Infecter par trojan vundo
Résolu
Bonjour,je suis infecter par le trojan vundo que je n arrive pas a irradiquer ci joint un rapport hitjackthis
gfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:00:15, on 03/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\MR MOUTON\Bureau\scanner.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0594ED88-A88C-482C-A5EF-F1CBA993B202} - C:\WINDOWS\system32\xxyyvTJd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A596175D-BBC7-476A-A152-FBA652B64505} - C:\WINDOWS\system32\geBtTJDt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - https://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_2_0.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D5D30A68-E230-49D9-B4D5-BF7532692945} - https://order.cdiscount.com/Account/LoginLight.html?referrer=https://clients.cdiscount.com%2Ferror%2F404.aspx%3F404%3Bhttp%3A%2F%2Fclients.cdiscount.com%3A100%2Forder%2Ftechcity%2Factivex%2Fcdiscount.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5130/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E5C9EB0E-0BCB-44D1-94F5-A29554673749}: NameServer = 192.168.1.1,80.10.246.129
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: brpvoa.dll
O20 - Winlogon Notify: geBtTJDt - C:\WINDOWS\SYSTEM32\geBtTJDt.dll
O21 - SSODL: Version3 - {2E523F81-92B0-496A-AE6D-126F2A4B518B} - (no file)
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
--
End of file - 12686 bytes
est aussi un rapport virtumondebegon
[08/03/2008, 14:34:46] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\MR MOUTON\Bureau\VirtumundoBeGone.exe" )
[08/03/2008, 14:34:58] - Detected System Information:
[08/03/2008, 14:34:58] - Windows Version: 5.1.2600, Service Pack 2
[08/03/2008, 14:34:58] - Current Username: MR MOUTON (Admin)
[08/03/2008, 14:34:58] - Windows is in NORMAL mode.
[08/03/2008, 14:34:58] - Searching for Browser Helper Objects:
[08/03/2008, 14:34:58] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:34:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:34:58] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:34:58] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:34:58] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:34:58] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:34:58] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} ()
[08/03/2008, 14:34:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:34:58] - Checking for HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:34:58] - Found: HKLM\...\Winlogon\Notify\geBtTJDt - This is probably Virtumundo.
[08/03/2008, 14:34:58] - Assigning {A596175D-BBC7-476A-A152-FBA652B64505} MSEvents Object
[08/03/2008, 14:34:58] - BHO list has been changed! Starting over...
[08/03/2008, 14:34:58] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:34:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:34:58] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:34:58] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:34:58] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:34:58] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:34:58] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} (MSEvents Object)
[08/03/2008, 14:34:58] - ALERT: Found MSEvents Object!
[08/03/2008, 14:34:58] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/03/2008, 14:34:58] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/03/2008, 14:34:58] - Finished Searching Browser Helper Objects
[08/03/2008, 14:34:58] - *** Detected MSEvents Object
[08/03/2008, 14:34:58] - Trying to remove MSEvents Object...
[08/03/2008, 14:34:59] - Terminating Process: IEXPLORE.EXE
[08/03/2008, 14:34:59] - Terminating Process: RUNDLL32.EXE
[08/03/2008, 14:34:59] - Disabling Automatic Shell Restart
[08/03/2008, 14:34:59] - Terminating Process: EXPLORER.EXE
[08/03/2008, 14:34:59] - Suspending the NT Session Manager System Service
[08/03/2008, 14:34:59] - Terminating Windows NT Logon/Logoff Manager
[08/03/2008, 14:34:59] - Re-enabling Automatic Shell Restart
[08/03/2008, 14:34:59] - File to disable: C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:34:59] - Renaming C:\WINDOWS\system32\geBtTJDt.dll -> C:\WINDOWS\system32\geBtTJDt.dll.vir
[08/03/2008, 14:34:59] - ! File rename was unsucessful.
[08/03/2008, 14:34:59] - Attempting to Deny Access to C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:35:00] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[08/03/2008, 14:35:00] - ERROR: Le mappage entre les noms de compte et les ID de sécurité n'a pas été effectué.
[08/03/2008, 14:35:00] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[08/03/2008, 14:35:00] - Removing HKLM\...\Browser Helper Objects\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:00] - Removing HKCR\CLSID\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:00] - Adding Kill Bit for ActiveX for GUID: {A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:00] - Deleting ATLEvents/MSEvents Registry entries
[08/03/2008, 14:35:00] - Removing HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:00] - Searching for Browser Helper Objects:
[08/03/2008, 14:35:00] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:35:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:00] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:35:00] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:35:00] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:35:00] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:35:00] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} ()
[08/03/2008, 14:35:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:00] - Checking for HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:00] - Found: HKLM\...\Winlogon\Notify\geBtTJDt - This is probably Virtumundo.
[08/03/2008, 14:35:00] - Assigning {A596175D-BBC7-476A-A152-FBA652B64505} MSEvents Object
[08/03/2008, 14:35:00] - BHO list has been changed! Starting over...
[08/03/2008, 14:35:00] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:35:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:00] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:35:00] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:35:00] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:35:00] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:35:00] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} (MSEvents Object)
[08/03/2008, 14:35:00] - ALERT: Found MSEvents Object!
[08/03/2008, 14:35:00] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/03/2008, 14:35:00] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/03/2008, 14:35:00] - Finished Searching Browser Helper Objects
[08/03/2008, 14:35:00] - *** Detected MSEvents Object
[08/03/2008, 14:35:00] - Trying to remove MSEvents Object...
[08/03/2008, 14:35:01] - Terminating Process: IEXPLORE.EXE
[08/03/2008, 14:35:01] - Terminating Process: RUNDLL32.EXE
[08/03/2008, 14:35:01] - Disabling Automatic Shell Restart
[08/03/2008, 14:35:01] - Terminating Process: EXPLORER.EXE
[08/03/2008, 14:35:01] - Suspending the NT Session Manager System Service
[08/03/2008, 14:35:01] - Terminating Windows NT Logon/Logoff Manager
[08/03/2008, 14:35:01] - Re-enabling Automatic Shell Restart
[08/03/2008, 14:35:01] - File to disable: C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:35:01] - Renaming C:\WINDOWS\system32\geBtTJDt.dll -> C:\WINDOWS\system32\geBtTJDt.dll.vir
[08/03/2008, 14:35:01] - ! File rename was unsucessful.
[08/03/2008, 14:35:01] - Attempting to Deny Access to C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:35:02] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[08/03/2008, 14:35:02] - ERROR: Le mappage entre les noms de compte et les ID de sécurité n'a pas été effectué.
[08/03/2008, 14:35:02] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[08/03/2008, 14:35:02] - Removing HKLM\...\Browser Helper Objects\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:02] - Removing HKCR\CLSID\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:02] - Adding Kill Bit for ActiveX for GUID: {A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:02] - Deleting ATLEvents/MSEvents Registry entries
[08/03/2008, 14:35:02] - Removing HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:02] - Searching for Browser Helper Objects:
[08/03/2008, 14:35:02] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:35:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:02] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:35:02] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:35:02] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:35:02] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:35:02] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} ()
[08/03/2008, 14:35:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:02] - Checking for HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:02] - Key not found: HKLM\...\Winlogon\Notify\geBtTJDt, continuing.
[08/03/2008, 14:35:02] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/03/2008, 14:35:02] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/03/2008, 14:35:02] - Finished Searching Browser Helper Objects
[08/03/2008, 14:35:02] - Finishing up...
[08/03/2008, 14:35:02] - A restart is needed.
[08/03/2008, 14:35:02] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[08/03/2008, 14:35:15] - Attempting to Restart via STOP error (Blue Screen
gfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:00:15, on 03/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\MR MOUTON\Bureau\scanner.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0594ED88-A88C-482C-A5EF-F1CBA993B202} - C:\WINDOWS\system32\xxyyvTJd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A596175D-BBC7-476A-A152-FBA652B64505} - C:\WINDOWS\system32\geBtTJDt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - https://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_2_0.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D5D30A68-E230-49D9-B4D5-BF7532692945} - https://order.cdiscount.com/Account/LoginLight.html?referrer=https://clients.cdiscount.com%2Ferror%2F404.aspx%3F404%3Bhttp%3A%2F%2Fclients.cdiscount.com%3A100%2Forder%2Ftechcity%2Factivex%2Fcdiscount.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5130/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E5C9EB0E-0BCB-44D1-94F5-A29554673749}: NameServer = 192.168.1.1,80.10.246.129
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: brpvoa.dll
O20 - Winlogon Notify: geBtTJDt - C:\WINDOWS\SYSTEM32\geBtTJDt.dll
O21 - SSODL: Version3 - {2E523F81-92B0-496A-AE6D-126F2A4B518B} - (no file)
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
--
End of file - 12686 bytes
est aussi un rapport virtumondebegon
[08/03/2008, 14:34:46] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\MR MOUTON\Bureau\VirtumundoBeGone.exe" )
[08/03/2008, 14:34:58] - Detected System Information:
[08/03/2008, 14:34:58] - Windows Version: 5.1.2600, Service Pack 2
[08/03/2008, 14:34:58] - Current Username: MR MOUTON (Admin)
[08/03/2008, 14:34:58] - Windows is in NORMAL mode.
[08/03/2008, 14:34:58] - Searching for Browser Helper Objects:
[08/03/2008, 14:34:58] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:34:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:34:58] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:34:58] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:34:58] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:34:58] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:34:58] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} ()
[08/03/2008, 14:34:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:34:58] - Checking for HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:34:58] - Found: HKLM\...\Winlogon\Notify\geBtTJDt - This is probably Virtumundo.
[08/03/2008, 14:34:58] - Assigning {A596175D-BBC7-476A-A152-FBA652B64505} MSEvents Object
[08/03/2008, 14:34:58] - BHO list has been changed! Starting over...
[08/03/2008, 14:34:58] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:34:58] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:34:58] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:34:58] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:34:58] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:34:58] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:34:58] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} (MSEvents Object)
[08/03/2008, 14:34:58] - ALERT: Found MSEvents Object!
[08/03/2008, 14:34:58] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/03/2008, 14:34:58] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/03/2008, 14:34:58] - Finished Searching Browser Helper Objects
[08/03/2008, 14:34:58] - *** Detected MSEvents Object
[08/03/2008, 14:34:58] - Trying to remove MSEvents Object...
[08/03/2008, 14:34:59] - Terminating Process: IEXPLORE.EXE
[08/03/2008, 14:34:59] - Terminating Process: RUNDLL32.EXE
[08/03/2008, 14:34:59] - Disabling Automatic Shell Restart
[08/03/2008, 14:34:59] - Terminating Process: EXPLORER.EXE
[08/03/2008, 14:34:59] - Suspending the NT Session Manager System Service
[08/03/2008, 14:34:59] - Terminating Windows NT Logon/Logoff Manager
[08/03/2008, 14:34:59] - Re-enabling Automatic Shell Restart
[08/03/2008, 14:34:59] - File to disable: C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:34:59] - Renaming C:\WINDOWS\system32\geBtTJDt.dll -> C:\WINDOWS\system32\geBtTJDt.dll.vir
[08/03/2008, 14:34:59] - ! File rename was unsucessful.
[08/03/2008, 14:34:59] - Attempting to Deny Access to C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:35:00] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[08/03/2008, 14:35:00] - ERROR: Le mappage entre les noms de compte et les ID de sécurité n'a pas été effectué.
[08/03/2008, 14:35:00] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[08/03/2008, 14:35:00] - Removing HKLM\...\Browser Helper Objects\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:00] - Removing HKCR\CLSID\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:00] - Adding Kill Bit for ActiveX for GUID: {A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:00] - Deleting ATLEvents/MSEvents Registry entries
[08/03/2008, 14:35:00] - Removing HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:00] - Searching for Browser Helper Objects:
[08/03/2008, 14:35:00] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:35:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:00] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:35:00] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:35:00] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:35:00] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:35:00] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} ()
[08/03/2008, 14:35:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:00] - Checking for HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:00] - Found: HKLM\...\Winlogon\Notify\geBtTJDt - This is probably Virtumundo.
[08/03/2008, 14:35:00] - Assigning {A596175D-BBC7-476A-A152-FBA652B64505} MSEvents Object
[08/03/2008, 14:35:00] - BHO list has been changed! Starting over...
[08/03/2008, 14:35:00] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:35:00] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:00] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:35:00] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:35:00] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:35:00] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:35:00] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} (MSEvents Object)
[08/03/2008, 14:35:00] - ALERT: Found MSEvents Object!
[08/03/2008, 14:35:00] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/03/2008, 14:35:00] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/03/2008, 14:35:00] - Finished Searching Browser Helper Objects
[08/03/2008, 14:35:00] - *** Detected MSEvents Object
[08/03/2008, 14:35:00] - Trying to remove MSEvents Object...
[08/03/2008, 14:35:01] - Terminating Process: IEXPLORE.EXE
[08/03/2008, 14:35:01] - Terminating Process: RUNDLL32.EXE
[08/03/2008, 14:35:01] - Disabling Automatic Shell Restart
[08/03/2008, 14:35:01] - Terminating Process: EXPLORER.EXE
[08/03/2008, 14:35:01] - Suspending the NT Session Manager System Service
[08/03/2008, 14:35:01] - Terminating Windows NT Logon/Logoff Manager
[08/03/2008, 14:35:01] - Re-enabling Automatic Shell Restart
[08/03/2008, 14:35:01] - File to disable: C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:35:01] - Renaming C:\WINDOWS\system32\geBtTJDt.dll -> C:\WINDOWS\system32\geBtTJDt.dll.vir
[08/03/2008, 14:35:01] - ! File rename was unsucessful.
[08/03/2008, 14:35:01] - Attempting to Deny Access to C:\WINDOWS\system32\geBtTJDt.dll
[08/03/2008, 14:35:02] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[08/03/2008, 14:35:02] - ERROR: Le mappage entre les noms de compte et les ID de sécurité n'a pas été effectué.
[08/03/2008, 14:35:02] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[08/03/2008, 14:35:02] - Removing HKLM\...\Browser Helper Objects\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:02] - Removing HKCR\CLSID\{A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:02] - Adding Kill Bit for ActiveX for GUID: {A596175D-BBC7-476A-A152-FBA652B64505}
[08/03/2008, 14:35:02] - Deleting ATLEvents/MSEvents Registry entries
[08/03/2008, 14:35:02] - Removing HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:02] - Searching for Browser Helper Objects:
[08/03/2008, 14:35:02] - BHO 1: {0EB0EE45-72DB-405C-BE21-071246949FBF} ()
[08/03/2008, 14:35:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:02] - Checking for HKLM\...\Winlogon\Notify\xxyyvTJd
[08/03/2008, 14:35:02] - Key not found: HKLM\...\Winlogon\Notify\xxyyvTJd, continuing.
[08/03/2008, 14:35:02] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/03/2008, 14:35:02] - BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[08/03/2008, 14:35:02] - BHO 4: {A596175D-BBC7-476A-A152-FBA652B64505} ()
[08/03/2008, 14:35:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/03/2008, 14:35:02] - Checking for HKLM\...\Winlogon\Notify\geBtTJDt
[08/03/2008, 14:35:02] - Key not found: HKLM\...\Winlogon\Notify\geBtTJDt, continuing.
[08/03/2008, 14:35:02] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/03/2008, 14:35:02] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/03/2008, 14:35:02] - Finished Searching Browser Helper Objects
[08/03/2008, 14:35:02] - Finishing up...
[08/03/2008, 14:35:02] - A restart is needed.
[08/03/2008, 14:35:02] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[08/03/2008, 14:35:15] - Attempting to Restart via STOP error (Blue Screen
Configuration: Windows XP Internet Explorer 7.0
15 réponses
Résumé de la discussion
Infection par le trojan Vundo/Virtumundo signalée sur Windows XP et un rapport HijackThis partage les processus actifs, les browser helper objects et les modifications de registre suspectes. Des outils comme VirtumundoBeGone identifient les composants virulents, détectent des Browser Helper Objects tels que geBtTJDt.dll et plusieurs BHO liés à Google Toolbar, puis tentent de les neutraliser et de supprimer les entrées de registre. Le rapport indique aussi des difficultés, notamment le renommage échoué du fichier geBtTJDt.dll et des problèmes de mappage entre noms de compte et SID, nécessitant potentiellement un redémarrage et une suppression manuelle.
-
Contributeurc´est un outil de suppression de fichiers...
-
Contributeurre,
supprime ce fichier .rar
[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar -
Contributeurok
* Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :
C:\Documents and Settings\MR MOUTON\Mes documents\Mes fichiers reçus\installer\MSWINSCK.OCX
C:\Documents and Settings\MR MOUTON\Bureau\torrent\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar
* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.
ps : il est entier le rapport kaspersky ?
@+-
C:\Documents and Settings\MR MOUTON\Mes documents\Mes fichiers reçus\installer\MSWINSCK.OCX unregistered successfully.
C:\Documents and Settings\MR MOUTON\Mes documents\Mes fichiers reçus\installer\MSWINSCK.OCX moved successfully.
< C:\Documents and Settings\MR MOUTON\Bureau\torrent\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar >
File/Folder C:\Documents and Settings\MR MOUTON\Bureau\torrent\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar not found.
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08052008_153519
OUI IL EST ENTIER
-
-
ContributeurSalut villebon,
voila ce que je peux trouver concernant tes bips...
https://www.commentcamarche.net/faq/389-bios-acceder-au-setup-du-bios
mais avant de faire quoi que ce soit...
passe ce scan :
Fais un scan en ligne Kaspersky avec Internet Explorer :
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
-> Click sur Démarrer Online-Scanner
-> Click maintenant sur J'accepte.
-> Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
-> Patiente pendant l'installation des Mises à jour.
-> Choisis par la suite l'analyse du Poste de travail.
-> Sauvegarde puis colle le rapport généré en fin d'analyse.
@+-
DESOLE JE ME SUIS ABSENTERCI JOINT LE RAPPORT KAPERSKY
C:\
D:\
E:\
Statistiques de l'analyse
Total d'objets analysés 60812
Nombre de virus trouvés 2
Nombre d'objets infectés 6
Nombre d'objets suspects 0
Durée de l'analyse 02:11:06
Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_FUJITSU.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\PrdMgr_FUJITSU.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\AccessProtectionLog.txt L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\BufferOverflowProtectionLog.txt L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\OnAccessScanLog.txt L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Bureau\torrent\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar/[NEW]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF/ashampoo_antispyware202_sm.exe/data0000.cab/both.exe Infecté : Trojan-Downloader.MSIL.Agent.aq ignoré
C:\Documents and Settings\MR MOUTON\Bureau\torrent\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar/[NEW]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF/ashampoo_antispyware202_sm.exe/data0000.cab Infecté : Trojan-Downloader.MSIL.Agent.aq ignoré
C:\Documents and Settings\MR MOUTON\Bureau\torrent\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar/[NEW]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF/ashampoo_antispyware202_sm.exe Infecté : Trojan-Downloader.MSIL.Agent.aq ignoré
C:\Documents and Settings\MR MOUTON\Bureau\torrent\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF\[NEW+]Ashampoo.AntiSpyWare.v2.0.2.Incl.Keygen.READ.NFO-CFF.rar RAR: infecté - 3 ignoré
C:\Documents and Settings\MR MOUTON\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Local Settings\Temp\NAILogs\UpdaterUI_FUJITSU.log L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Local Settings\Temp\~DF9D75.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\Mes documents\Mes fichiers reçus\installer\MSWINSCK.OCX Infecté : Backdoor.Win32.VB.fbh ignoré
C:\Documents and Settings\MR MOUTON\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\MR MOUTON\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\System Volume Information\_restore{276670F8-3999-4BBA-A2C2-657373457EDB}\RP7\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\pfirewall.log L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\MSWINSCK.OCX Infecté : Backdoor.Win32.VB.fbh ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\temp\a2cache_7B90AC94.dat L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
JE REVIENT DANS 15MINUTE MERCI
-
-
Contributeurre,
desolé j´ai du m´absenter...
c´est quoi ces bip?
c´est au demarrage ?
tu en as combien ?
@+ -
Contributeurok
tu as encore des soucis ?
post un nouveau rapport hijack this stp
@+-
APPARAMENT TU M AS DEBARRASER DE CETTE VEROLE MAI JE POSER JUSTE LA QUESTION DE SES BIP QUE JE N AVAIT PAS AVANT L INFECTION VU QUE J AI CHOPPE JOKE.BLUESCRENN.C EST CE FAMEUX VUNDO
JE TE POSTE HITJACKTHIS
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:52:06, on 03/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\MR MOUTON\Bureau\scanner.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - https://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_2_0.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D5D30A68-E230-49D9-B4D5-BF7532692945} - https://order.cdiscount.com/Account/LoginLight.html?referrer=https://clients.cdiscount.com%2Ferror%2F404.aspx%3F404%3Bhttp%3A%2F%2Fclients.cdiscount.com%3A100%2Forder%2Ftechcity%2Factivex%2Fcdiscount.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5130/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E5C9EB0E-0BCB-44D1-94F5-A29554673749}: NameServer = 192.168.1.1,80.10.246.129
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: brpvoa.dll
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
-
-
-
Contributeurok
-
CA Y EST MALWAREBYTES A FINI CA ETAIT LONG DESOLEE JE TE JOINT LE LOG
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1018
Windows 5.1.2600 Service Pack 2
17:38:07 03/08/2008
mbam-log-8-3-2008 (17-38-03).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 90908
Temps écoulé: 59 minute(s), 37 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\WINDOWS\system32\geBtTJDt.dll.vir (Trojan.Vundo) -> No action taken.
C:\QooBox\Quarantine\C\WINDOWS\system32\xxyyvTJd.dll.vir (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{276670F8-3999-4BBA-A2C2-657373457EDB}\RP2\A0000008.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{276670F8-3999-4BBA-A2C2-657373457EDB}\RP2\A0000009.dll (Trojan.Vundo) -> No action taken.
ET LE SUIVANT APRES SUPRESSION
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1018
Windows 5.1.2600 Service Pack 2
17:38:14 03/08/2008
mbam-log-8-3-2008 (17-38-14).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 90908
Temps écoulé: 59 minute(s), 37 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\WINDOWS\system32\geBtTJDt.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\xxyyvTJd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{276670F8-3999-4BBA-A2C2-657373457EDB}\RP2\A0000008.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{276670F8-3999-4BBA-A2C2-657373457EDB}\RP2\A0000009.dll (Trojan.Vundo) -> Quarantined and deleted successfully. -
-
-
Contributeurok
Fais un scan avec cet antispyware :
Telecharge malwarebytes + tutoriel :
-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Tu l´instale; le programme va se mettre automatiquement a jour.
Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".
Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "yes".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.
@+ -
Contributeurd´accord
-
CA Y EST JE TE POST LE LOG
ComboFix 08-08-02.01 - MR MOUTON 2008-08-03 16:03:15.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1069 [GMT 2:00]
Endroit: C:\Documents and Settings\MR MOUTON\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\MR MOUTON\Application Data\inst.exe
C:\vundofix.txt
C:\WINDOWS\config.ini
C:\WINDOWS\system32\dJTvyyxx.ini
C:\WINDOWS\system32\dJTvyyxx.ini2
C:\WINDOWS\system32\geBtTJDt.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\xxyyvTJd.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-03 to 2008-08-03 ))))))))))))))))))))))))))))))))))))
.
2008-08-03 14:06 . 2008-08-03 14:06 <REP> d-------- C:\VundoFix Backups
2008-08-03 13:09 . 2008-08-03 13:09 <REP> d-------- C:\Documents and Settings\MR MOUTON\Application Data\Malwarebytes
2008-08-03 13:08 . 2008-08-03 13:09 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-03 13:08 . 2008-08-03 13:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-03 13:08 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-03 13:08 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-03 03:05 . 2008-08-03 03:05 <REP> d-------- C:\Program Files\Ashampoo
2008-08-01 21:12 . 2008-08-01 21:12 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-07-22 21:45 . 2008-07-22 21:49 <REP> d-------- C:\Program Files\EsetOnlineScanner
2008-07-16 23:20 . 2008-07-16 23:20 <REP> d-------- C:\Program Files\ma-config.com
2008-07-16 23:18 . 2008-07-16 23:18 <REP> d-------- C:\Program Files\Windows Installer Clean Up
2008-07-16 23:17 . 2008-07-16 23:17 <REP> d-------- C:\Program Files\MSECACHE
2008-07-14 13:21 . 2008-07-14 13:21 <REP> d-------- C:\Documents and Settings\MR MOUTON\Application Data\VSRevoGroup
2008-07-13 19:05 . 2008-07-13 19:05 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS
2008-07-12 21:43 . 2008-07-29 20:05 <REP> d-------- C:\Program Files\SpeedFan
2008-07-12 21:43 . 2008-07-12 21:43 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2008-07-11 01:08 . 2008-08-03 16:08 186,097 --a------ C:\WINDOWS\system32\nvapps.xml
2008-07-11 01:07 . 2008-07-11 01:07 <REP> d-------- C:\WINDOWS\nview
2008-07-11 01:07 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-07-10 21:14 . 2008-07-10 21:14 <REP> d-------- C:\WINDOWS\E31C348B63A94CBF8D7FD932ABB63244.TMP
2008-07-09 20:20 . 2008-07-09 20:20 268 --ah----- C:\sqmdata00.sqm
2008-07-09 20:20 . 2008-07-09 20:20 244 --ah----- C:\sqmnoopt00.sqm
2008-07-09 20:20 . 2008-07-09 20:20 172 --ah----- C:\sqmnoopt03.sqm
2008-07-09 20:20 . 2008-07-09 20:20 172 --ah----- C:\sqmnoopt02.sqm
2008-07-09 20:20 . 2008-07-09 20:20 172 --ah----- C:\sqmnoopt01.sqm
2008-07-09 20:20 . 2008-07-09 20:20 172 --ah----- C:\sqmdata01.sqm
2008-07-09 20:20 . 2008-07-09 20:20 148 --ah----- C:\sqmdata03.sqm
2008-07-09 20:20 . 2008-07-09 20:20 148 --ah----- C:\sqmdata02.sqm
2008-07-07 03:10 . 2008-08-02 03:06 4,195,517 --a------ C:\WINDOWS\pfirewall.log.old
2008-07-06 00:12 . 2008-07-06 00:42 <REP> d-------- C:\temp
2008-07-06 00:06 . 2008-07-06 00:06 <REP> d-------- C:\Program Files\Fichiers communs\Fujitsu Siemens Computers
2008-07-06 00:05 . 2008-07-06 00:05 <REP> d-------- C:\Program Files\Fujitsu Siemens Computers
2008-07-05 18:29 . 2008-07-05 18:29 <REP> d-------- C:\Program Files\LETMIN
2008-07-05 18:29 . 2008-07-05 18:29 <REP> d-------- C:\Program Files\Icone
2008-07-05 14:32 . 2008-07-05 14:32 <REP> d-------- C:\Program Files\NovaLogic
2008-07-05 12:11 . 2008-07-05 12:11 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-07-05 12:11 . 2008-07-05 12:24 23,616 --a------ C:\WINDOWS\War3Unin.dat
2008-07-05 12:11 . 2008-07-05 12:11 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-07-05 12:08 . 2008-07-27 16:49 <REP> d-------- C:\Program Files\Warcraft III
2008-07-04 00:41 . 2008-07-04 00:43 <REP> d-------- C:\WINDOWS\avxoscan
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-03 01:42 --------- d-----w C:\Documents and Settings\MR MOUTON\Application Data\uTorrent
2008-08-02 18:21 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-08-02 16:33 --------- d-----w C:\Program Files\eChanblard
2008-08-01 19:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-22 19:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-07-11 22:24 2,874 ----a-w C:\Documents and Settings\MR MOUTON\Application Data\wklnhst.dat
2008-07-08 22:36 --------- d-----w C:\Program Files\AxBx
2008-07-04 00:32 --------- d-----w C:\Program Files\Panda Security
2008-06-30 19:27 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-29 23:08 --------- d-----w C:\Program Files\uTorrent
2008-06-26 20:35 91,744 ----a-w C:\WINDOWS\BPMNT.dll
2008-06-26 20:35 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2008-06-26 20:35 333,576 ----a-w C:\WINDOWS\tsc.exe
2008-06-26 20:35 1,213,784 ----a-w C:\WINDOWS\vsapi32.dll
2008-06-23 21:02 --------- d-----w C:\Program Files\Ubi Soft
2008-06-22 20:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-05 20:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-04 20:20 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-04 20:20 --------- d-----w C:\Program Files\Picture It! Premium 10
2008-06-04 20:20 --------- d-----w C:\Program Files\Microsoft Works
2008-05-30 12:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll
2008-05-30 12:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll
2008-05-30 12:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll
2008-05-30 12:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll
2008-05-30 12:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll
2008-05-30 12:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll
2008-05-30 12:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll
2008-05-16 09:48 446,464 ----a-w C:\WINDOWS\system32\NVUninst.exe
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-16 21:29 94,208 ----a-w C:\Documents and Settings\MR MOUTON\Application Data\ezplay.sys
2008-03-21 19:09 47,360 ----a-w C:\Documents and Settings\MR MOUTON\Application Data\pcouffin.sys
2007-05-08 22:56 49 ----a-w C:\Documents and Settings\MR MOUTON\Uninstall.bat
2007-09-30 08:27 2 --shatr C:\WINDOWS\winstart.bat
.
------- Sigcheck -------
2006-12-16 19:12 506368 3efd602a3fd0f9ee82c297636679fec9 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2006-12-16 19:12 506368 3efd602a3fd0f9ee82c297636679fec9 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-08 23:04 68856]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-07-14 21:35 1961984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 14:39 136768]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 09:50 112216]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 18:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 18:50 1603152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"AntiSpyWare2Guard"="C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2007-08-14 09:29 2334040]
"nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=brpvoa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"vidc.dvsd"= pdvcodec.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\eChanblard\\emule.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mcoinstall.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [2007-08-14 09:28]
S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2007-04-16 13:22]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-06-26 09:13]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.orange.fr/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R0 -: HKLM-Main,Start Page = hxxp://www.ustart.org
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 -: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 -: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 -: E&xport to Microsoft Excel
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{E5C9EB0E-0BCB-44D1-94F5-A29554673749}: NameServer = 192.168.1.1,80.10.246.129
O18 -: Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://dev.srtest.com/srl_bin/sysreqlab3.cab
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\SysReqLab3.osd
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\sysreqlab3.dll
ownloaded Program Files\CONFLICT.3\oscan82.ocx
O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://ma-config.com/activex/hardwaredetection_3_0_2_0.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf
O16 -: {D5D30A68-E230-49D9-B4D5-BF7532692945} - hxxps://clients.cdiscount.com/Order/TechCity/activex/CDiscount.cab
C:\WINDOWS\Downloaded Program Files\CDiscount.inf
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-03 16:08:42
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\McAfee\Common Framework\Mctray.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-03 16:20:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-03 14:20:13
Pre-Run: 48,489,426,944 octets libres
Post-Run: 48,594,878,464 octets libres
214 --- E O F --- 2008-07-08 19:38:12 -
CELUI DE HITJACKTHIS
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:26:37, on 03/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\MR MOUTON\Bureau\scanner.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://dev.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - https://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_2_0.cab
O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - https://www.f-secure.com/en/home/support
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D5D30A68-E230-49D9-B4D5-BF7532692945} - https://order.cdiscount.com/Account/LoginLight.html?referrer=https://clients.cdiscount.com%2Ferror%2F404.aspx%3F404%3Bhttp%3A%2F%2Fclients.cdiscount.com%3A100%2Forder%2Ftechcity%2Factivex%2Fcdiscount.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5130/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E5C9EB0E-0BCB-44D1-94F5-A29554673749}: NameServer = 192.168.1.1,80.10.246.129
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: brpvoa.dll
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
-
-
Contributeurok ;)
-
Contributeurdesactive le ;)
-
Contributeurbon alors desactive ton antivirus lors du telechargement...
-
Contributeurhuuum...
essaie en le prenant ici :
http://sd-1.archive-host.com/membres/up/1366464061/ComboFix.rar
ps : dezip le sur ton bureau...
@+ -
bonjour g!rly merci de ton ade mais je n arrive pas a telecharger combofix a la fin du telechargement il me dit impossible de finir le telechargement verifier que le disque n est pas plein
-
Contributeursalut,
Télécharge combofix.exe (par sUBs) sur ton Bureau.
-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Post egalamenet un nouveau rapport hijack this stp
@+
