Virus, reboot, Pokepoke

Question

Bonsoir, je vous écris à partir d'un PC complètement à la ramasse :o

Depuis quelques jours déjà (voir quelques mois), mon ordinateur se voit régulièrement (ré)infecté par les mêmes virus, qui visibilement font partis de cette catégorie qui s'accroche réellement. De mémoire, les deux plus "énervants" en tout cas ceux qui me posent le plus de problêmes actuellement, il s'agit de : Trojan.Win32.Elitebar.g et Pokepoke76. Le premier ralentis, voir reboot mon pc à plusieurs reprises, le second ne cesse de m'ouvrir IE et semble faire une fixation sur un certain Winfixer 2005.

Donc bref, j'ai déjà Hijack, LQFix et CCleaner pour me charger du nettoyage, me manque que la méthode. Histoire de pas perdre de temps, je poste directement mon rapport Hijack :

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1MOZILL~1FIREFOX.EXE
D:HijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://www.directsearchzone.com/sp2.php
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.directsearchzone.com/sp2.php
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.directsearchzone.com/sp2.php
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = local.,
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:WINDOWSSystem32mljge.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [ATIPTA] "C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe"
O4 - HKLM..Run: [Smapp] C:Program FilesAnalog DevicesSoundMAXSMTray.exe
O4 - HKLM..Run: [Windows Svshost Service Update 32] svcsshost32.exe
O4 - HKLM..Run: [Wind0ws Sharing] ssprotecter.exe
O4 - HKLM..Run: [Microsoft Update] wuamkop32.exe
O4 - HKLM..Run: [System Update Service] update.pif
O4 - HKLM..Run: [TkBellExe] "C:Program FilesFichiers communsRealUpdate_OBrealsched.exe" -osboot
O4 - HKLM..Run: [Windows Security Service] windows.pif
O4 - HKLM..Run: [DAEMON Tools-1033] "D:Program FilesD-Toolsdaemon.exe" -lang 1033
O4 - HKLM..Run: [MSDOS Security Service] msdos.pif
O4 - HKLM..Run: [iTunesHelper] "D:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_04binjusched.exe
O4 - HKLM..Run: [KAVPersonal50] "D:Program FilesKaspersky LabKaspersky Anti-Virus Personalkav.exe" /minimize
O4 - HKLM..Run: [MS Security] systm.pif
O4 - HKLM..Run: [Windows Security] ms32.pif
O4 - HKLM..Run: [Win Security] msw32.pif
O4 - HKLM..Run: [OS Security] mswind32.pif
O4 - HKLM..Run: [SVCH Service] svch32.pif
O4 - HKLM..Run: [HTML Help System] hhs.pif
O4 - HKLM..Run: [HTML32 Help System] hhs32.pif
O4 - HKLM..Run: [Internet Help Svc] IHSVC.EXE
O4 - HKLM..Run: [MNI.UWFX5V_0001_LP] "C:DOCUME~1quintLOCALS~1Templsas.exe"
O4 - HKLM..Run: [System service78] C:WINDOWSetbpokapoka78.exe
O4 - HKLM..RunServices: [SERV PacK2] nure.exe
O4 - HKLM..RunServices: [Windows Svshost Service Update 32] svcsshost32.exe
O4 - HKLM..RunServices: [Wind0ws Sharing] ssprotecter.exe
O4 - HKLM..RunServices: [Microsoft Update] wuamkop32.exe
O4 - HKLM..RunServices: [Windows Updating Service] updating.pif
O4 - HKLM..RunServices: [MS UniX] navupdate64.exe
O4 - HKLM..RunServices: [System Update Service] update.pif
O4 - HKLM..RunServices: [Windows Security Service] windows.pif
O4 - HKLM..RunServices: [MS-DOS Boot Service] boot32.pif
O4 - HKLM..RunServices: [MS-DOS Security Service] ms-dos.pif
O4 - HKLM..RunServices: [MSDOS Security Service] msdos.pif
O4 - HKLM..RunServices: [System Updates Service] updates.pif
O4 - HKLM..RunServices: [MS Unix Binary] hypertrm.exe
O4 - HKLM..RunServices: [MS Security] systm.pif
O4 - HKLM..RunServices: [Windows Security] ms32.pif
O4 - HKLM..RunServices: [Win Security] msw32.pif
O4 - HKLM..RunServices: [Wind Security] mswi32.pif
O4 - HKLM..RunServices: [OS Security] mswind32.pif
O4 - HKLM..RunServices: [SVCH Service] svch32.pif
O4 - HKLM..RunServices: [HTML Help System] hhs.pif
O4 - HKLM..RunServices: [HTML32 Help System] hhs32.pif
O4 - HKLM..RunServices: [Internet Help Svc] IHSVC.EXE
O4 - HKCU..Run: [Windows Svshost Service Update 32] svcsshost32.exe
O4 - HKCU..Run: [Windows Updating Service] updating.pif
O4 - HKCU..Run: [MS UniX] navupdate64.exe
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN Messengermsnmsgr.exe" /background
O4 - HKCU..Run: [Steam] "d:program filesvalvesteamsteam.exe" -silent
O4 - HKCU..Run: [Windows Security Service] windows.pif
O4 - HKCU..Run: [MS-DOS Boot Service] boot32.pif
O4 - HKCU..Run: [MS-DOS Security Service] ms-dos.pif
O4 - HKCU..Run: [System Update Service] update.pif
O4 - HKCU..Run: [MSDOS Security Service] msdos.pif
O4 - HKCU..Run: [System Updates Service] updates.pif
O4 - HKCU..Run: [MS Unix Binary] hypertrm.exe
O4 - HKCU..Run: [Toijuo] C:WINDOWSSystem32n?tdde.exe
O4 - HKCU..Run: [Aaau] "C:Program Filesatuowpwt.exe" -vt ndrv
O4 - HKCU..Run: [MS Security] systm.pif
O4 - HKCU..Run: [Windows Security] ms32.pif
O4 - HKCU..Run: [Win Security] msw32.pif
O4 - HKCU..Run: [Wind Security] mswi32.pif
O4 - HKCU..Run: [OS Security] mswind32.pif
O4 - HKCU..Run: [HTML Help System] hhs.pif
O4 - HKCU..Run: [HTML32 Help System] hhs32.pif
O4 - HKCU..Run: [Internet Help Svc] IHSVC.EXE
O4 - HKCU..RunServices: [Windows Updating Service] updating.pif
O4 - HKCU..RunServices: [Windows Security Service] windows.pif
O4 - HKCU..RunServices: [MS-DOS Boot Service] boot32.pif
O4 - HKCU..RunServices: [MS-DOS Security Service] ms-dos.pif
O4 - HKCU..RunServices: [System Update Service] update.pif
O4 - HKCU..RunServices: [MSDOS Security Service] msdos.pif
O4 - HKCU..RunServices: [System Updates Service] updates.pif
O4 - HKCU..RunServices: [MS Security] systm.pif
O4 - HKCU..RunServices: [Windows Security] ms32.pif
O4 - HKCU..RunServices: [Win Security] msw32.pif
O4 - HKCU..RunServices: [Wind Security] mswi32.pif
O4 - HKCU..RunServices: [OS Security] mswind32.pif
O4 - HKCU..RunServices: [HTML Help System] hhs.pif
O4 - HKCU..RunServices: [HTML32 Help System] hhs32.pif
O4 - HKCU..RunServices: [Internet Help Svc] IHSVC.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:WinZipWZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_04binnpjpi150_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_04binnpjpi150_04.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:WINDOWSSystem32Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengerMSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengerMSMSGS.EXE (file missing)
O10 - Unknown file in Winsock LSP: c:program filesbonjourmdnsnsp.dll
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/fra_pao_med.exe
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Za [...] ge-c11.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - Winlogon Notify: ddcca - ddcca.dll (file missing)
O20 - Winlogon Notify: mljge - C:WINDOWSSystem32mljge.dll
O20 - Winlogon Notify: mljgg - mljgg.dll (file missing)
O20 - Winlogon Notify: ssttt - ssttt.dll (file missing)
O20 - Winlogon Notify: vtuts - C:WINDOWSSystem32vtuts.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesFichiers communsInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:Program FilesiPodbiniPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - D:Program FilesKaspersky LabKaspersky Anti-Virus Personalkavsvc.exe
O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:WINDOWSSystem32lsasrv.exe (file missing)
O23 - Service: MSGSERVICE - Unknown owner - C:WINDOWSmsgsrv.exe (file missing)
O23 - Service: TCP/IP NetBIOS Connections (nbconn) - Unknown owner - C:WINDOWSwinstub.exe (file missing)
O23 - Service: netinfo - Unknown owner - C:WINDOWSnetinfo.exe (file missing)
O23 - Service: NTFSprotect (ntfsdiscman) - Unknown owner - C:WINDOWSntfsprotect.exe (file missing)
O23 - Service: Performance Logs (Perfhmon) - Unknown owner - C:WINDOWSSystem32Perfhmon.exe (file missing)
O23 - Service: System Manager Service (SMSC) - Unknown owner - C:WINDOWSsmsc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
O23 - Service: WindowsSysBoot - Unknown owner - C:WINDOWSwinsys.exe (file missing)
O23 - Service: MS Dns Service (WinNet) - Unknown owner - C:WINDOWSsystem32wincntrl.exe

Voilà, en esperant recevoir des réponses positives ainsi qu'un peu d'aide. Merci d'avance.

PS: Je signale par précaution que je n'arrive pas à lancer le mode sans échec classique. Il bloque. Je passe par le mode sans échec avec prise en charge de réseaux, j'espere que ça pose pas de problême. Re-merci.

boulepate · Answer

Salut,
dit nous tu es sous quelle version de windows?!
Ensuite telecharge ces logiciels gratuit fait un scan avec chacun puis seulement après remet un rapport hijack:
installe vite un anti virus:
avast! Edition Familiale:
Un antivirus gratuit et en français!
Avast Edition Familiale

SpyBot - Search & Destroy en français:
Spybot Search & Destroy

a² free: Contre les trojans et malware.
a² free

Ad-Aware SE Personal:(en anglais)
Ad-aware

Le patch pour le faire fonctionner en français:
Patch FR pour Ad-aware

boulepate · Answer

Re,
tu peux fixer ceci:

R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://www.directsearchzone.com/sp2.php
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.directsearchzone.com/sp2.php
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.directsearchzone.com/sp2.php
O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:WINDOWSSystem32mljge.dll
O4 - HKLM..Run: [Windows Svshost Service Update 32] svcsshost32.exe
O4 - HKLM..Run: [Wind0ws Sharing] ssprotecter.exe
O4 - HKLM..Run: [Microsoft Update] wuamkop32.exe
O4 - HKLM..Run: [System Update Service] update.pif
O4 - HKLM..Run: [Windows Security Service] windows.pif
O4 - HKLM..Run: [MSDOS Security Service] msdos.pif
O4 - HKLM..Run: [MS Security] systm.pif
O4 - HKLM..Run: [Windows Security] ms32.pif
O4 - HKLM..Run: [Win Security] msw32.pif
O4 - HKLM..Run: [OS Security] mswind32.pif
O4 - HKLM..Run: [SVCH Service] svch32.pif
O4 - HKLM..Run: [HTML Help System] hhs.pif
O4 - HKLM..Run: [HTML32 Help System] hhs32.pif
O4 - HKLM..Run: [Internet Help Svc] IHSVC.EXE
O4 - HKLM..Run: [System service78] C:WINDOWSetbpokapoka78.exe
O4 - HKLM..RunServices: [SERV PacK2] nure.exe
O4 - HKLM..RunServices: [Windows Svshost Service Update 32] svcsshost32.exe
O4 - HKLM..RunServices: [Wind0ws Sharing] ssprotecter.exe
O4 - HKLM..RunServices: [Microsoft Update] wuamkop32.exe
O4 - HKLM..RunServices: [Windows Updating Service] updating.pif
O4 - HKLM..RunServices: [MS UniX] navupdate64.exe
O4 - HKLM..RunServices: [System Update Service] update.pif
O4 - HKLM..RunServices: [Windows Security Service] windows.pif
O4 - HKLM..RunServices: [MS-DOS Boot Service] boot32.pif
O4 - HKLM..RunServices: [MS-DOS Security Service] ms-dos.pif
O4 - HKLM..RunServices: [MSDOS Security Service] msdos.pif
O4 - HKLM..RunServices: [System Updates Service] updates.pif
O4 - HKLM..RunServices: [MS Unix Binary] hypertrm.exe
O4 - HKLM..RunServices: [MS Security] systm.pif
O4 - HKLM..RunServices: [Windows Security] ms32.pif
O4 - HKLM..RunServices: [Win Security] msw32.pif
O4 - HKLM..RunServices: [Wind Security] mswi32.pif
O4 - HKLM..RunServices: [OS Security] mswind32.pif
O4 - HKLM..RunServices: [SVCH Service] svch32.pif
O4 - HKLM..RunServices: [HTML Help System] hhs.pif
O4 - HKLM..RunServices: [HTML32 Help System] hhs32.pif
O4 - HKLM..RunServices: [Internet Help Svc] IHSVC.EXE
O4 - HKCU..Run: [Windows Svshost Service Update 32] svcsshost32.exe
O4 - HKCU..Run: [Windows Updating Service] updating.pif
O4 - HKCU..Run: [MS UniX] navupdate64.exe
O4 - HKCU..Run: [Windows Security Service] windows.pif
O4 - HKCU..Run: [MS-DOS Boot Service] boot32.pif
O4 - HKCU..Run: [MS-DOS Security Service] ms-dos.pif
O4 - HKCU..Run: [System Update Service] update.pif
O4 - HKCU..Run: [MSDOS Security Service] msdos.pif
O4 - HKCU..Run: [System Updates Service] updates.pif
O4 - HKCU..Run: [MS Unix Binary] hypertrm.exe
O4 - HKCU..Run: [Toijuo] C:WINDOWSSystem32n?tdde.exe
O4 - HKCU..Run: [Aaau] "C:Program Filesatuowpwt.exe" -vt ndrv
O4 - HKCU..Run: [MS Security] systm.pif
O4 - HKCU..Run: [Windows Security] ms32.pif
O4 - HKCU..Run: [Win Security] msw32.pif
O4 - HKCU..Run: [Wind Security] mswi32.pif
O4 - HKCU..Run: [OS Security] mswind32.pif
O4 - HKCU..Run: [HTML Help System] hhs.pif
O4 - HKCU..Run: [HTML32 Help System] hhs32.pif
O4 - HKCU..Run: [Internet Help Svc] IHSVC.EXE
O4 - HKCU..RunServices: [Windows Updating Service] updating.pif
O4 - HKCU..RunServices: [Windows Security Service] windows.pif
O4 - HKCU..RunServices: [MS-DOS Boot Service] boot32.pif
O4 - HKCU..RunServices: [MS-DOS Security Service] ms-dos.pif
O4 - HKCU..RunServices: [System Update Service] update.pif
O4 - HKCU..RunServices: [MSDOS Security Service] msdos.pif
O4 - HKCU..RunServices: [System Updates Service] updates.pif
O4 - HKCU..RunServices: [MS Security] systm.pif
O4 - HKCU..RunServices: [Windows Security] ms32.pif
O4 - HKCU..RunServices: [Win Security] msw32.pif
O4 - HKCU..RunServices: [Wind Security] mswi32.pif
O4 - HKCU..RunServices: [OS Security] mswind32.pif
O4 - HKCU..RunServices: [HTML Help System] hhs.pif
O4 - HKCU..RunServices: [HTML32 Help System] hhs32.pif
O4 - HKCU..RunServices: [Internet Help Svc] IHSVC.EXE
O10 - Unknown file in Winsock LSP: c:program filesbonjourmdnsnsp.dll
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/fra_pao_med.exe
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Za [...] ge-c11.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activ [...] asinst.cab
O20 - Winlogon Notify: ddcca - ddcca.dll (file missing)
O20 - Winlogon Notify: mljge - C:WINDOWSSystem32mljge.dll
O20 - Winlogon Notify: mljgg - mljgg.dll (file missing)
O20 - Winlogon Notify: ssttt - ssttt.dll (file missing)
O20 - Winlogon Notify: vtuts - C:WINDOWSSystem32vtuts.dll
O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:WINDOWSSystem32lsasrv.exe (file missing)
O23 - Service: MSGSERVICE - Unknown owner - C:WINDOWSmsgsrv.exe (file missing)
O23 - Service: TCP/IP NetBIOS Connections (nbconn) - Unknown owner - C:WINDOWSwinstub.exe (file missing)
O23 - Service: netinfo - Unknown owner - C:WINDOWSnetinfo.exe (file missing)
O23 - Service: NTFSprotect (ntfsdiscman) - Unknown owner - C:WINDOWSntfsprotect.exe (file missing)
O23 - Service: Performance Logs (Perfhmon) - Unknown owner - C:WINDOWSSystem32Perfhmon.exe (file missing)
O23 - Service: System Manager Service (SMSC) - Unknown owner - C:WINDOWSsmsc.exe (file missing)

recherche ces fichiers sur ton pc et supprime si present:
svcsshost32.exe
ssprotecter.exe
wuamkop32.exe
update.pif
windows.pif
msdos.pif
systm.pif
ms32.pif
msw32.pif
mswind32.pif
svch32.pif
hhs.pif
hhs32.pif
pokapoka78.exe
nure.exe
svcsshost32.exe
ssprotecter.exe
wuamkop32.exe
navupdate64.exe
windows.pif
boot32.pif
msdos.pif
hypertrm.exe
systm.pif
ms32.pif
msw32.pif
mswi32.pif
svch32.pif
hhs.pif
hhs32.pif
svcsshost32.exe
updating.pif
navupdate64.exe
windows.pif
boot32.pif
ms-dos.pif
update.pif
msdos.pif
updates.pif
hypertrm.exe
systm.pif
ms32.pif
msw32.pif
mswi32.pif
mswind32.pif
hhs.pif
hhs32.pif
boot32.pif
ms-dos.pif
updates.pif
systm.pif
ms32.pif
msw32.pif
mswi32.pif
hhs.pif
hhs32.pif
IHSVC.EXE

Tapes dans executer " msconfig" và sur l'onglet demarrage et desactive si tu vois des fichiers similaires, fait un scan avec sypbot, ad-aware, a²free, puis remet un rapport hijack s'il te plait.

boulepate · Answer

Re,tu peux encore fixer ceci:O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\System32\mljge.dll O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:\WINDOWS\System32\lsasrv.exe (file missing) O23 - Service: microsoft update (msnupdate) - Unknown owner - C:\WINDOWS\windupdate.exe O23 - Service: TCP/IP NetBIOS Connections (nbconn) - Unknown owner - C:\WINDOWS\winstub.exe (file missing) O23 - Service: NTFSprotect (ntfsdiscman) - Unknown owner - C:\WINDOWS
tfsprotect.exe (file missing) O23 - Service: Performance Logs (Perfhmon) - Unknown owner - C:\WINDOWS\System32\Perfhmon.exe (file missing) O23 - Service: WindowsSysBoot - Unknown owner - C:\WINDOWS\winsys.exe (file missing)Tu peux telecharger un firewall, pour plus de sécurité:ZoneAlarm:Zone AlarmOù en est ton probléme ?! Met à jour ton windows si tu ne la pas fait.

balltrap34 · Answer

salutremet nous un hijack par securite

balltrap34 · Answer

salut commence par ceci
telecharge ceci
http://www.downloads.subratam.org/l2mfix.exe
decompresse le double clik sur l2mfix.bat appuie sur n importe quelle touche et ensuite choisi l option 2
a la fin il vas reboter donne moi son rapport et refait un hijack

Oone · Answer

Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1516 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1660 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!

Zipping up files for submission:
adding: clear.reg (188 bytes security) (deflated 2%)
adding: lo2.txt (188 bytes security) (deflated 49%)
adding: test.txt (188 bytes security) (stored 0%)
adding: test2.txt (188 bytes security) (stored 0%)
adding: test3.txt (188 bytes security) (stored 0%)
adding: test5.txt (188 bytes security) (stored 0%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mljge]
"Asynchronous"=dword:00000001
"DllName"="C:\\WINDOWS\\System32\\mljge.dll"
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************

Hijack arrive dans quelques minutes.

balltrap34 · Answer

oki

balltrap34 · Answer

salut****************************************************************&#9658; imprime ceci pour ne rien oublier et tous fairetous faire dans l ordre imperativement****************************************************************&#9658; tous da bord telecharge ces programmes si tu ne les a pas et met les a jour mais ne les utilise pas encore et verifie que tu as les bonnes version c est imperatif&#9834;  ad-aware (1)version 1.06 (ici)               http://www.florensac-chasse-trap.com/   section virusvoir demo http://pageperso.aol.fr/balltrap34/adwseflash.zip***&#9834;  spybot (2)version 1.4       (ici)               http://www.florensac-chasse-trap.com/   section virusvoir demo http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm***et aussi ceci&#9834;  CleanUp40.exe(3)voir demohttp://pageperso.aol.fr/balltrap34/democleanup.htm***&#9834;  a2(4)http://www.emsisoft.net/fr/penser a le metre a jour avant de scanner le pc*******************************************************************&#9658; assure toi de ceci Affiche tous les fichiers et dossiers : cliquer sur démarrer/panneau de configuration/option des dossiers/affichage Cocher afficher les dossiers cacher Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décocher masquer les extensions dont le type est connu Puis fais «Ok» pour valider les changements. Et appliquer ****************************************************************&#9658; vide tes fichiers temps et tempory internet file sur tous les utilisateur utilise ceci pour le faire &#9834;http://pageperso.aol.fr/Balltrap34/CleanUp40.exe   ****************************************************************&#9658; relance hijack coche ces lignes et  ensuite clik sur fixO2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\System32\mljge.dll O4 - HKLM\..\Run: [MNI.UWFX5V_0001_LP] "C:\DOCUME~1\quint\LOCALS~1\Temp\lsas.exe" O4 - HKLM\..\RunServices: [Internet Help Svc] IHSVC.EXE O4 - HKCU\..\Run: [Internet Help Svc] IHSVC.EXE O4 - HKCU\..\RunServices: [Internet Help Svc] IHSVC.EXE O20 - Winlogon Notify: mljge - C:\WINDOWS\System32\mljge.dll O23 - Service: ILT - Unknown owner - C:\WINDOWS\ilt.exe (file missing)O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:\WINDOWS\System32\lsasrv.exe (file missing) O23 - Service: TCP/IP NetBIOS Connections (nbconn) - Unknown owner - C:\WINDOWS\winstub.exe (file missing) O23 - Service: NTFSprotect (ntfsdiscman) - Unknown owner - C:\WINDOWS
tfsprotect.exe (file missing) O23 - Service: Performance Logs (Perfhmon) - Unknown owner - C:\WINDOWS\System32\Perfhmon.exe (file missing) O23 - Service: MS Dns Service (WinNet) - Unknown owner - C:\WINDOWS\system32\wincntrl.exe****************************************************************&#9658;****************************************************************&#9658; redemarre en mode sans echecmode sans echec pour cela tu tapote la touche f8 des le debut de l allumage du pc sans t arreter une fenetre vas souvrir tute deplace avec les fleches du clavier sur demarreren mode sans echec une fois sur le bureau il ni auras pas toutes les couleurs et autres c est normal.si f8 ne marche pas utilise la touche f5****************************************************************&#9658; recherche et suppr ceciC:\WINDOWS\System32\mljge.dll IHSVC.EXE C:\WINDOWS\ilt.exeC:\WINDOWS\system32\wincntrl.exeC:\WINDOWS\System32\Perfhmon.exeC:\WINDOWS
tfsprotect.exeC:\WINDOWS\System32\lsasrv.exe****************************************************************&#9658;****************************************************************&#9658;passe  adaware et vire tous se qu il trouve    ****************************************************************&#9658;passe spy boot et vire tous se qu il trouvent****************************************************************&#9658;passe a2****************************************************************tu vide ta poubelle et tu redemarre en mode normal et refait un hijack et precise ou en sont tes soucis--

balltrap34 · Answer

j est oublier de te faire arreter les services lol

clik sur Démarrer->exécuter->tape: services.msc

Double-clique: Network Security Service (LSA Server)

Règle-le sur "Arrêté" et "Désactivé".

et fait de meme avecceci
nbconn

ntfsdiscman

Perfhmon

WinNet

et recommence la procedure

balltrap34 · Answer

le premier tu la trouver refait un hijack

Utilisateur anonyme · Answer

salut

en attendant balltrap, vérifie si les services n'apparaissent pas sous ces noms exact:

TCP/IP NetBIOS Connections
NTFSprotect
Performance Logs
MS Dns Service

ensuite, rend toi ici:
http://www.nod32.it/home/home.htm
Dans le menu déroulant de droite, remonte jusqu'a :
Agent.CS trojan cleaner
puis clic sur download
Dezippe AGCSCLEAN.zip

redemarre en mode sans echecs:
dans le dossier AGCSCLEAN, double clic sur le fichier AGCSCLEAN.exe

redemarre le pc et reposte un rapport hijackthis

a+

Utilisateur anonyme · Answer

salut oobe

tu as bien passé le fix en mode sans echec ?

le rapport hijackthis, tu l'a fais en mode normal ?

si tu as bien passé le fix en mode sans echec, je te mettrais une autre manip pour virer celui qui resiste.

a+

Oone · Answer

Desolé, avec un peu de retard, le log Hijack en mode normal :Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Analog Devices\SoundMAX\SMTray.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeD:\Program Files\D-Tools\daemon.exeD:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_04\bin\jusched.exeC:\Program Files\MSN Messenger\msnmsgr.exeD:\program files\valve\steam\steam.exeD:\WinZip\WZQKPICK.EXEC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\iPod\bin\iPodService.exeD:\HijackThis.exeR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {416A95BA-5B0D-02DC-2AB7-7195CEF38EC2} - C:\WINDOWS\System32\veoij.dllO2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\System32\mljge.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimizeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silentO4 - Global Startup: WinZip Quick Pick.lnk = D:\WinZip\WZQKPICK.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dllO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: mljge - C:\WINDOWS\System32\mljge.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Oone · Answer

Bonjour, je suis de retour avec des problêmes supplémentaires. C'est simple : je ne sais pas ce qui se passe. Mon ordinateur rame complètement, bloque, redemarre sans arrêt et Kaspersky ne me signale aucun problêmes. Voici donc mon Hijack en esperant recevoir une fois de plus une aide positive :Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\MOZILL~1\FIREFOX.EXED:\HijackThis.exeR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {416A95BA-5B0D-02DC-2AB7-7195CEF38EC2} - C:\WINDOWS\System32\veoij.dllO2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\System32\mljge.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exeO4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimizeO4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exeO4 - HKLM\..\Run: [Browser Help Svc] BHSV.EXEO4 - HKLM\..\Run: [jncLaWWVZRQZU]La]X] C:\WINDOWS\System32\cbyymuf.exeO4 - HKLM\..\Run: [Up Service] up32.pifO4 - HKLM\..\RunServices: [Browser Help Svc] BHSV.EXEO4 - HKLM\..\RunServices: [jncLaWWVZRQZU]La]X] C:\WINDOWS\System32\cbyymuf.exeO4 - HKLM\..\RunServices: [Up Service] up32.pifO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silentO4 - HKCU\..\Run: [Browser Help Svc] BHSV.EXEO4 - HKCU\..\Run: [Up Service] up32.pifO4 - HKCU\..\RunServices: [Browser Help Svc] BHSV.EXEO4 - HKCU\..\RunServices: [Up Service] up32.pifO4 - Global Startup: WinZip Quick Pick.lnk = D:\WinZip\WZQKPICK.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dllO16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/fra_pagl.exeO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: mljge - C:\WINDOWS\System32\mljge.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exeO23 - Service: Microsoft Distributed Transaction (MSDT) - Unknown owner - C:\WINDOWS\msdt.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Oone · Answer

Personne ne peut m'aider ? :|

Goudax · Answer

Salut, 

Vas voir sur le forum de 01net, y a un type, Maekal_morte, qui se demerde pas mal du tout avec toutes ces daubes. Il m'a bien aidé, j'ai plus rien, ou du moins je ne vois plus rien, mais mon PC tourne bien.

Virus, reboot, Pokepoke

16 réponses

Discussions similaires

Newsletters