Mon pc rame

jb10 -  
bonjour
j'ai téléchargé le logiciel hijackthis et j'ai fait un scan (voir ci dessous)
est-ce quelqu'un peut m'aider a régler mes problèmes
merci beaucoup par avance
Logfile of HijackThis v1.99.1
Scan saved at 16:59:24, on 20/12/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\94.tmp
c:\docume~1\jean-b~1\applic~1\newchi~1\Dentwavewindow.exe
c:\docume~1\jean-b~1\applic~1\newchi~1\Dentwavewindow.exe
C:\WINDOWS\System32\msiexec.exe
C:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX09.063\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.psrvnonrufbefmlqtvmmo.net/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeWt5QKqMb/lsZIg4_W7nt2/.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.oreka.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe smsse.exe
F2 - REG:system.ini: UserInit=userinit.exe,xpjava.exe
O1 - Hosts: 64.233.167.104 www.symantec.com
O1 - Hosts: 64.233.167.104 www.sophos.com
O1 - Hosts: 64.233.167.104 www.mcafee.com
O1 - Hosts: 64.233.167.104 www.viruslist.com
O1 - Hosts: 64.233.167.104 www.f-secure.com
O1 - Hosts: 64.233.167.104 www.avp.com
O1 - Hosts: 64.233.167.104 www.kaspersky.com
O1 - Hosts: 64.233.167.104 www.networkassociates.com
O1 - Hosts: 64.233.167.104 www.ca.com
O1 - Hosts: 64.233.167.104 www.my-etrust.com
O1 - Hosts: 64.233.167.104 www.nai.com
O1 - Hosts: 64.233.167.104 www.trendmicro.com
O1 - Hosts: 64.233.167.104 www.grisoft.com
O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
O1 - Hosts: 64.233.167.104 symantec.com
O1 - Hosts: 64.233.167.104 sophos.com
O1 - Hosts: 64.233.167.104 mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
O1 - Hosts: 64.233.167.104 viruslist.com
O1 - Hosts: 64.233.167.104 f-secure.com
O1 - Hosts: 64.233.167.104 kaspersky.com
O1 - Hosts: 64.233.167.104 kaspersky-labs.com
O1 - Hosts: 64.233.167.104 avp.com
O1 - Hosts: 64.233.167.104 networkassociates.com
O1 - Hosts: 64.233.167.104 ca.com
O1 - Hosts: 64.233.167.104 mast.mcafee.com
O1 - Hosts: 64.233.167.104 my-etrust.com
O1 - Hosts: 64.233.167.104 download.mcafee.com
O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
O1 - Hosts: 64.233.167.104 secure.nai.com
O1 - Hosts: 64.233.167.104 nai.com
O1 - Hosts: 64.233.167.104 update.symantec.com
O1 - Hosts: 64.233.167.104 updates.symantec.com
O1 - Hosts: 64.233.167.104 us.mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
O1 - Hosts: 64.233.167.104 customer.symantec.com
O1 - Hosts: 64.233.167.104 rads.mcafee.com
O1 - Hosts: 64.233.167.104 trendmicro.com
O1 - Hosts: 64.233.167.104 grisoft.com
O1 - Hosts: 64.233.167.104 sandbox.norman.no
O1 - Hosts: 64.233.167.104 www.pandasoftware.com
O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {77B37C7B-057E-F3B6-8E23-EA9EDC2D0160} - C:\DOCUME~1\JEAN-B~1\APPLIC~1\MULTIO~1\deafface.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exe
O4 - HKLM\..\Run: [runs] run.exe
O4 - HKLM\..\Run: [ATIUpdater] atiupdxx.exe
O4 - HKLM\..\Run: [HPWebSync] WebSyncSvc.exe
O4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\94.tmp
O4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exe
O4 - HKLM\..\RunServices: [runs] run.exe
O4 - HKLM\..\RunServices: [ATIUpdater] atiupdxx.exe
O4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exe
O4 - HKCU\..\Run: [runs] run.exe
O4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exe
O4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exe
O4 - HKCU\..\Run: [ball first] C:\DOCUME~1\JEAN-B~1\APPLIC~1\NEWCHI~1\city bike htm.exe
O4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exe
O4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exe
O4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.oreka.com
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exe
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.tbcode.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32\rpcsvc.exe

14 réponses

  1. aranjuez31 Contributeur
    bjr

    fixe ceciO4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAj

    m.à.j de windows update: sp2

    vire cette usine à spy qu'est messenger plus

    as-tu appliqué les post 13 & 14 ? - aimerais connaître les résultats
    1. jb10
      merci beucoup pour vos conseils
      voici mon nouvel hijackthis

      Logfile of HijackThis v1.99.1
      Scan saved at 12:24:09, on 31/12/2005
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\SYSTEM32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\LEXBCES.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\CTsvcCDA.exe
      C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
      C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
      C:\Program Files\MessengerPlus! 3\MsgPlus.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Digital Line Detect\DLG.exe
      C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
      C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
      C:\Program Files\Windows Media Player\wmplayer.exe
      C:\WINDOWS\System32\imapi.exe
      C:\Program Files\AIM\aim.exe
      C:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX00.094\HijackThis.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.cxdqwhlyntyrslnqnltbtcusx.com/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeXmhm/3C4D6bpIg4_W7nt2/.html
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
      O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
      O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exe
      O4 - HKLM\..\Run: [runs] run.exe
      O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
      O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
      O4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exe
      O4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exe
      O4 - HKCU\..\Run: [runs] run.exe
      O4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exe
      O4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exe
      O4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAj
      O4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exe
      O4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exe
      O4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exe
      O4 - Global Startup: Digital Line Detect.lnk = ?
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
      O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
      O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
      O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
      O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.oreka.com
      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - AppInit_DLLs: MsgPlusLoader.dll
      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
      O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
      O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
      O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
      O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
      O23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32\rpcsvc.exe (file missing)
      1. Utilisateur anonyme
        salut

        oui, (post 8), mais le ver empeche l'acces aux sites av (les 01), et de plus symantec à eu la bonne idée de mettre le mot fix dans le nom de son outil de désinfection, et le ver bloque l'execution de tout processus contenant les mots: fix, tool, removal...etc, lol
        Avec de la chance peut-être en mode sans echec...
        C'est un ver qui date, mais ca fait plusieurs log que je le vois réapparaitre, il reprend du service on dirait...

        a+
        1. aranjuez31 Contributeur
          re

          ok
          merci pour l'info ,moe
      4. aranjuez31 Contributeur
        re

        fixe
        O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\msmbw.exe
        et aussi
        O4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\msmbw.exe

        et ce n'est pas fini
        toutes ces 01 ne me plaisent pas
        as-tu mis ces objets dans fichier host de toi-même ??
        1. aranjuez31 Contributeur
          bsr
          fixe les 016
          O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
          O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} (CInstall Class) - http://adserver.sharewareonline.com/adserver/Install.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
          O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cab
          1. quick157
            Salut jb,

            Continue à suivre les conseils qui te sont donnés ci-dessus.

            Pour info, ccleaner et cleanup sont des nettoyeurs alors que spybot est un antispyware (excellent logiciel d'ailleurs). Ce ne sont donc ni des antivirus ni des pare-feu.

            Bien à toi
            1. Utilisateur anonyme
              Salut

              Désolé d'avoir à te dire ca, mais ton pc est une usine à vers et trojans, installe un firewall d'urgence.
              http://www.inoculer.com/firewall5.php3

              Ensuite télécharge ceci et enregistre le sur ton bureau:
              http://cjoint.com/?mymgm8Q8pC

              Redemarre en mode sans echec:
              Redemarre le pc, laisse passer l'écran du bios, puis tapote sur la touche F8 avant qu'apparaisse l'écran de chargement de windows.
              Choisis le mode sans échec dans les options et valide avec entrée.

              dezippe mymgm8Q8pC_Sflog.zip (clic droit dessus>extraire tout) puis double clic sur sflog.exe
              une fois fais, redemarre le pc normalement et fait un scan av ici et poste le rapport:
              http://www.bitdefender.fr

              a+
              1. jb10
                merci beaucoup pour votre aide.
                est-ce que ccleaner, clean up et spybot sont des antivirus ou des pare feu??
                voici mon nouveau rapport
                merci encore pour votre aide

                Logfile of HijackThis v1.99.1
                Scan saved at 23:20:33, on 23/12/2005
                Platform: Windows XP SP1 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\LEXBCES.EXE
                C:\WINDOWS\system32\spoolsv.exe
                C:\WINDOWS\System32\Ati2evxx.exe
                C:\WINDOWS\System32\CTsvcCDA.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\System32\MsPMSPSv.exe
                C:\Program Files\Messenger\msmsgs.exe
                C:\Program Files\QuickTime\qttask.exe
                C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
                C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                C:\Program Files\winupdates\winupdates.exe
                C:\WINDOWS\System32\lexpps.exe
                C:\WINDOWS\System32\ctfmon.exe
                C:\Program Files\MSN Messenger\MsnMsgr.Exe
                C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                C:\Program Files\Digital Line Detect\DLG.exe
                C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
                C:\Program Files\LimeWire\LimeWire.exe
                C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
                C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
                C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
                C:\Program Files\AIM\aim.exe
                C:\Program Files\Internet Explorer\IEXPLORE.EXE
                C:\WINDOWS\explorer.exe
                C:\Program Files\WinRAR\WinRAR.exe
                C:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX00.468\HijackThis.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.cxdqwhlyntyrslnqnltbtcusx.com/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeXmhm/3C4D6bpIg4_W7nt2/.html
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O1 - Hosts: 64.233.167.104 www.symantec.com
                O1 - Hosts: 64.233.167.104 www.sophos.com
                O1 - Hosts: 64.233.167.104 www.mcafee.com
                O1 - Hosts: 64.233.167.104 www.viruslist.com
                O1 - Hosts: 64.233.167.104 www.f-secure.com
                O1 - Hosts: 64.233.167.104 www.avp.com
                O1 - Hosts: 64.233.167.104 www.kaspersky.com
                O1 - Hosts: 64.233.167.104 www.networkassociates.com
                O1 - Hosts: 64.233.167.104 www.ca.com
                O1 - Hosts: 64.233.167.104 www.my-etrust.com
                O1 - Hosts: 64.233.167.104 www.nai.com
                O1 - Hosts: 64.233.167.104 www.trendmicro.com
                O1 - Hosts: 64.233.167.104 www.grisoft.com
                O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
                O1 - Hosts: 64.233.167.104 symantec.com
                O1 - Hosts: 64.233.167.104 sophos.com
                O1 - Hosts: 64.233.167.104 mcafee.com
                O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
                O1 - Hosts: 64.233.167.104 viruslist.com
                O1 - Hosts: 64.233.167.104 f-secure.com
                O1 - Hosts: 64.233.167.104 kaspersky.com
                O1 - Hosts: 64.233.167.104 kaspersky-labs.com
                O1 - Hosts: 64.233.167.104 avp.com
                O1 - Hosts: 64.233.167.104 networkassociates.com
                O1 - Hosts: 64.233.167.104 ca.com
                O1 - Hosts: 64.233.167.104 mast.mcafee.com
                O1 - Hosts: 64.233.167.104 my-etrust.com
                O1 - Hosts: 64.233.167.104 download.mcafee.com
                O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
                O1 - Hosts: 64.233.167.104 secure.nai.com
                O1 - Hosts: 64.233.167.104 nai.com
                O1 - Hosts: 64.233.167.104 update.symantec.com
                O1 - Hosts: 64.233.167.104 updates.symantec.com
                O1 - Hosts: 64.233.167.104 us.mcafee.com
                O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
                O1 - Hosts: 64.233.167.104 customer.symantec.com
                O1 - Hosts: 64.233.167.104 rads.mcafee.com
                O1 - Hosts: 64.233.167.104 trendmicro.com
                O1 - Hosts: 64.233.167.104 grisoft.com
                O1 - Hosts: 64.233.167.104 sandbox.norman.no
                O1 - Hosts: 64.233.167.104 www.pandasoftware.com
                O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
                O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
                O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
                O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exe
                O4 - HKLM\..\Run: [runs] run.exe
                O4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\94.tmp
                O4 - HKLM\..\Run: [Printer Spooler] C:\WINDOWS\system32\9A.tmp
                O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\msmbw.exe
                O4 - HKLM\..\Run: [serpe] C:\WINDOWS\System32\serbw.exe
                O4 - HKLM\..\Run: [avnort] C:\WINDOWS\msmbw.exe
                O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
                O4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exe
                O4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exe
                O4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\msmbw.exe
                O4 - HKLM\..\RunServices: [serpe] C:\WINDOWS\System32\serbw.exe
                O4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\msmbw.exe
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
                O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exe
                O4 - HKCU\..\Run: [runs] run.exe
                O4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exe
                O4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exe
                O4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAj
                O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                O4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exe
                O4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exe
                O4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exe
                O4 - Global Startup: Digital Line Detect.lnk = ?
                O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
                O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
                O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
                O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
                O14 - IERESET.INF: START_PAGE_URL=http://www.oreka.com
                O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
                O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} (CInstall Class) - http://adserver.sharewareonline.com/adserver/Install.cab
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cab
                O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                O20 - AppInit_DLLs: MsgPlusLoader.dll
                O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
                O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
                O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
                O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
                O23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32\rpcsvc.exe (file missing)
                1. aranjuez31 Contributeur
                  bsr
                  2 antivirus se neutralisent et ne font pas leur boulot
                  on ne répéte jamais assez : 1 seul antivirus, 1 seul pare-feu !
                  fais en sorte de régler ce pb d'abord
                  1. jb10
                    merci beaucoup carlasne
                    je suis en train de faire ce que tu m'as recommandé
                    je te tiendrais au courant
                    1. carlasne
                      re jb et sa tu le fixe
                      O1 - Hosts: 64.233.167.104 www.symantec.com
                      O1 - Hosts: 64.233.167.104 www.sophos.com
                      O1 - Hosts: 64.233.167.104 www.mcafee.com
                      O1 - Hosts: 64.233.167.104 www.viruslist.com
                      O1 - Hosts: 64.233.167.104 www.f-secure.com
                      O1 - Hosts: 64.233.167.104 www.avp.com
                      O1 - Hosts: 64.233.167.104 www.kaspersky.com
                      O1 - Hosts: 64.233.167.104 www.networkassociates.com
                      O1 - Hosts: 64.233.167.104 www.ca.com
                      O1 - Hosts: 64.233.167.104 www.my-etrust.com
                      O1 - Hosts: 64.233.167.104 www.nai.com
                      O1 - Hosts: 64.233.167.104 www.trendmicro.com
                      O1 - Hosts: 64.233.167.104 www.grisoft.com
                      O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
                      O1 - Hosts: 64.233.167.104 symantec.com
                      O1 - Hosts: 64.233.167.104 sophos.com
                      O1 - Hosts: 64.233.167.104 mcafee.com
                      O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
                      O1 - Hosts: 64.233.167.104 viruslist.com
                      O1 - Hosts: 64.233.167.104 f-secure.com
                      O1 - Hosts: 64.233.167.104 kaspersky.com
                      O1 - Hosts: 64.233.167.104 kaspersky-labs.com
                      O1 - Hosts: 64.233.167.104 avp.com
                      O1 - Hosts: 64.233.167.104 networkassociates.com
                      O1 - Hosts: 64.233.167.104 ca.com
                      O1 - Hosts: 64.233.167.104 mast.mcafee.com
                      O1 - Hosts: 64.233.167.104 my-etrust.com
                      O1 - Hosts: 64.233.167.104 download.mcafee.com
                      O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
                      O1 - Hosts: 64.233.167.104 secure.nai.com
                      O1 - Hosts: 64.233.167.104 nai.com
                      O1 - Hosts: 64.233.167.104 update.symantec.com
                      O1 - Hosts: 64.233.167.104 updates.symantec.com
                      O1 - Hosts: 64.233.167.104 us.mcafee.com
                      O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
                      O1 - Hosts: 64.233.167.104 customer.symantec.com
                      O1 - Hosts: 64.233.167.104 rads.mcafee.com
                      O1 - Hosts: 64.233.167.104 trendmicro.com
                      O1 - Hosts: 64.233.167.104 grisoft.com
                      O1 - Hosts: 64.233.167.104 sandbox.norman.no
                      O1 - Hosts: 64.233.167.104 www.pandasoftware.com
                      O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
                      O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
                      O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exe
                      O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) -
                      @ plus claude
                      1. carlasne
                        bonjour jb
                        commence par sa
                        1 faite un scan en ligne http://www.bitdefender.fr/bd/site/products.php?p_id=24
                        et faite une analyse avec ses logiciel

                        2 télécharger ewido https://www.avg.com/en-ww/homepage
                        démo 14 jours et gratuit après sans protection active et mise a jours automatique

                        3 télécharger ad aware
                        Ad-aware

                        4 télécharger spybote
                        https://www.clubic.com/telecharger-fiche10965-spybot-search-and-destroy.html

                        5 faite les mise a jours et nettoyer votre pc

                        6 télécharger cleanup sur le site de M balltrap 34 (encore merci) voir démo section virus
                        http://www.florensac-chasse-trap.com/
                        ensuite a toi de choisir panda ou avaste ou risque de confit
                        @++ claude
                        1. quick157
                          Salut JB,

                          Hormis ton log HijackThis, tu devrais peut-être donner un minimum d'explication concernant le problème que tu rencontres. Ca aiderait certainement les membres qui sont aptes à déchiffrer le log.

                          Bien à toi
                          1. jb
                            merci quick157
                            mais je ne mis connais pas beaucoup en informatique
                            je sais juste que j'avais plusieurs virus comme cheval de troie par exemple et d'autres
                            et en plus lorsque j'allume mon ordi il y a un message d'erreur qui apparaît en me disant qu'il ne trouve pas le logiciel smsse.exe et je n'arrive pas à le trouver moi-même
                            c'est tout ce que je peux dire
                            merci