Analyse log hijack this.

Résolu
Utilisateur anonyme -  
Yo, voici le rapport: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:47:35, on 06/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Pvm\Piano virtuel midi.exe
C:\Documents and Settings\Thomas NOUHAUD\Bureau\Downloads\HiJackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - (no file)
O2 - BHO: (no name) - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - (no file)
O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Program Files\Helper\1204225682.dll
O2 - BHO: RDL Rolex - {D63D92ED-3213-4E4E-B1BB-F612BC8B0068} - C:\WINDOWS\dgtxrdfqgk.dll
O3 - Toolbar: ekvgsnw - {C8241E4D-67AB-4AFB-AA37-A65D5930E1EE} - C:\WINDOWS\ekvgsnw.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.116.66,85.255.112.159
O17 - HKLM\System\CCS\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: NameServer = 85.255.116.66,85.255.112.159
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: NameServer = 85.255.116.66,85.255.112.159
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.66 85.255.112.159
O17 - HKLM\System\CS2\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.116.66,85.255.112.159
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.66 85.255.112.159
O17 - HKLM\System\CS3\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.116.66,85.255.112.159
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.116.66 85.255.112.159
O17 - HKLM\System\CS4\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.116.66,85.255.112.159
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.66 85.255.112.159
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O21 - SSODL: alofkmn - {73A5EF5E-994B-4B95-A948-E04ACD687645} - C:\WINDOWS\alofkmn.dll
O21 - SSODL: bxlrvps - {0A370B97-336B-4883-ABDC-4E41DE71A43C} - C:\WINDOWS\bxlrvps.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe (file missing)
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 10039 bytes


Je suis en train d'apprendre comment lire un rapport Hijackthis!
Configuration: Windows XP
Firefox 2.0.0.12

30 réponses

Résumé de la discussion

Un rapport HijackThis issu d'un PC Windows XP est présenté, et l'objectif est d'apprendre à lire ce type de fichier et à identifier les éléments potentiellement malveillants. Plusieurs éléments clés ressortent, notamment des recommandations d'outils comme FixWareout et des instructions pour relancer HijackThis en mode système afin de cocher et corriger les entrées problématiques. D'autres contributions décrivent l'usage d OTMoveIt et SDFix pour déplacer ou supprimer les fichiers suspects et proposent des étapes de désinstallation ou de redémarrage pour stabiliser le système. Enfin, il est indiqué d'analyser les rapports générés, de poster les résultats et d'envisager des actions complémentaires comme la suppression de programmes indésirables et la correction des paramètres réseau.

Bobot (l’IA à votre service)
  1. Utilisateur anonyme
    bonsoir parfait tu as tuée l'infection wareout , comment se porte ton pc ?
    1. Utilisateur anonyme
      il se porte à merveille, merci. je crois que c'est fini. alors merci a toi ml king. je te souhaite bonheur, chance, amour et prosperité a toi et ta famille sur 10 generations. merci encore, bisous

      proutax
  3. Utilisateur anonyme
    ça doit etre le dernier 

    Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:31:31, on 09/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Utilitaires suppression de virus\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5356 bytes

    1. Utilisateur anonyme
      bonjour

      relance hoijackthis do a scan systeme only et coche la case devant ces lignes puis clic sur fix shequed

      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
      O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
      O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
      O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)

      ensuite desinstal bitdefender : http://www.bitdefender.fr/KB333-fr--Desinstaller-BitDefender.html et télécharge l'outils de désinstallation et suis les instructions.

      ensuite redemarre ton pc et poste un nouveau rapport hijackthis

      il y quelques années j'était webmaster , accident de voiture , problemes de memoires , maintenant je suis dans l'automobile et j'essaie de reapprendre certaines choses mais c'est pas evident !
      1. Utilisateur anonyme
        Wouah putin ! halucinant ! roh ben mon gars! gg a toi ! Bravo Bravo Bravo mec.
        C'est fou ton histoire, moi j'ai 16ans et je fous rien de ma vie...
    3. Utilisateur anonyme
      C'est bien ce que je pensais... plus de lignes O17 sur Hijackthis voici le rapport quand même: 

      Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:09:14, on 09/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Utilitaires suppression de virus\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe (file missing)
---
End of file - 7371 bytes
      1. Utilisateur anonyme
        Autre chose au sujet du rapport HJT

        Les O9 sont pas un peu suspects? c'est du msn alors que je l'ai désinstallé !!
        Et les O4 y'en a des bizares (nwiz, LVCOMSX)

        J'essaie de t'aider un peu même si j'y connais pas grand chose ^^ !
        Mais une question me turlulupine... T'es un informaticien ou alors tu fais ça comme ça et t'as appris?
    4. Utilisateur anonyme
      Haya y'a un souci ! SmitFraudFix ne veut pas s'executer en mode sans echec pour l'option N°5 (mode normal requis)
      J'ai donc fait en mode normal: 

      SmitFraudFix v2.300

Rapport fait à  0:04:11,59, 09/03/2008
Executé à partir de C:\Utilitaires suppression de virus\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !

Description: NVIDIA nForce MCP Networking Controller
DNS Server Search Order: 85.255.114.24
DNS Server Search Order: 85.255.112.235

Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !

Description: NVIDIA nForce MCP Networking Controller
DNS Server Search Order: 85.255.114.24
DNS Server Search Order: 85.255.112.235

HKLM\SYSTEM\CCS\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CCS\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CCS\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CCS\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CCS\Services\Tcpip\..\{D0D563E0-1519-42E0-B5D5-FA1924C6D58B}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS2\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS2\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS2\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D0D563E0-1519-42E0-B5D5-FA1924C6D58B}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS3\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS3\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS3\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS3\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: NameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CS3\Services\Tcpip\..\{D0D563E0-1519-42E0-B5D5-FA1924C6D58B}: DhcpNameServer=85.255.114.24,85.255.112.235
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.114.24 85.255.112.235
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.114.24 85.255.112.235
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.114.24 85.255.112.235

»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix


      1. Utilisateur anonyme
        dans l'ordre smitfraudfix en mode sans echecs , suppression des lignes 017 avec hijackthis en mode normal ensuite tu redemarre ton pc est tu relance hijackthis do a scanand save log , et tu me poste le rapport smitfraudfixx et le nouveau rapport hijacthis bonne nuit
        1. Utilisateur anonyme
          ok je vais me reposer une fois la manip faite redemarre ton pc et poste un nouveau rapport hijackthis .
          bonne nuit ;-)
          1. Utilisateur anonyme
            bon ca commence a etre mieu mais il en reste encore , ce qui me derange le plus , c'est ceci , une redirection vers l'ukraine me semble t il

            O17 - HKLM\System\CCS\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
            O17 - HKLM\System\CCS\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: NameServer = 85.255.114.24,85.255.112.235
            O17 - HKLM\System\CCS\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: NameServer = 85.255.114.24,85.255.112.235
            O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
            O17 - HKLM\System\CS2\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
            O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
            O17 - HKLM\System\CS3\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235

            redemarre en mode sans echec relance smitfraudfix selectionne cette fois ci l'option 5 copie le rapport , relance hijackthis do a scan systeme only et coche la case devant les lignes 017 puis clic sur fix chequed

            ensuiete redemarre ton pc , puis moi un nouveau rapport hijackthis ainsi que le rapport de smitfraudfix option 5
            1. Utilisateur anonyme
              J'y court !
          2. Utilisateur anonyme
            Et un HiJack en plus:
            
<code>Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:51:50, on 08/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Utilitaires suppression de virus\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CCS\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
O17 - HKLM\System\CS2\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
O17 - HKLM\System\CS3\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe (file missing)

--
End of file - 8168 bytes
            1. Utilisateur anonyme
              ton infection s'accroche poste moi un rapport de combofix

              Télécharges ComboFix à partir d'un de ces liens :

              http://download.bleepingcomputer.com/sUBs/ComboFix.exe
              https://forospyware.com
              http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

              Et important, enregistre le sur le bureau.

              Avant d'utiliser ComboFix :

              ► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

              ► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

              Une fois fait, sur ton bureau double-clic sur Combofix.exe.

              - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

              /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

              - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

              - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

              ► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

              ► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
              1. Utilisateur anonyme
                Rapport ComboFix: 
                ComboFix 08-03-07.4 - Thomas NOUHAUD 2008-03-08 22:39:56.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.1.1036.18.666 [GMT 1:00]
Endroit: C:\Documents and Settings\Thomas NOUHAUD\Bureau\ComboFix.exe
 * Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Thomas NOUHAUD\Application Data\macromedia\Flash Player\#SharedObjects\2P3HS6V5\iforex.com
C:\Documents and Settings\Thomas NOUHAUD\Application Data\macromedia\Flash Player\#SharedObjects\2P3HS6V5\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Thomas NOUHAUD\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Thomas NOUHAUD\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Program Files\outlook
C:\WINDOWS\hidrwupd.dll
C:\WINDOWS\pack.epk
C:\WINDOWS\rasqervy.dll
C:\WINDOWS\sdfinacs.dll
C:\WINDOWS\sdfixwcs.dll
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\system32\_000002_.tmp.dll
C:\WINDOWS\system32\_000003_.tmp.dll
C:\WINDOWS\system32\_000004_.tmp.dll
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000901_.tmp.dll
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\wuasirvy.dll

.
(((((((((((((((((((((((((((((   Fichiers créés 2008-02-08 to 2008-03-08  ))))))))))))))))))))))))))))))))))))
.

2008-03-08 00:18 . 2008-03-08 00:18	<REP>	d--------	C:\Program Files\Windows Live
2008-03-08 00:18 . 2008-03-08 00:18	<REP>	d--hsc---	C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-03-08 00:18 . 2008-03-08 00:18	<REP>	d--------	C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-08 00:07 . 2008-03-08 00:13	<REP>	d--------	C:\Utilitaires suppression de virus
2008-03-07 23:16 . 2008-03-07 23:16	<REP>	d--------	C:\WINDOWS\ERUNT
2008-03-04 19:58 . 2008-03-04 20:00	<REP>	d--------	C:\WINDOWS\privacy_danger(3)
2008-03-04 00:28 . 2008-03-04 00:28	9,296	--a------	C:\WINDOWS\system32\oigkyg.exe
2008-03-04 00:25 . 2008-03-07 19:33	<REP>	d--------	C:\WINDOWS\privacy_danger(2)
2008-03-02 22:26 . 2008-03-02 22:26	9,296	--a------	C:\WINDOWS\system32\cpxehj.exe
2008-02-28 23:46 . 2008-02-28 23:46	7,168	--a------	C:\WINDOWS\system32\nrtinp.exe
2008-02-28 20:12 . 2008-02-28 20:12	50	--a------	C:\tmp.bat
2008-02-27 19:20 . 2008-02-27 19:20	<REP>	d--------	C:\Documents and Settings\Thomas NOUHAUD\Application Data\dvdcss
2008-02-27 16:30 . 2008-02-27 16:30	0	--a------	C:\WINDOWS\mngui.INI
2008-02-18 23:12 . 2008-02-28 13:33	28,665	--a------	C:\WINDOWS\system32\gpedit.msc
2008-02-18 22:33 . 2002-08-22 09:52	1,585,714	--a------	C:\WINDOWS\system32\system.adm
2008-02-18 22:33 . 2002-07-16 17:52	285,558	--a------	C:\WINDOWS\system32\inetres.adm
2008-02-18 22:33 . 2001-08-28 13:00	43,054	--a------	C:\WINDOWS\system32\conf.adm
2008-02-18 22:27 . 2008-02-18 22:27	<REP>	d--h-----	C:\WINDOWS\system32\GroupPolicy
2008-02-18 22:27 . 2001-08-28 13:00	499,200	--a------	C:\WINDOWS\system32\gpedit.dll
2008-02-18 22:27 . 2002-08-29 10:44	284,160	--a------	C:\WINDOWS\system32\appmgr.dll
2008-02-18 22:27 . 2002-08-29 10:44	185,856	--a------	C:\WINDOWS\system32\gptext.dll
2008-02-18 22:27 . 2002-08-29 10:44	165,376	--a------	C:\WINDOWS\system32\appmgmts.dll
2008-02-18 22:27 . 2001-08-28 13:00	119,296	--a------	C:\WINDOWS\system32\fde.dll
2008-02-18 22:27 . 2002-08-29 10:44	70,144	--a------	C:\WINDOWS\system32\fdeploy.dll
2008-02-18 22:27 . 2001-08-28 13:00	34,352	--a------	C:\WINDOWS\system32\gpedit.old.msc
2008-02-18 19:19 . 2008-02-18 19:19	<REP>	d--hs----	C:\FOUND.007

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-08 21:39	---------	d-----w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\OpenOffice.org2
2008-03-07 19:33	4,290	----a-w	C:\WINDOWS\system32\tmp.reg
2008-03-07 18:33	---------	d-----w	C:\Program Files\Spybot - Search & Destroy
2008-03-07 18:33	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-06 22:24	---------	d-----w	C:\Program Files\Samsung
2008-03-06 21:51	---------	d-----w	C:\Program Files\Pvm
2008-03-05 21:29	82,432	----a-w	C:\WINDOWS\system32\IEDFix.exe
2008-03-01 22:12	86,016	----a-w	C:\WINDOWS\system32\VACFix.exe
2008-02-28 19:12	---------	d-----w	C:\Program Files\MSN Messenger
2008-01-09 19:57	---------	d-----w	C:\Program Files\Sony Ericsson
2008-01-09 19:57	---------	d-----w	C:\Program Files\Fichiers communs\Teleca Shared
2008-01-09 19:57	---------	d-----w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\Teleca
2008-01-09 19:57	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Teleca
2008-01-09 19:57	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-01-09 19:54	6,176	----a-w	C:\WINDOWS\system32\drivers\w810cm.sys
2008-01-09 19:54	5,808	----a-w	C:\WINDOWS\system32\drivers\w810wh.sys
2007-12-18 09:51	179,584	----a-w	C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-11 21:37	506,560	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\GDIPFONTCACHEV1.DAT
2007-01-13 15:30	379	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb1942.dat
2006-11-05 18:07	173,056	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb4418.dat
2006-11-05 18:03	151	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb5549.dat
2006-11-05 18:03	13,046	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb7555.dat
2006-11-05 18:03	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb1295.dat
2006-11-05 18:02	379	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb41.dat
2006-11-05 16:42	6,144	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb1060.dat
2006-11-05 15:03	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb6149.dat
2006-11-05 15:03	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb4178.dat
2006-11-05 15:03	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb365.dat
2006-11-05 15:03	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb1044.dat
2006-10-30 16:57	13,046	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb4976.dat
2006-10-30 16:57	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb3119.dat
2006-10-30 16:05	177,152	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb2956.dat
2006-10-22 11:45	6,144	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb2995.dat
2006-10-22 11:02	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb7853.dat
2006-10-22 11:02	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb7384.dat
2006-10-22 11:02	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb6905.dat
2006-10-22 11:02	0	----a-w	C:\Documents and Settings\Thomas NOUHAUD\Application Data\internaldb1659.dat
2005-11-29 08:52	278,528	----a-w	C:\Program Files\Fichiers communs\FDEUnInstaller.exe
.

(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2006-09-15 13:27 2048000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 15:40 155648]
"vspdfprsrv.exe"="C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe" [2003-06-17 14:24 4569600]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2000-07-12 14:14 311350]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 15:32 225280]
"LogitechVideo[inspector]"="C:\Program Files\Logitech\Video\InstallHelper.exe" [2006-01-05 08:15 73728]
"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 17:22 262144]
"LogitechCameraAssistant"="C:\Program Files\Logitech\Video\CameraAssistant.exe" [2006-01-05 07:58 489472]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 22:32 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2002-08-30 12:00 44032]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]

C:\Documents and Settings\Thomas NOUHAUD\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.2.lnk - C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe [2007-02-02 16:54:56 393216]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitLord\\BitLord.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\WINDOWS\\System32\\dpnsvr.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\World of Warcraft\\Launcher.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-2.3.0-frFR-downloader.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\Explorer.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard downloader
"6112:TCP"= 6112:TCP:Blizzard downloader

R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2002-08-06 03:48]
R2 FILESpy;FILESpy;C:\Program Files\Softwin\BitDefender Professional Edition\filespy.sys [2003-04-24 12:37]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-19 16:10]
R3 es1969;Pilote audio ESS Solo (WDM);C:\WINDOWS\system32\drivers\es1969.sys [2001-08-17 20:19]
R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37]
S3 adxapie;adxapie;C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\adxapie.sys []
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" []
S3 ess;Pilote audio ESS (WDM);C:\WINDOWS\system32\drivers\ess.sys [2001-08-17 20:19]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-22 18:11:42 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 22:42:34
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès 
Les fichiers cachés: 0 

**************************************************************************
.
Temps d'accomplissement: 2008-03-08 22:46:04
ComboFix-quarantined-files.txt  2008-03-08 21:46:02
.
2008-02-18 20:41:11	--- E O F ---

            2. Utilisateur anonyme
              J'ai plus MSN je l'ai désinstallé. Sinon le Log m'a l'air correct: 

              Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:48:52, on 08/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\System32\svchost.exe
C:\Utilitaires suppression de virus\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - (no file)
O2 - BHO: (no name) - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - (no file)
O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CCS\Services\Tcpip\..\{46B21596-F978-4487-8D6D-4ABF84C2F6CA}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0E6DB2B-8DDF-443A-990B-E470C6DE7DB7}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
O17 - HKLM\System\CS2\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
O17 - HKLM\System\CS3\Services\Tcpip\..\{227E81A5-96D6-47F7-BFEB-E8BB9F2FC4FB}: NameServer = 85.255.114.24,85.255.112.235
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.24 85.255.112.235
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe (file missing)

--
End of file - 8342 bytes
              1. Utilisateur anonyme
                bonjour ca as bien avancé . poste un nouveau rapport hijackthis . ou en sont tes problemes avec msn ?
                2. Utilisateur anonyme
                  Comme tu m'as dis la nature du virus présent (MSN) j'ai fait un petit MSNFix après avoir vu des fichiers suspects (qklxwxtc.exe et famwssg.exe ) donc voilà le rapport, si jamais j'ai fait une connerie dis le moi j'ai le backup !! ^^ merci d'avance M.L King 

                  MSNFix 1.674  
 
C:\Documents and Settings\Thomas NOUHAUD\Bureau\Downloads\MSNFix\MSNFix 
Fix exécuté le 07/03/2008 - 23:58:38,26 By Thomas NOUHAUD 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\famwssg.exe 
... C:\WINDOWS\system32\tmp.txt 
... C:\Autorun.inf 
... C:\autorun.inf 
... C:\Documents and Settings\Thomas NOUHAUD\??????.exe 
... C:\Documents and Settings\Thomas NOUHAUD\????????.exe 
... C:\qklxwxtc.exe 
... C:\qklxwxtc.exe 
... C:\famwssg.exe 
... C:\famwssg.exe 
... C:\qklxwxtc.exe 
... C:\qklxwxtc.exe 
 
************************ Recherche les dossiers présents       
 
... C:\Temp\ 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\famwssg.exe  
.. OK ... C:\WINDOWS\system32\tmp.txt  
.. OK ... C:\Autorun.inf  
.. OK ... C:\autorun.inf  
.. OK ... C:\Documents and Settings\Thomas NOUHAUD\??????.exe  
.. OK ... C:\Documents and Settings\Thomas NOUHAUD\????????.exe  
.. OK ... C:\qklxwxtc.exe  
.. OK ... C:\qklxwxtc.exe  
.. OK ... C:\famwssg.exe  
.. OK ... C:\famwssg.exe  
.. OK ... C:\qklxwxtc.exe  
.. OK ... C:\qklxwxtc.exe  
 
 
************************ Suppression des dossiers       
 
/!\ ...  C:\Temp\   
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
Aucun Fichier trouvé 
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 08032008_ 0021748.zip
 


------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------
                  1. Utilisateur anonyme
                    Re! 

                    [b]SDFix: Version 1.153 [/b]

Run by Thomas NOUHAUD on 07/03/2008 at 23:19

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Name:
userinfo32

Path:
\??\C:\WINDOWS\system\userinfo32.ggt 

userinfo32 - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default HomePage Value
Restoring Default Desktop Components Value

Rebooting

Service Uux55 - Deleted after Reboot

[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\drivers\Uux55.sys - Deleted
C:\WINDOWS\SYSTEM32\RNAPH.DLL - Deleted
C:\875862~1 - Deleted
C:\WINDOWS\SYSTEM32\WTAQSGQA.TMP - Deleted
C:\Program Files\outlook\p.zip  - Deleted
C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\ac8zt2.dat  - Deleted
C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe  - Deleted
C:\WINDOWS\rs.txt  - Deleted
C:\WINDOWS\system32\real.txt  - Deleted
C:\WINDOWS\system\userinfo32.ggt  - Deleted


Could Not Remove C:\autorun.inf 



Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-07 23:41:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:76,6d,43,01,7a,e8,cd,38,87,5c,00,a3,a7,4e,1a,64,f5,bf,bb,b6,c0,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:b0,f2,97,5b,66,26,71,bf,74,6d,2a,2a,be,32,a1,de,58,55,e9,20,b6,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,eb,11,a4,a8,40,54,99,92,a7,58,e0,cf,ed,12,51,20,3d,..
"khjeh"=hex:b7,80,96,af,dd,fe,0b,30,82,7e,0c,49,64,ce,a9,b8,b7,5c,2c,5f,62,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6f,18,78,67,a7,2d,a4,ac,b7,98,7e,02,07,0a,45,b4,f4,a1,9e,aa,37,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:76,6d,43,01,7a,e8,cd,38,87,5c,00,a3,a7,4e,1a,64,f5,bf,bb,b6,c0,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:e5,69,b3,c1,b5,68,26,0e,16,bf,db,27,19,19,9e,0a,72,b8,40,8a,2c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,eb,11,a4,a8,40,54,99,92,a7,58,e0,cf,ed,12,51,20,3d,..
"khjeh"=hex:b7,80,96,af,dd,fe,0b,30,82,7e,0c,49,64,ce,a9,b8,b7,5c,2c,5f,62,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:31,0f,93,d0,f6,a8,e6,20,7c,ec,39,fa,9b,c2,8d,58,57,7f,6c,3e,21,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
"CategoryMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:f3fa4c93
"s2"=dword:ebb026a8
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:76,6d,43,01,7a,e8,cd,38,87,5c,00,a3,a7,4e,1a,64,f5,bf,bb,b6,c0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:e5,69,b3,c1,b5,68,26,0e,16,bf,db,27,19,19,9e,0a,72,b8,40,8a,2c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,eb,11,a4,a8,40,54,99,92,a7,58,e0,cf,ed,12,51,20,3d,..
"khjeh"=hex:b7,80,96,af,dd,fe,0b,30,82,7e,0c,49,64,ce,a9,b8,b7,5c,2c,5f,62,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:31,0f,93,d0,f6,a8,e6,20,7c,ec,39,fa,9b,c2,8d,58,57,7f,6c,3e,21,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\BitLord\\BitLord.exe"="C:\\Program Files\\BitLord\\BitLord.exe:*:Enabled:BitLord"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"="C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe:*:Disabled:jk2mp"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"
"E:\\tftpd32.exe"="E:\\tftpd32.exe:*:Disabled:tftpd32"
"C:\\WINDOWS\\System32\\dpnsvr.exe"="C:\\WINDOWS\\System32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\\Program Files\\Vietcong\\vcded.exe"="C:\\Program Files\\Vietcong\\vcded.exe:*:Enabled:vcded"
"C:\\Documents and Settings\\Thomas NOUHAUD\\Bureau\\Downloads\\wowclient-downloader.exe"="C:\\Documents and Settings\\Thomas NOUHAUD\\Bureau\\Downloads\\wowclient-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\World of Warcraft\\Launcher.exe"="C:\\Program Files\\World of Warcraft\\Launcher.exe:*:Enabled:World of Warcraft"
"C:\\Program Files\\World of Warcraft\\WoW-2.3.0-frFR-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.3.0-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\DOCUME~1\\THOMAS~1\\LOCALS~1\\Temp\\services.exe"="C:\\DOCUME~1\\THOMAS~1\\LOCALS~1\\Temp\\services.exe:*:Enabled:Flash Media"
"C:\\WINDOWS\\Explorer.EXE"="C:\\WINDOWS\\Explorer.EXE:*:Enabled:enable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:

C:\autorun.inf  Found

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 19 Aug 2004        60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Fri 26 Sep 2003         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 26 Sep 2003           401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv18.bak"
Thu 14 Dec 2006             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]
                    2. Utilisateur anonyme 
                      File move failed. C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe scheduled to be moved on reboot.
C:\WINDOWS\ekvgsnw.dll unregistered successfully.
C:\WINDOWS\ekvgsnw.dll moved successfully.
File/Folder C:\WINDOWS\dgtxrdfqgk.dll not found.
DllUnregisterServer procedure not found in C:\WINDOWS\alofkmn.dll
C:\WINDOWS\alofkmn.dll NOT unregistered.
C:\WINDOWS\alofkmn.dll moved successfully.
File/Folder C:\WINDOWS\bxlrvps.dll not found.
Item C:\WINDOWS\system32\userinit.exe is whitelisted and cannot be moved.
File move failed. C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe scheduled to be moved on reboot.
 
OTMoveIt2 v1.0.20 log created on 03072008_230819
                      1. Utilisateur anonyme
                        télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
                        double-clique sur OTMoveIt.exe pour le lancer.
                        copie la liste qui se trouve en citation ci-dessous,
                        et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

                        Citation :

                        C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe
                        C:\WINDOWS\ekvgsnw.dll
                        C:\WINDOWS\dgtxrdfqgk.dll
                        C:\WINDOWS\alofkmn.dll
                        C:\WINDOWS\bxlrvps.dll
                        C:\WINDOWS\system32\userinit.exe
                        C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe

                        clique sur MoveIt! pour lancer la suppression.
                        le résultat apparaitra dans le cadre "Results".
                        clique sur Exit pour fermer.
                        poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
                        copie et colle le rapport ici
                        il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

                        ensuite

                        Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
                        http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
                        Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
                        • Redémarre ton ordinateur
                        • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
                        • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
                        • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
                        • Choisis ton compte.
                        Déroule la liste des instructions ci-dessous :
                        • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
                        • Appuie sur Y pour commencer le processus de nettoyage.
                        • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
                        • Appuie sur une touche pour redémarrer le PC.
                        • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
                        • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
                        • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
                        • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
                        • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
                        1. Utilisateur anonyme
                          héhé, une belle ribambelle ! 

                          Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:55:08, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Thomas NOUHAUD\Bureau\Downloads\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - (no file)
O2 - BHO: (no name) - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - (no file)
O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: RDL Rolex - {D63D92ED-3213-4E4E-B1BB-F612BC8B0068} - C:\WINDOWS\dgtxrdfqgk.dll (file missing)
O3 - Toolbar: ekvgsnw - {C8241E4D-67AB-4AFB-AA37-A65D5930E1EE} - C:\WINDOWS\ekvgsnw.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\THOMAS~1\LOCALS~1\Temp\services.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O21 - SSODL: alofkmn - {73A5EF5E-994B-4B95-A948-E04ACD687645} - C:\WINDOWS\alofkmn.dll
O21 - SSODL: bxlrvps - {0A370B97-336B-4883-ABDC-4E41DE71A43C} - C:\WINDOWS\bxlrvps.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender Professional Edition\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe (file missing)

--
End of file - 7952 bytes
                          • 1
                          • 2

                          Discussions similaires

                          Nouveau tag ajouté | Nouvelle option activé sans permission?
                          BountyFullChest

                          1 réponse
                          Huawei P8 Lite "nouveau tag ajouté"
                          ArianeKathleen

                          25 réponses
                          Nouveau tag ajouté - Utilité
                          Eerfers

                          1 réponse
                          Google Chrome "  Échec de l'analyse antivirus "
                          jmpower

                          18 réponses
                          " Échec de l'analyse antivirus " la solution.
                          bazfile

                          0 réponse