Besoin d'une analyse Svp

Question

Bonjour à tous,j'aurai besoin que quelqu'un puisse m'aider à éradiquer un virus. J'ai déjà supprimer les spywares et tout et tout...il me reste à fixer certaines lignes: voici mon log:Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\GEARSec.exed:\Norton Ghost\Agent\PQV2iSvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeC:\WINDOWS\Explorer.EXED:\Norton Ghost\Agent\GhostTray.exeD:\bitdef~1\bdmcon.exeC:\WINDOWS\system32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\WINDOWS\inet20010\services.exec:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\WINDOWS\inet20010\mm4.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\HPZipm12.exeC:\WINDOWS\inet20010\mm4.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\ServicePackFiles\i386\IExplore.exeC:\WINDOWS\system32\NOTEPAD.EXEF:\Logiciels\Virus de merde\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF3 - REG:win.ini: run=C:\WINDOWS\inet20010\services.exeO2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20010\3.00.13.dllO4 - HKLM\..\Run: [Norton Ghost 9.0] d:\Norton Ghost\Agent\GhostTray.exeO4 - HKLM\..\Run: [BDMCon] D:\bitdef~1\bdmcon.exeO4 - HKLM\..\Run: [BDNewsAgent] D:\bitdef~1\bdnagent.exeO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20010\services.exeO4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exeO4 - HKLM\..\Run: [Microsoft Office] C:\WINDOWS\system32\msvcp.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\system32\wwwloader.exeO4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20010\services.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128282998868O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CABO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dllO20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\j0j6la1s1d.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Norton Ghost - Symantec Corporation - d:\Norton Ghost\Agent\PQV2iSvc.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing) Merci de votre aideCharly

Kristopher · Answer

Salut Charly

Hormis BitDefender c'est quoi ta protection ?

- Télécharge et scanne ton PC avec Ewido Security Suite : http://www.01net.com/telecharger/windows/Utilitaire/antivirus/fiches/31851.html
Copie/colle le rapport sur le forum.

++

Charly · Answer

Re- !

Donc voici le rapport avec Ediwo

---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 22:12:52, 28/01/2006
+ Somme de contrôle: 44C36682

+ Résultats du scan:

HKLM\SOFTWARE\Classes\CLSID\{5321E378-FFAD-4999-8C62-03CA8155F0B3} -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKLM\SOFTWARE\Classes\CLSID\{724510C3-F3C8-4FB7-879A-D99F29008A2F} -> Hijacker.SpyAxe : Nettoyer et sauvegarder
HKLM\SOFTWARE\Classes\Replace.HBO -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKLM\SOFTWARE\Classes\Replace.HBO\CLSID -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKLM\SOFTWARE\Classes\Replace.HBO\CurVer -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKLM\SOFTWARE\Classes\Replace.HBO.1 -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{724510c3-f3c8-4fb7-879a-d99f29008a2f} -> Hijacker.SpyAxe : Nettoyer et sauvegarder
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5321E378-FFAD-4999-8C62-03CA8155F0B3} -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{724510C3-F3C8-4FB7-879A-D99F29008A2F} -> Hijacker.SpyAxe : Nettoyer et sauvegarder
HKU\S-1-5-21-1715567821-1060284298-854245398-1005\Software\Microsoft\Internet Explorer\Keywords -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKU\S-1-5-21-1715567821-1060284298-854245398-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{44BE0690-5429-47F0-85BB-3FFD8020233E} -> Spyware.UCmore : Nettoyer et sauvegarder
HKU\S-1-5-21-1715567821-1060284298-854245398-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5321E378-FFAD-4999-8C62-03CA8155F0B3} -> Spyware.CoolWebSearch : Nettoyer et sauvegarder
HKU\S-1-5-21-1715567821-1060284298-854245398-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{724510C3-F3C8-4FB7-879A-D99F29008A2F} -> Hijacker.SpyAxe : Nettoyer et sauvegarder
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{724510C3-F3C8-4FB7-879A-D99F29008A2F} -> Hijacker.SpyAxe : Nettoyer et sauvegarder
[1696] C:\WINDOWS\system32\mujtes40.dll -> Spyware.Look2Me : Erreur durant le nettoyage
[796] C:\WINDOWS\system32\mujtes40.dll -> Spyware.Look2Me : Erreur durant le nettoyage
[200] C:\WINDOWS\inet20010\3.00.13.dll -> Spyware.Ihbo : Nettoyer et sauvegarder
[6200] C:\WINDOWS\inet20010\3.00.13.dll -> Spyware.Ihbo : Erreur durant le nettoyage
[9448] C:\WINDOWS\inet20010\mm4.exe -> Proxy.Delf.an : Nettoyer et sauvegarder
[12440] C:\WINDOWS\inet20010\3.00.13.dll -> Spyware.Ihbo : Erreur durant le nettoyage
C:\Documents and Settings\Charly\Cookies\charly@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@adtech[2].txt -> Spyware.Cookie.Adtech : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@atdmt[2].txt -> Spyware.Cookie.Atdmt : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@estat[1].txt -> Spyware.Cookie.Estat : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@paypopup[2].txt -> Spyware.Cookie.Paypopup : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@valueclick[1].txt -> Spyware.Cookie.Valueclick : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@weborama[1].txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@wreport.weborama[1].txt -> Spyware.Cookie.Weborama : Nettoyer et sauvegarder
C:\Documents and Settings\Charly\Cookies\charly@www.smartadserver[1].txt -> Spyware.Cookie.Smartadserver : Nettoyer et sauvegarder
C:\WINDOWS\inet20010\alg.exe -> Worm.Delf.i : Nettoyer et sauvegarder
C:\WINDOWS\inet20010\__delete_on_reboot__3.00.13.dll -> Spyware.Ihbo : Nettoyer et sauvegarder
C:\WINDOWS\system32\__delete_on_reboot__msupdate32.dll -> Proxy.Agent.ij : Nettoyer et sauvegarder
D:\BitDefender Free Edition\Infected\mspostsp.exe -> Trojan.Inject.i : Nettoyer et sauvegarder

::Fin du rapport

Que faire alors? J'ai toujours des pop up qui s'ouvrent sans cesse :@

aranjuez31 · Answer

bsr
vraiment crados ton log
--------
continue de nettoyer avec ceci
Télécharge ceci: (merci a S!RI pour ce petit programme).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.
----------------------------------------------------------------------------
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

aranjuez31 · Answer

bsrremets un nouvel hijack

Charly · Answer

OK, voici le rapport HijackLogfile of HijackThis v1.99.1Scan saved at 22:52:10, on 28/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\WINDOWS\System32\GEARSec.exed:\Norton Ghost\Agent\PQV2iSvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeD:\Norton Ghost\Agent\GhostTray.exeD:\bitdef~1\bdmcon.exeC:\WINDOWS\system32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Internet Explorer\iexplore.exed:\WinRAR\WinRAR.exeF:\Logiciels\Virus de merde\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [Norton Ghost 9.0] d:\Norton Ghost\Agent\GhostTray.exeO4 - HKLM\..\Run: [BDMCon] D:\bitdef~1\bdmcon.exeO4 - HKLM\..\Run: [BDNewsAgent] D:\bitdef~1\bdnagent.exeO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\system32\wwwloader.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128282998868O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CABO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\j4l40e3qeh.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Norton Ghost - Symantec Corporation - d:\Norton Ghost\Agent\PQV2iSvc.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

aranjuez31 · Answer

re charly
------
éclaire ma lanterne
nom de ton p-feu ?
nom de ton antivirus?
--------
fixe ces lignes
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128282998868
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto.com/activeX/newUploadFotoCom.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
-------
ce n est pas fini

Charly · Answer

Donc voici le log que j'ai actuellement:Logfile of HijackThis v1.99.1Scan saved at 23:12:55, on 28/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\WINDOWS\System32\GEARSec.exed:\Norton Ghost\Agent\PQV2iSvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeD:\Norton Ghost\Agent\GhostTray.exeD:\bitdef~1\bdmcon.exeC:\WINDOWS\system32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeF:\Logiciels\Virus de merde\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [Norton Ghost 9.0] d:\Norton Ghost\Agent\GhostTray.exeO4 - HKLM\..\Run: [BDMCon] D:\bitdef~1\bdmcon.exeO4 - HKLM\..\Run: [BDNewsAgent] D:\bitdef~1\bdnagent.exeO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\system32\wwwloader.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\j4l40e3qeh.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Norton Ghost - Symantec Corporation - d:\Norton Ghost\Agent\PQV2iSvc.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

aranjuez31 · Answer

re
si tu n as pas de p-feu incorporé à Bit Defender Free Edition v7.2

il te faut en mettre un
par exemple ZAlarm
http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=34std&ctry=FR&lang=fr

charly · Answer

oki, merci aranjuez en tout cas...dis moi, ca a l'air d'être clean mais j'ai toujours un problème au niveau des fenêtres intempestives....tu saurais pas d'où ca vient et comment je peux faire pour m'en débarasser??

aranjuez31 · Answer

bsr

Installer L2mfix là (nettoie ligne O20 de Hijackthis)

http://www.downloads.subratam.org/l2mfix.exe
http://users.skynet.be/BernieClub/tools.html
1. extraire le fichier sur le bureau
2. désactiver l'antivirus (car process est détecté faussement comme virus malware par certains antivirus)
3. lancer l2mfix.bat et sélectionner l'option #1 et faire Enter pour faire apparaître le log (cela prend qqs minutes)
4. Copie le log et colle sur un FORUM approprié pour une aide (par ex CMC sécurité/virus)
5. Fermes toutes tes fenêtres windows

6. Relances l2mfix.bat et sélectionne l'option #2
7. l'ordi va redémarrer automatiquement sinon le faire manuellement
8. Recopie le log et colle-le à nouveau sur un FORUM approprié pour une aide
9. Lances un Hijackthis http://www.merijn.org/files/hijackthis.zip ou là http://users.skynet.be/BernieClub/tools.html
tu le lances " Do a system scan and save log " et tu copie/colle le rapport sur un FORUM approprié pour une aide (avec cliq droit de la souris).

Charly · Answer

Bonsoir,Voici après redémarrage mon 2nd log L2mfix ainsi que mon log Hijack this à la suiteL2mfix 010406Creating Account.La commande s'est termin‚e correctement.Adding Administrative privleges. Checking for L2MFix account(0=no 1=yes): 1 Granting SeDebugPrivilege to L2MFIX   ... successful Running From:C:\WINDOWS\system32 Killing Processes! Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 572 'smss.exe'Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 996 'winlogon.exe'Killing PID 996 'winlogon.exe'Killing PID 996 'winlogon.exe'Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 524 'explorer.exe'Killing PID 524 'explorer.exe'Killing PID 524 'explorer.exe'Killing PID 524 'explorer.exe'Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.orgKilling PID 1752 'rundll32.exe'Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrateurs   ... successful Scanning First Pass. Please Wait! First Pass Completed  Second Pass Scanning  Second pass Completed!        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).        1 fichier(s) copi‚(s).Deleting: C:\WINDOWS\system32\ahtapi.dll  Successfully Deleted: C:\WINDOWS\system32\ahtapi.dll  Deleting: C:\WINDOWS\system32\en24l1fq1.dll  Successfully Deleted: C:\WINDOWS\system32\en24l1fq1.dll  Deleting: C:\WINDOWS\system32\en8ul1l91.dll  Successfully Deleted: C:\WINDOWS\system32\en8ul1l91.dll  Deleting: C:\WINDOWS\system32\hr8605lse.dll  Successfully Deleted: C:\WINDOWS\system32\hr8605lse.dll  Deleting: C:\WINDOWS\system32\ktr8l79u1.dll  Successfully Deleted: C:\WINDOWS\system32\ktr8l79u1.dll  Deleting: C:\WINDOWS\system32\LQWND12n.DLL  Successfully Deleted: C:\WINDOWS\system32\LQWND12n.DLL  Deleting: C:\WINDOWS\system32\mdvcp50.dll  Successfully Deleted: C:\WINDOWS\system32\mdvcp50.dll  Deleting: C:\WINDOWS\system32\mujtes40.dll  Successfully Deleted: C:\WINDOWS\system32\mujtes40.dll  Deleting: C:\WINDOWS\system32\sarmdll.dll  Successfully Deleted: C:\WINDOWS\system32\sarmdll.dll   msg11?.dll         0 fichier(s) copi‚(s).   Restoring Windows Update Certificates.: The following Is the Current Export of the Winlogon notify key:****************************************************************************Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\  6c,00,00,00"Logoff"="ChainWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]"Asynchronous"=dword:00000000"Impersonate"=dword:00000000"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\  6c,00,6c,00,00,00"Logoff"="CryptnetWlxLogoffEvent"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]"DLLName"="cscdll.dll""Logon"="WinlogonLogonEvent""Logoff"="WinlogonLogoffEvent""ScreenSaver"="WinlogonScreenSaverEvent""Startup"="WinlogonStartupEvent""Shutdown"="WinlogonShutdownEvent""StartShell"="WinlogonStartShellEvent""Impersonate"=dword:00000000"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MS-DOS Emulation]"Asynchronous"=dword:00000000"DllName"="C:\WINDOWS\system32\en8ul1l91.dll""Impersonate"=dword:00000000"Logon"="WinLogon""Logoff"="WinLogoff""Shutdown"="WinShutdown"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]"DLLName"="wlnotify.dll""Logon"="SCardStartCertProp""Logoff"="SCardStopCertProp""Lock"="SCardSuspendCertProp""Unlock"="SCardResumeCertProp""Enabled"=dword:00000001"Impersonate"=dword:00000001"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]"Asynchronous"=dword:00000000"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00"Impersonate"=dword:00000000"StartShell"="SchedStartShell""Logoff"="SchedEventLogOff"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]"Logoff"="WLEventLogoff""Impersonate"=dword:00000000"Asynchronous"=dword:00000001"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]"DLLName"="WlNotify.dll""Lock"="SensLockEvent""Logon"="SensLogonEvent""Logoff"="SensLogoffEvent""Safe"=dword:00000001"MaxWait"=dword:00000258"StartScreenSaver"="SensStartScreenSaverEvent""StopScreenSaver"="SensStopScreenSaverEvent""Startup"="SensStartupEvent""Shutdown"="SensShutdownEvent""StartShell"="SensStartShellEvent""PostShell"="SensPostShellEvent""Disconnect"="SensDisconnectEvent""Reconnect"="SensReconnectEvent""Unlock"="SensUnlockEvent""Impersonate"=dword:00000001"Asynchronous"=dword:00000001[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ermsrv]"Asynchronous"=dword:00000000"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00"Impersonate"=dword:00000000"Logoff"="TSEventLogoff""Logon"="TSEventLogon""PostShell"="TSEventPostShell""Shutdown"="TSEventShutdown""StartShell"="TSEventStartShell""Startup"="TSEventStartup""MaxWait"=dword:00000258"Reconnect"="TSEventReconnect""Disconnect"="TSEventDisconnect"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]"DLLName"="wlnotify.dll""Logon"="RegisterTicketExpiredNotificationEvent""Logoff"="UnregisterTicketExpiredNotificationEvent""Impersonate"=dword:00000001"Asynchronous"=dword:00000001 The following are the files found: ****************************************************************************C:\WINDOWS\system32\ahtapi.dll C:\WINDOWS\system32\en24l1fq1.dll C:\WINDOWS\system32\en8ul1l91.dll C:\WINDOWS\system32\hr8605lse.dll C:\WINDOWS\system32\ktr8l79u1.dll C:\WINDOWS\system32\LQWND12n.DLL C:\WINDOWS\system32\mdvcp50.dll C:\WINDOWS\system32\mujtes40.dll C:\WINDOWS\system32\sarmdll.dll  Registry Entries that were Deleted: Please verify that the listing looks ok.  If there was something deleted wrongly there are backups in the backreg folder. ****************************************************************************Windows Registry Editor Version 5.00[HKEY_CLASSES_ROOT\CLSID\{EA09E0B5-49BF-4A6F-ABF8-0070F0B772E2}]@=""[HKEY_CLASSES_ROOT\CLSID\{EA09E0B5-49BF-4A6F-ABF8-0070F0B772E2}\Implemented Categories]@=""[HKEY_CLASSES_ROOT\CLSID\{EA09E0B5-49BF-4A6F-ABF8-0070F0B772E2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]@=""[HKEY_CLASSES_ROOT\CLSID\{EA09E0B5-49BF-4A6F-ABF8-0070F0B772E2}\InprocServer32]@="C:\WINDOWS\system32\mdvcp50.dll""ThreadingModel"="Apartment"REGEDIT4[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]"{EA09E0B5-49BF-4A6F-ABF8-0070F0B772E2}"=-[-HKEY_CLASSES_ROOT\CLSID\{EA09E0B5-49BF-4A6F-ABF8-0070F0B772E2}]REGEDIT4[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]"SV1"=""****************************************************************************Desktop.ini Contents: ********************************************************************************************************************************************************Checking for L2MFix account(0=no 1=yes): 0Zipping up files for submission:  adding: dlls/ahtapi.dll (188 bytes security) (deflated 5%)  adding: dlls/en24l1fq1.dll (188 bytes security) (deflated 4%)  adding: dlls/en8ul1l91.dll (188 bytes security) (deflated 4%)  adding: dlls/hr8605lse.dll (188 bytes security) (deflated 5%)  adding: dlls/ktr8l79u1.dll (188 bytes security) (deflated 5%)  adding: dlls/LQWND12n.DLL (188 bytes security) (deflated 5%)  adding: dlls/mdvcp50.dll (188 bytes security) (deflated 4%)  adding: dlls/mujtes40.dll (188 bytes security) (deflated 5%)  adding: dlls/sarmdll.dll (188 bytes security) (deflated 5%)  adding: backregs/EA09E0B5-49BF-4A6F-ABF8-0070F0B772E2.reg (188 bytes security) (deflated 70%)  adding: backregs/notibac.reg (188 bytes security) (deflated 63%)  adding: backregs/shell.reg (188 bytes security) (deflated 73%)______________________________________________________Logfile of HijackThis v1.99.1Scan saved at 00:20:38, on 29/01/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\WINDOWS\System32\GEARSec.exed:\Norton Ghost\Agent\PQV2iSvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeD:\Norton Ghost\Agent\GhostTray.exeD:\bitdef~1\bdmcon.exeC:\WINDOWS\system32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\wuauclt.exeF:\Logiciels\Virus de merde\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO4 - HKLM\..\Run: [Norton Ghost 9.0] d:\Norton Ghost\Agent\GhostTray.exeO4 - HKLM\..\Run: [BDMCon] D:\bitdef~1\bdmcon.exeO4 - HKLM\..\Run: [BDNewsAgent] D:\bitdef~1\bdnagent.exeO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\system32\wwwloader.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dllO20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\en8ul1l91.dll (file missing)O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Norton Ghost - Symantec Corporation - d:\Norton Ghost\Agent\PQV2iSvc.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)Quelqu'un y voit-il clair là dedans pour résoudre mon problème ?!

aranjuez31 · Answer

okfais option 2 - collepuis nouvel ewido colléet dis si ton blem demeure

charly · Answer

Et bien, il me semble que mon problème est résolu...Merci encore à vous 2 Kristopher et Aranjuez;)Merci et bonne nuitée maintenantCharly

aranjuez31 · Answer

have a nice nightsi blem , tu connais le chemin pour revenir

Besoin d'une analyse Svp

14 réponses

Discussions similaires

Newsletters