hackfaq.orgO1 - Hosts: 127.0.0.72 www.hazeleger.netO1 - Hosts: 127.0.0.73 www.javacoolsoftware.comO1 - Hosts: 127.0.0.74 www.kellys-korner-xp.comO1 - Hosts: 127.0.0.75 www.kephyr.comO1 - Hosts: 127.0.0.76 www.lavasoft.deO1 - Hosts: 127.0.0.77 www.lavasoftusa.comO1 - Hosts: 127.0.0.78 www.lurkhere.comO1 - Hosts: 127.0.0.79 www.majorgeeks.comO1 - Hosts: 127.0.0.80 www.merijn.orgO1 - Hosts: 127.0.0.81 www.mjc1.comO1 - Hosts: 127.0.0.82 www.moosoft.comO1 - Hosts: 127.0.0.83 www.mvps.orgO1 - Hosts: 127.0.0.84 www.net-integration.netO1 - Hosts: 127.0.0.85 www.noadware.netO1 - Hosts: 127.0.0.86 www.no-spybot.comO1 - Hosts: 127.0.0.87 www.onlinepcfix.comO1 - Hosts: 127.0.0.88 www.pchell.comO1 - Hosts: 127.0.0.89 www.pestpatrol.comO1 - Hosts: 127.0.0.94 www.spychecker.comO1 - Hosts: 127.0.0.95 www.spychecker.comO1 - Hosts: 127.0.0.96 www.spycop.comO1 - Hosts: 127.0.0.97 www.spyguard.comO1 - Hosts: 127.0.0.98 www.spykiller.comO1 - Hosts: 127.0.0.99 www.spyware.co.uk O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll O2 - BHO: (no name) - {E323AE7D-4AC3-47F4-B6D0-32DA232657E6} - C:\WINDOWS\System32\mbdp.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O4 - HKLM\..\Run: [seyyyucir] C:\WINDOWS\System32	vegvq.exe O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll,DllInstall O18 - Filter: text/html - {37CE9164-AF44-41AE-9225-24BB696EC2D7} - C:\WINDOWS\System32\mbdp.dllO18 - Filter: text/plain - {37CE9164-AF44-41AE-9225-24BB696EC2D7} - C:\WINDOWS\System32\mbdp.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll ferme  tout  les  programmes  en  cours  et  fait  fix  chekedredemarre  en  mode  sans  echec  (  session  administ  si  possible )tapotte   sur  touche  f8  au  demarrage  du   pcassure  toi  d  avoir  acces  aux  fichier  cacherexplorateur  windows< outil< option  des  dossier < affichagecoche: afficher  les  fichier  cacher...........decoche: masquer  les  extentions  des  fichiers.........decoche : masquer  les  fichier.......recherche  et  supprime  manuellement  ce  qui  en  gras C:\WINDOWS\System32\ tvegvq.exe C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\ se.dll,DllInstall C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\ se.dll/sp.html C:\WINDOWS\System32\ mbdp.dllC:\WINDOWS\System32\ vbsys2.dll vive  ta  corbeil   remet  l  affichage  par  defaut  etreboot  pc  et  relance  hijack  pour  verif

Bouli · Answer

Salut Tufs,

Merci beaucoup pour ton aide.

J'ai fait tout ce qui tu m'as indiqué.

Par contre, je n'ai pas trouvé de se.dll,DllInstall.

J'ai juste supprimé se.dll. et en me connectant, j'ai eu un message indiquant qu'il ne trouvait pas cette ressource (se.dll).

Sinon, tout a l'air de bien fonctionner.

Voici le nouveau rapport :

Logfile of HijackThis v1.99.1
Scan saved at 18:28:20, on 05/03/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Canon\MultiPASS4\MPTBox.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Antispyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.fr/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{32AFBE6E-8225-4FA9-A5D9-53C554FA0436}: NameServer = 212.151.136.246 130.244.127.169
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Bouli

balltrap34 · Answer

salut
dans la base de registre chercher ceci et virer continuer la recherche pour chaque fichier avec la touche f3 j usqua la fin du registre
jethomepage
ce.exe
sp.dll
------
allez sur demarrer/executer
et taper msconfig
rechercher une entree en relation avec
se.dll la decocher et appliquer
----------------
ensuite relancer hijack cocher et fixer ceci
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\VERHAS~1\LOCALS~1\Temp\se.dll,DllInstall

----------
redemarrer et refaire un hijack

Bouli · Answer

Hello,

Merci pour ton aide.

je n'ai pas trouvé de ce.exe dans la base de registre.
J'ai fait tout le reste sans problème.

Voici le nouveau rapport:

Logfile of HijackThis v1.99.1
Scan saved at 10:57:45, on 06/03/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Canon\MultiPASS4\MPTBox.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Antispyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.fr/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{32AFBE6E-8225-4FA9-A5D9-53C554FA0436}: NameServer = 212.151.136.254 130.244.127.161
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Bouli

balltrap34 · Answer

retu na pas d anti virus et de pare feu?????????????

Bouli · Answer

Bah, j'avais un antivirus mais il ne marchait plus.Donc je l'ai viré. Il faut que j'en remette un.

balltrap34 · Answer

comme je t ai mis les deux obligatoire anti virus et pare feu

Rapport HijackThis

7 réponses

Discussions similaires

Newsletters