Trojan generic

jerome143 -  
Bonjour à tous, voilà j'ai un troj generic sur les fichiers
e:\WINDOWS\Drivers\Microsoft\microsoft.exe
e:\WINDOWS\Drivers\Microsoft\services32.exe
e:\WINDOWS\Drivers\Microsoft\unroot.bat

j'ai fait un log de hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 19:15:07, on 29/08/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
E:\Program Files\QuickTime\qttask.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
E:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
E:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
E:\WINDOWS\System32\rundll32.exe
E:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
E:\WINDOWS\System32\nvsvc32.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\MsPMSPSv.exe
D:\D-Tools\daemon.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\WINDOWS\Drivers\Microsoft\service.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\utilitaires\cd utilitaires\internet\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PSPVideo9] D:\Program Files\pspvideo9\pspvideo9.exe -t
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Service] E:\WINDOWS\Drivers\Microsoft\Servicerun.exe E:\WINDOWS\Drivers\Microsoft\Service.exe
O4 - HKLM\..\Run: [avast!] c:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WhenUSave] "E:\Program Files\Save\Save.exe"
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: KODAK Software Updater.lnk = E:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = E:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://jeromemilielric.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jeromemilielric.spaces.live.com/PhotoUpload/MsnPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DDF3BA8-1D86-487C-973D-9282C055731D}: NameServer = 80.10.246.130 80.10.246.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - c:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - E:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - Unknown owner - c:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - c:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - c:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - D:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: Microsoft Star Window Service - Unknown owner - E:\WINDOWS\System32\dllcache\svcshoter.exe (file missing)
O23 - Service: Network helper Service (MSDisk) - Unknown owner - E:\WINDOWS\System32\irdvxc.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

qqun peut 'il m'aider svp?

Merci d'avance
Configuration: Windows XP
Internet Explorer 6.0

10 réponses

  1. jerome143
    Voilà ce que ca donne apres l'operation de flash one

    01/09/2007 a 11:38:27,93

    *** Recherche des fichiers dans E:

    *** Recherche des fichiers dans E:\WINDOWS\

    *** Recherche des fichiers dans E:\WINDOWS\system32
    "E:\WINDOWS\Downloaded Program Files\CONFLICT.1" FOUND

    *** Recherche des fichiers dans E:\Program Files
    *** Fin du rapport !
    0
    1. Utilisateur anonyme
      lol, teigneux le petit (^_^)
      0
      1. flash-one
        pour lyonnais92:

        tu recommence comme dans ce post:

        spyware security troubleshooting et security#0

        a la fin tu te demandais comment sa se fais tu te pose encore la question d'ailleur
        attend la fin avant de donner des conclusions
        j'ai ma methode meme si tu la comprend pas
        au debut comme a la fin

        en attendant va polluer un autre poste!!
        0
        1. Lyonnais92 Contributeur sécurité
          Re

          la manip 4 ne réussira pas plus à enlever la ligne

          O23 - Service: Network helper Service (MSDisk) - Unknown owner - E:\WINDOWS\System32\irdvxc.exe" /service (file missing

          que la manip 1 !
          0
          2. flash-one
            faut laisser faire la manip 4 pour en etre sur

            pour moi c'est sa effectivement: Sdbot
            0
            1. Lyonnais92 Contributeur sécurité
              Bonjour,

              post 1

              pour commencer fixe ses lignes en mode sans echec:

              ......
              O23 - Service: Network helper Service (MSDisk) - Unknown owner - E:\WINDOWS\System32\irdvxc.exe" /service (file missing)

              post 4

              ok fixe celles ci maintenant:

              O23 - Service: Network helper Service (MSDisk) - Unknown owner - E:\WINDOWS\System32\irdvxc.exe" /service (file missing)

              même pas vu que la procédure a échoué
              __________________________________________________________________________________________________________

              jerome 143, si tu es encore par là :

              ========================================
              Arrête ce service

              Network helper Service (MSDisk)

              pour ça fais cette manip :

              Démarrer -> executer tape services.msc clic droit sur le service cité - > propriétés et dans "type de démarrage" et mets le sur « arrêté » et « désactivé ».

              =======================================

              Ensuite, cherche ce fichier par l'explorateur Windows :

              E:\WINDOWS\System32\irdvxc.exe

              si tu le trouve, clic droit et supprimer.

              Si il ne veut pas, on fera autrement.
              Remets un log Hijackthis.

              Une référence pour ma mémoire :
              https://www.trendmicro.com/vinfo/us/threat-encyclopedia/search/wormsdbotank

              @+
              0
              1. flash-one
                ok fixe celles ci maintenant:

                O23 - Service: Network helper Service (MSDisk) - Unknown owner - E:\WINDOWS\System32\irdvxc.exe" /service (file missing)

                O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jeromemilielric.spaces.live.com/PhotoUpload/MsnPUpld.cab

                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

                en mode normal

                ensuite:

                Télécharge Clean
                ----> http://www.malekal.com/download/clean.zip

                Dézippe tout le contenu dans le même dossier. Double clic sur clean ou clean.cmd choisissez l'option 1.
                Un rapport va s'ouvrir, copie et colle le contenu ici stp
                0
                1. jerome143
                  Voilà j'ai fixer les lignes avec hijackthis, qu'est ce que t'en penses ?

                  Logfile of HijackThis v1.99.1
                  Scan saved at 20:41:09, on 29/08/2007
                  Platform: Windows XP (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 (6.00.2600.0000)

                  Running processes:
                  E:\WINDOWS\System32\smss.exe
                  E:\WINDOWS\SYSTEM32\winlogon.exe
                  E:\WINDOWS\system32\services.exe
                  E:\WINDOWS\system32\lsass.exe
                  E:\WINDOWS\system32\svchost.exe
                  E:\WINDOWS\System32\svchost.exe
                  E:\WINDOWS\Explorer.EXE
                  E:\WINDOWS\system32\spoolsv.exe
                  E:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                  E:\Program Files\QuickTime\qttask.exe
                  E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
                  E:\WINDOWS\System32\rundll32.exe
                  E:\WINDOWS\Drivers\Microsoft\Service.exe
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  E:\WINDOWS\System32\ctfmon.exe
                  E:\Program Files\MSN Messenger\MsnMsgr.Exe
                  E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  E:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
                  E:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
                  c:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  E:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
                  c:\Program Files\Alwil Software\Avast4\ashServ.exe
                  E:\WINDOWS\System32\nvsvc32.exe
                  E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  c:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
                  E:\WINDOWS\System32\svchost.exe
                  E:\WINDOWS\System32\MsPMSPSv.exe
                  c:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  c:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  D:\utilitaires\cd utilitaires\internet\HijackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar4.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar4.dll
                  O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [PSPVideo9] D:\Program Files\pspvideo9\pspvideo9.exe -t
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                  O4 - HKLM\..\Run: [Service] E:\WINDOWS\Drivers\Microsoft\Servicerun.exe E:\WINDOWS\Drivers\Microsoft\Service.exe
                  O4 - HKLM\..\Run: [avast!] c:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
                  O4 - HKCU\..\Run: [msnmsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                  O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  O4 - Global Startup: KODAK Software Updater.lnk = E:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
                  O4 - Global Startup: Logiciel Kodak EasyShare.lnk = E:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
                  O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\INCRED~1\bin\resources\WebMenuImg.htm
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
                  O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
                  O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
                  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://jeromemilielric.spaces.live.com//PhotoUpload/MsnPUpld.cab
                  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
                  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
                  O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jeromemilielric.spaces.live.com/PhotoUpload/MsnPUpld.cab
                  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - c:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: Autodesk Licensing Service - Autodesk - E:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
                  O23 - Service: avast! Antivirus - Unknown owner - c:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - Unknown owner - c:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                  O23 - Service: avast! Web Scanner - Unknown owner - c:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                  O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - D:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
                  O23 - Service: Network helper Service (MSDisk) - Unknown owner - E:\WINDOWS\System32\irdvxc.exe" /service (file missing)
                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
                  O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe
                  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - c:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
                  0
                  1. flash-one
                    supprime la restauration systeme avant
                    0
                    1. flash-one
                      salut,
                      pour commencer fixe ses lignes en mode sans echec:

                      O4 - HKCU\..\Run: [WhenUSave] "E:\Program Files\Save\Save.exe"

                      O23 - Service: Microsoft Star Window Service - Unknown owner - E:\WINDOWS\System32\dllcache\svcshoter.exe (file missing)

                      O23 - Service: Network helper Service (MSDisk) - Unknown owner - E:\WINDOWS\System32\irdvxc.exe" /service (file missing)

                      ensuite repost un log en mode normal stp
                      0

                      Discussions similaires

                      '' generic android ''
                      Flxra._.Atxmics

                      2 réponses
                      Aide pour un virus
                      cerise92700

                      41 réponses
                      Disque dur non détecté.
                      Jamni

                      9 réponses
                      Virus Profile: Generic!atr.b
                      chantalou66

                      8 réponses
                      DD JMicron non reconnu
                      GeeketteJr

                      7 réponses