Vundo, smitfraud

Résolu
antinoos -  
bonjour,

j'ai un gros problème.
je ne connais absolument rien à l'informatique.
voila virus scan entreprise mcaffe me dit qu'il a détecte et supprime le cheval de trois vundo et spybot smitfraud, mais à chaque scan ils sont la.
le problème c'est que sa ouvres des pages internet parfois pornographique mon petit frère va souvent sur le pc donc il pourrai tomber sur ces sites.

pour mon niveau informatique c'est nada.
donc si vous pouvez m'aide en m'indiquant les démarche avec des explication pas trop complique merci.
Configuration: Windows XP
Firefox 2.0.0.1

107 réponses

Résumé de la discussion

Une machine Windows XP, avec Firefox 2.0.0.1, est infectée par des malwares tels que Vundo et Smitfraud/Virtumundo, provoquant des redirections d'affichage et des détections répétées par les outils de sécurité. Pour résoudre cela, les éléments de réponse essentiels préconisent d'exécuter L2mFix en mode sûr, en choisissant l'option 2 puis de lancer SmitfraudFix pour nettoyer les restes et générer un rapport. Des analyses complémentaires avec HijackThis et des listes de processus et de clés de démarrage permettent d'identifier les composants à supprimer, puis d'obtenir un rapport détaillé à communiquer. En cas d'infection persistante, il est conseillé de déconnecter le PC du réseau pendant le nettoyage et de sauvegarder les données avant toute manipulation pour limiter les risques et les réinfections.

Bobot (l’IA à votre service)
  1. green day Modérateur
    Salut

    Je vois que tu as déjà crée un poste et que Mok's@ s'occupe de toi, merci de continuer avec lui ;-)

    ++
    1. toosmarty4u
      salut greenday,

      j'ai le meme genre de probleme que antinoos et sans doute le meme niveau en oinformatique (a peine mieux disons)
      et je galère trop
      j'ai essayé d'enlever smitfraud mais je galère:

      voila le rapport smitfraudfix :
      en plus norton m'alerte a chaque fois que j'essaie de l'executer.

      si tu peux me guider comme tu l'a fait avec antinoos, ce serait enorme!

      merci de ton aide

      mitFraudFix v2.197

      Scan done at 20:44:55,65, 10/07/2007
      Run from C:\Program Files\SmitfraudFix
      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
      The filesystem type is NTFS
      Fix run in normal mode

      »»»»»»»»»»»»»»»»»»»»»»»» Process

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\System32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
      C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
      C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
      C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
      C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Apoint\Apoint.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\WINDOWS\ATK0100\Hcontrol.exe
      C:\Program Files\Apoint\Apntex.exe
      C:\WINDOWS\System32\ezSP_Px.exe
      C:\WINDOWS\system32\ICO.EXE
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Sony\HotKey Utility\HKserv.exe
      C:\Program Files\sony\vaio update 2\VAIOUpdt.exe
      C:\Program Files\Sony\ISB Utility\ISBMgr.exe
      C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Sony\HotKey Utility\HKWnd.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\WINDOWS\VM_STI.EXE
      C:\Program Files\Real\RealPlayer\RealPlay.exe
      C:\WINDOWS\ATK0100\ATKOSD.exe
      C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\RALINK\Common\RaUI.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\cmd.exe

      »»»»»»»»»»»»»»»»»»»»»»»» hosts

      »»»»»»»»»»»»»»»»»»»»»»»» C:\

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Olive

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Olive\Application Data

      »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Olive\Favoris

      »»»»»»»»»»»»»»»»»»»»»»»» Desktop

      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

      »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

      »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
      !!!Attention, following keys are not inevitably infected!!!

      SrchSTS.exe by S!Ri
      Search SharedTaskScheduler's .dll

      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
      !!!Attention, following keys are not inevitably infected!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      "AppInit_DLLs"=""

      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
      !!!Attention, following keys are not inevitably infected!!!

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
      "System"=""

      »»»»»»»»»»»»»»»»»»»»»»»» Rustock

      »»»»»»»»»»»»»»»»»»»»»»»» DNS

      Description: Intel(R) PRO/Wireless 2200BG Network Connection - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 212.27.54.252
      DNS Server Search Order: 212.27.53.252

      Description: Intel(R) PRO/1000 MT Network Connection - Miniport d'ordonnancement de paquets
      DNS Server Search Order: 212.27.39.134
      DNS Server Search Order: 213.228.0.168

      HKLM\SYSTEM\CCS\Services\Tcpip\..\{ACABCBD7-34EF-4087-8281-92318C715FB5}: DhcpNameServer=212.27.39.134 213.228.0.168
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{E85755E9-446D-415E-AF91-280A7C08E24D}: DhcpNameServer=212.27.39.1 212.27.32.5
      HKLM\SYSTEM\CCS\Services\Tcpip\..\{FCC276D8-7475-4BB2-AD5F-560B9854893D}: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{ACABCBD7-34EF-4087-8281-92318C715FB5}: DhcpNameServer=212.27.39.134 213.228.0.168
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{E85755E9-446D-415E-AF91-280A7C08E24D}: DhcpNameServer=212.27.39.1 212.27.32.5
      HKLM\SYSTEM\CS1\Services\Tcpip\..\{FCC276D8-7475-4BB2-AD5F-560B9854893D}: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS3\Services\Tcpip\..\{ACABCBD7-34EF-4087-8281-92318C715FB5}: DhcpNameServer=212.27.39.134 213.228.0.168
      HKLM\SYSTEM\CS3\Services\Tcpip\..\{E85755E9-446D-415E-AF91-280A7C08E24D}: DhcpNameServer=212.27.39.1 212.27.32.5
      HKLM\SYSTEM\CS3\Services\Tcpip\..\{FCC276D8-7475-4BB2-AD5F-560B9854893D}: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
      HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252

      »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

      »»»»»»»»»»»»»»»»»»»»»»»» End
      4. green day Modérateur
        re

        Si tu n'as plus de problème, alors, oui : il n'y en a plus :)

        garde avg antispayware, ccleaner + cleanup et tu peux virer tout le reste, installe un parefeu !

        un peu de lecture :

        https://sebsauvage.net/safehex.html

        securite proteger un ordinateur contre les malwares d internet

        @+
        1. antinoos Auteur
          donc il n'y a plus de problème dans le pc?
          je doit desinstaller tous les antivirus ou certain peuvent etre utile?

          merci de m'avoir aider.
          1. green day Modérateur
            Salut

            pour ad-aware, c'est normal ...

            sinon le dernier hijack est bon !

            ++
            1. antinoos Auteur
              j'ai fait le scan en ligne, apres plusieurs heures quand je suis revenu internet explorer indiquer qu'il avait eu une erreur et qu'il devait ferme.
              mcaffe détecte le virus new poly win dans un dossier mais il ne le détruit pas, donc je vais le détruire manuellement mais il revient.
              mais il ne détecte plus vundo ou smitfraud.

              quand je lance ad aware se il trouve toujours une tracking cookie @live365

              Logfile of HijackThis v1.99.1
              Scan saved at 15:47, on 07-02-28
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16414)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\Ati2evxx.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
              C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
              C:\Program Files\Network Associates\VirusScan\Mcshield.exe
              C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
              C:\WINDOWS\PMJ151LA.BIN
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\wanmpsvc.exe
              C:\WINDOWS\system32\Ati2evxx.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
              C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
              C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
              C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
              C:\Program Files\QuickTime\qttask.exe
              C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
              C:\Program Files\eMule\emule.exe
              C:\WINDOWS\system32\msiexec.exe
              C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
              C:\Documents and Settings\Soulimane Aouraghe\Bureau\Raccourcis Bureau non utilisés\CCM.exe

              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
              R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
              O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
              O2 - BHO: DgnWebIE - {2843DAC1-05EF-11D2-95BA-0060083493D6} - C:\Program Files\Dragon Systems\NaturallySpeaking\Program\web_ie.dll
              O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
              O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
              O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
              O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
              O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
              O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
              O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
              O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
              O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
              O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
              O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
              O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
              O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
              O11 - Options group: [INTERNATIONAL] International*
              O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
              O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
              O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
              O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
              O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
              O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
              O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
              O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
              O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
              O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN
              O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
              O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
              1. green day Modérateur
                Salut !

                fixe ces lignes :

                O2 - BHO: (no name) - {2D81C3CA-5A42-4D14-B119-CCFD483CAE09} - (no file)

                O2 - BHO: (no name) - {BEB6DFB0-2056-4398-8C68-C03CF14A823D} - (no file)
                et refais le scan en ligne de bitfefender stp

                @+
                1. antinoos Auteur
                  la sa n'ouvre plus de fenêtre internet de pub et l'antivirus ne détecte rien

                  Logfile of HijackThis v1.99.1
                  Scan saved at 23:42, on 07-02-26
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16414)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
                  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
                  C:\WINDOWS\PMJ151LA.BIN
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\wanmpsvc.exe
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
                  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
                  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                  C:\Program Files\QuickTime\qttask.exe
                  C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
                  C:\Program Files\MSN Messenger\usnsvc.exe
                  C:\Program Files\Windows Media Player\wmplayer.exe
                  C:\WINDOWS\System32\imapi.exe
                  C:\Documents and Settings\Soulimane Aouraghe\Bureau\CCM.exe

                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                  R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                  O2 - BHO: DgnWebIE - {2843DAC1-05EF-11D2-95BA-0060083493D6} - C:\Program Files\Dragon Systems\NaturallySpeaking\Program\web_ie.dll
                  O2 - BHO: (no name) - {2D81C3CA-5A42-4D14-B119-CCFD483CAE09} - (no file)
                  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: (no name) - {BEB6DFB0-2056-4398-8C68-C03CF14A823D} - (no file)
                  O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
                  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
                  O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                  O11 - Options group: [INTERNATIONAL] International*
                  O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
                  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
                  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
                  O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN
                  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                  O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                  2. antinoos Auteur
                    killbox dit pending fil rename operation registry data has been removed by external process

                    que doi je faire
                    1. green day Modérateur
                      Salut

                      Relance hijackthis :

                      choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

                      R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)

                      O2 - BHO: (no name) - {085BD6FD-6D13-45BC-AFC3-0627FFF188E4} - (no file)
                      O2 - BHO: (no name) - {19807030-8DBC-4106-ABF3-4C6B5432EA75} - (no file)
                      O2 - BHO: (no name) - {271CFC49-D79E-4BF1-BCED-989705CD0E53} - (no file)

                      O2 - BHO: (no name) - {2D81C3CA-5A42-4D14-B119-CCFD483CAE09} - (no file)

                      O2 - BHO: (no name) - {54541452-263F-4B34-8F25-20AA884C4C3D} - (no file)
                      O2 - BHO: (no name) - {6531E851-40D0-47DB-A77D-524BBC29E135} - (no file)

                      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

                      O2 - BHO: (no name) - {D5B866E9-6E6D-40C5-A1F2-C6341950A8DD} - C:\WINDOWS\system32\geeby.dll
                      O2 - BHO: (no name) - {E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} - C:\WINDOWS\system32\yhlkoews.dll

                      O20 - Winlogon Notify: awtqnkh - awtqnkh.dll (file missing)
                      O20 - Winlogon Notify: byxutts - byxutts.dll (file missing)
                      O20 - Winlogon Notify: byxxvvs - byxxvvs.dll (file missing)
                      O20 - Winlogon Notify: byxyabc - byxyabc.dll (file missing)
                      O20 - Winlogon Notify: ddcbcya - ddcbcya.dll (file missing)
                      O20 - Winlogon Notify: geeby - C:\WINDOWS\system32\geeby.dll
                      O20 - Winlogon Notify: iifgecd - iifgecd.dll (file missing)
                      O20 - Winlogon Notify: mljijif - mljijif.dll (file missing)
                      O20 - Winlogon Notify: mljjkji - mljjkji.dll (file missing)
                      O20 - Winlogon Notify: nnnnkji - nnnnkji.dll (file missing)
                      O20 - Winlogon Notify: nnnnnol - nnnnnol.dll (file missing)
                      O20 - Winlogon Notify: opnoomk - opnoomk.dll (file missing)
                      O20 - Winlogon Notify: rqrolkl - rqrolkl.dll (file missing)
                      O20 - Winlogon Notify: rqronom - rqronom.dll (file missing)
                      O20 - Winlogon Notify: rqrqoop - rqrqoop.dll (file missing)
                      O20 - Winlogon Notify: ssqnomn - ssqnomn.dll (file missing)
                      O20 - Winlogon Notify: ssqrrro - ssqrrro.dll (file missing)
                      O20 - Winlogon Notify: tuvwwwu - tuvwwwu.dll (file missing)

                      O20 - Winlogon Notify: wvuspmj - wvuspmj.dll (file missing)
                      O20 - Winlogon Notify: xxywxwu - xxywxwu.dll (file missing)
                      O20 - Winlogon Notify: xxyxwvw - xxyxwvw.dll (file missing)
                      O20 - Winlogon Notify: yayawvt - yayawvt.dll (file missing)

                      ensuite, redémarre en mode sans échec :

                      Double-clique killbox.exe.

                      Copie le texte gras ci-bas (sélectionne tout avec ta souris, clic-droit et "Copier") :

                      C:\WINDOWS\system32\yhlkoews.dll
                      C:\WINDOWS\system32\geeby.dll

                      * Sélectionnz "delete on reboot"
                      * Cliquez sur le menu "File" -> "Past from clip board"
                      * Cliquez sur All Files
                      * Cliquez sur la croix rouge et et blanche

                      ensuite :

                      passe un coup de ccleaner et reposte un nouveau hijack stp, précise l'évolution de la situation !

                      ++
                      2. antinoos Auteur
                        voila les rapports

                        SDFix: Version 1.65

                        Run by: Soulimane Aouraghe - 07-02-26 @ 0:40:41.14

                        Microsoft Windows XP [version 5.1.2600]

                        Running From: C:\SDFix

                        Safe Mode:
                        Checking Services:

                        Name:
                        WSMSPSVC

                        Path:
                        "C:\WINDOWS\msngr.exe"

                        WSMSPSVC Deleted

                        Restoring Windows Registry Entries
                        Restoring Default Hosts File

                        Rebooting...

                        Normal Mode:
                        Checking Files:

                        Below files will be copied to Backups folder then removed:

                        C:\WINDOWS\msngr.exe - Deleted

                        ADS Check:

                        C:\WINDOWS\system32
                        No streams found.

                        Final Check:

                        Authorized Application Key Export:

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
                        "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"
                        "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:LocalSubNet:Disabled:Yahoo! Messenger"
                        "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
                        "C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"="C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe:*:Disabled:TmNationsESWC"
                        "C:\\Program Files\\SCi\\Conflict\\Desert Storm\\DesertStorm.exe"="C:\\Program Files\\SCi\\Conflict\\Desert Storm\\DesertStorm.exe:*:Disabled:Conflict:Desert Storm"
                        "C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"
                        "C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
                        "C:\\Program Files\\ABC\\abc.exe"="C:\\Program Files\\ABC\\abc.exe:*:Disabled:abc"
                        "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                        "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
                        "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Disabled:BitComet - a BitTorrent Client"
                        "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Disabled:BitTorrent"
                        "C:\\Program Files\\JVTorrent\\btdownloadgui.exe"="C:\\Program Files\\JVTorrent\\btdownloadgui.exe:*:Disabled:btdownloadgui"
                        "C:\\Program Files\\F-Secure Anti-Virus\\backweb\\4476822\\Program\\fspex.exe"="C:\\Program Files\\F-Secure Anti-Virus\\backweb\\4476822\\Program\\fspex.exe:*:Disabled:F-Secure Anti-Virus 2005"
                        "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Disabled:GameSpy Arcade"
                        "C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Disabled:Kazaa Media Desktop"
                        "C:\\Program Files\\Kazaa Lite\\Kazaa.kpp"="C:\\Program Files\\Kazaa Lite\\Kazaa.kpp:*:Disabled:Kazaa Media Desktop"
                        "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Disabled:LimeWire"
                        "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Disabled:LimeWire swarmed installer"
                        "C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"="C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe:*:Disabled:P2P Networking"
                        "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
                        "C:\\Program Files\\EA GAMES\\Battlefield 1942 Secret Weapons of WWII Demo\\BF1942.exe"="C:\\Program Files\\EA GAMES\\Battlefield 1942 Secret Weapons of WWII Demo\\BF1942.exe:*:Disabled:BF1942"
                        "C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Disabled:M5Shell"
                        "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Disabled:Windows Live Messenger 8.0 (Phone)"
                        "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Disabled:Windows Messenger"
                        "C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Disabled:Windows® NetMeeting®"
                        "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
                        "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
                        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                        "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
                        "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
                        "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                        "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
                        "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

                        Remaining Files:
                        ---------------

                        Backups Folder: - C:\SDFix\backups\backups.zip

                        Checking For Files with Hidden Attributes :

                        C:\Documents and Settings\Soulimane Aouraghe\Bureau\musique\Nas - Illmatic (Reissue 2004) - Rap [www.torrentazos.com]\Thumbs.db
                        C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll
                        C:\WINDOWS\system32\awtqpmj.dll
                        C:\WINDOWS\system32\awtstuv.dll.vir
                        C:\WINDOWS\system32\geeby.dll
                        C:\WINDOWS\system32\geedb.dll.vir
                        C:\WINDOWS\system32\mljgf.dll.vir
                        C:\WINDOWS\system32\mljkjkj.dll.vir
                        C:\WINDOWS\system32\nnnkjih.dll
                        C:\WINDOWS\system32\pmnlm.dll.vir
                        C:\WINDOWS\system32\urqroml.dll
                        C:\WINDOWS\system32\43824BF15B.sys

                        Finished

                        Logfile of HijackThis v1.99.1
                        Scan saved at 00:58, on 07-02-26
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16414)

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                        C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                        C:\Program Files\Network Associates\VirusScan\Mcshield.exe
                        C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
                        C:\WINDOWS\PMJ151LA.BIN
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\wanmpsvc.exe
                        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                        C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
                        C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
                        C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                        C:\Program Files\QuickTime\qttask.exe
                        C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
                        C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
                        C:\Documents and Settings\Soulimane Aouraghe\Bureau\CCM.exe

                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                        R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)
                        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                        O2 - BHO: (no name) - {085BD6FD-6D13-45BC-AFC3-0627FFF188E4} - (no file)
                        O2 - BHO: (no name) - {19807030-8DBC-4106-ABF3-4C6B5432EA75} - (no file)
                        O2 - BHO: (no name) - {271CFC49-D79E-4BF1-BCED-989705CD0E53} - (no file)
                        O2 - BHO: DgnWebIE - {2843DAC1-05EF-11D2-95BA-0060083493D6} - C:\Program Files\Dragon Systems\NaturallySpeaking\Program\web_ie.dll
                        O2 - BHO: (no name) - {2D81C3CA-5A42-4D14-B119-CCFD483CAE09} - (no file)
                        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: (no name) - {54541452-263F-4B34-8F25-20AA884C4C3D} - (no file)
                        O2 - BHO: (no name) - {6531E851-40D0-47DB-A77D-524BBC29E135} - (no file)
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: (no name) - {D5B866E9-6E6D-40C5-A1F2-C6341950A8DD} - C:\WINDOWS\system32\geeby.dll
                        O2 - BHO: (no name) - {E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} - C:\WINDOWS\system32\yhlkoews.dll
                        O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                        O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                        O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                        O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
                        O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
                        O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                        O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                        O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
                        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                        O11 - Options group: [INTERNATIONAL] International*
                        O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
                        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                        O20 - Winlogon Notify: awtqnkh - awtqnkh.dll (file missing)
                        O20 - Winlogon Notify: byxutts - byxutts.dll (file missing)
                        O20 - Winlogon Notify: byxxvvs - byxxvvs.dll (file missing)
                        O20 - Winlogon Notify: byxyabc - byxyabc.dll (file missing)
                        O20 - Winlogon Notify: ddcbcya - ddcbcya.dll (file missing)
                        O20 - Winlogon Notify: geeby - C:\WINDOWS\system32\geeby.dll
                        O20 - Winlogon Notify: iifgecd - iifgecd.dll (file missing)
                        O20 - Winlogon Notify: mljijif - mljijif.dll (file missing)
                        O20 - Winlogon Notify: mljjkji - mljjkji.dll (file missing)
                        O20 - Winlogon Notify: nnnnkji - nnnnkji.dll (file missing)
                        O20 - Winlogon Notify: nnnnnol - nnnnnol.dll (file missing)
                        O20 - Winlogon Notify: opnoomk - opnoomk.dll (file missing)
                        O20 - Winlogon Notify: rqrolkl - rqrolkl.dll (file missing)
                        O20 - Winlogon Notify: rqronom - rqronom.dll (file missing)
                        O20 - Winlogon Notify: rqrqoop - rqrqoop.dll (file missing)
                        O20 - Winlogon Notify: ssqnomn - ssqnomn.dll (file missing)
                        O20 - Winlogon Notify: ssqrrro - ssqrrro.dll (file missing)
                        O20 - Winlogon Notify: tuvwwwu - tuvwwwu.dll (file missing)
                        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
                        O20 - Winlogon Notify: wvuspmj - wvuspmj.dll (file missing)
                        O20 - Winlogon Notify: xxywxwu - xxywxwu.dll (file missing)
                        O20 - Winlogon Notify: xxyxwvw - xxyxwvw.dll (file missing)
                        O20 - Winlogon Notify: yayawvt - yayawvt.dll (file missing)
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                        O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                        O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
                        O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
                        O23 - Service: PMJ151 AutoLaunch Service (PMJ151LA) - Matsushita Electric Industrial Co. ,Ltd, - C:\WINDOWS\PMJ151LA.BIN
                        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                        O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                        1. green day Modérateur
                          Salut

                          tu fais < démarrer < poste de travail < disque local C:\ < et là tu cherches un fichier du nom de SDFix

                          tu dois aussi le trouvé en mode sans échec !

                          ++
                          1. antinoos Auteur
                            salut

                            comprend pas.
                            tu peut m'explique à la façon antivirus pour les nul
                            1. green day Modérateur
                              Salut

                              regarde si le dossier n'a pas était crée sous la racine ( partition C:/ dans poste de travail )

                              ++
                              • 1
                              • 2
                              • 3
                              • 4
                              • 5
                              • 6

                              Discussions similaires

                              Smitfraud-C
                              Lasto97

                              25 réponses
                              Surinfection Win32:Virut,Win32:Rootkit-gen,tr
                              gorgutz

                              29 réponses
                              [XP] Desinfection smitfraud
                              titelea

                              9 réponses
                              message de securité smitfraud
                              fuertes

                              59 réponses
                              Win32:Vundo@dll [Trj]
                              Ned'

                              22 réponses