Infécté par Win32:VBStat-C

Arut -  
Bonjour,

J'ai un problème avec un trojan( Win32:VBStat-C) qui ouvre des pages internet et je ne suis pas capable de m'en défaire. J'aimerais avoir votre aide pour m'en débarasser. J'ai comme antivirus Avast
Merci

Arut
Configuration: Windows XP edition familiale
Firefox 2.0.0.3

27 réponses

Résumé de la discussion

Le fil porte sur une infection trojan Win32:VBStat-C qui redirige le navigateur et échappe aux tentatives de suppression, avec Avast installé sur Windows XP Edition Familiale et Firefox 2.0.0.3. Des outils comme VundoFix et HijackThis ont été employés, avec des rapports montrant suppression ou tentative de suppression de DLL et fichiers système, et des modifications de paramètres réseau. Plusieurs éléments persistants incluaient des fichiers dans system32 (fccbxus.dll, pmkjg.dll, jkhfd.dll), des entrées de démarrage et des serveurs DNS modifiés indiqués dans HijackThis, notamment. En dernier lieu, l'analyse AVG Anti-Spyware a signalé des éléments en restauration et a permis de nettoyer certaines entrées, mais des composants restants incitent à poursuivre le nettoyage.

Bobot (l’IA à votre service)
  1. did71 Contributeur sécurité
    bonsoir,

    télécharge HijackThis:

    http://pchelpbordeaux.free.fr/logiciels.html

    Tutorial:

    http://pchelpbordeaux.free.fr/tuto.html

    Démo en image:

    http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

    Fais un scan et poste l'analyse.

    a+
    0
    1. Arut
      Logfile of HijackThis v1.99.1
      Scan saved at 21:37:31, on 08/05/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\UAService7.exe
      C:\windows\system\hpsysdrv.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
      C:\Program Files\BroadJump\Client Foundation\CFD.exe
      C:\WINDOWS\StopHid.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\HP\KBD\KBD.EXE
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Alt-Tab Thingy v3\attmain.exe
      C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      C:\Program Files\LClock\LClock.exe
      C:\Program Files\Styler\Styler.exe
      C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{A6467D54-4E4C-4F35-9971-BAD59FD4C232}\Blaero Start Orb.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\Program Files\PeerGuardian2\pg2.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      C:\Program Files\Logitech\SetPoint\SetPoint.exe
      C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
      C:\Program Files\MSN Messenger\usnsvc.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\explorer.exe
      C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
      O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
      O2 - BHO: (no name) - {B3948DD0-E170-4BE1-AE94-2727896497E7} - C:\WINDOWS\system32\pmkjg.dll
      O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\uaqjsdit.dll (file missing)
      O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll
      O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
      O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
      O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
      O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
      O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
      O4 - HKLM\..\Run: [StopHid] StopHid.exe
      O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
      O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
      O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
      O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
      O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
      O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
      O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
      O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
      O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
      O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
      O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
      O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
      O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
      O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
      O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
      O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
      O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
      O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
      O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
      O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
      O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
      O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
      O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
      O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
      O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
      O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
      O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
      O20 - Winlogon Notify: fccbxus - C:\WINDOWS\SYSTEM32\fccbxus.dll
      O20 - Winlogon Notify: pmkjg - C:\WINDOWS\system32\pmkjg.dll
      O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
      O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
      O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
      O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
      O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
      O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
      0
      1. did71 Contributeur sécurité
        re,

        infection courante ces temps ci!

        * Télécharge VundoFix.exe (par Atribune) sur ton Bureau:

        http://www.atribune.org/public-beta/VundoFix.exe

        * Double-clique VundoFix.exe afin de le lancer
        * Clique sur le bouton Scan for Vundo
        * Lorsque le scan est complété, clique sur le bouton Remove Vundo
        * Une invite te demandera si tu veux supprimer les fichiers, clique YES
        * Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
        * Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
        * Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse

        Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

        a+
        0
        1. Arut
          Comme prévu 1 fichier n'a pu être supprimé, au redémarrage, aucun fichier infecté n'a été trouvé. Voici le rapport de VundoFix :

          VundoFix V6.3.21

          Checking Java version...

          Java version is 1.5.0.5
          Old versions of java are exploitable and should be removed.

          Java version is 1.5.0.6
          Old versions of java are exploitable and should be removed.

          Java version is 1.5.0.9
          Old versions of java are exploitable and should be removed.

          Java version is 1.5.0.10

          Java version is 1.5.0.11

          Scan started at 21:47:52 08/05/2007

          Listing files found while scanning....

          C:\WINDOWS\system32\gjkmp.bak1
          C:\WINDOWS\system32\gjkmp.bak2
          C:\WINDOWS\system32\gjkmp.ini
          C:\WINDOWS\system32\pmkjg.dll
          C:\WINDOWS\system32\uaqjsdit.dll

          Beginning removal...

          Attempting to delete C:\WINDOWS\system32\gjkmp.bak1
          C:\WINDOWS\system32\gjkmp.bak1 Has been deleted!

          Attempting to delete C:\WINDOWS\system32\gjkmp.bak2
          C:\WINDOWS\system32\gjkmp.bak2 Has been deleted!

          Attempting to delete C:\WINDOWS\system32\gjkmp.ini
          C:\WINDOWS\system32\gjkmp.ini Has been deleted!

          Attempting to delete C:\WINDOWS\system32\pmkjg.dll
          C:\WINDOWS\system32\pmkjg.dll Could not be deleted.

          Performing Repairs to the registry.
          Done!

          VundoFix V6.3.21

          Checking Java version...

          Java version is 1.5.0.5
          Old versions of java are exploitable and should be removed.

          Java version is 1.5.0.6
          Old versions of java are exploitable and should be removed.

          Java version is 1.5.0.9
          Old versions of java are exploitable and should be removed.

          Java version is 1.5.0.10

          Java version is 1.5.0.11

          Scan started at 21:58:23 08/05/2007

          Listing files found while scanning....

          No infected files were found.

          Beginning removal...

          Et voici le second rapport de HijackThis :

          Logfile of HijackThis v1.99.1
          Scan saved at 22:14:42, on 08/05/2007
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\UAService7.exe
          C:\WINDOWS\system32\ZoneLabs\vsmon.exe
          C:\WINDOWS\system32\SearchIndexer.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\WINDOWS\system32\wbem\wmiapsrv.exe
          C:\WINDOWS\system32\SearchProtocolHost.exe
          C:\windows\system\hpsysdrv.exe
          C:\WINDOWS\system32\rundll32.exe
          C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
          C:\Program Files\BroadJump\Client Foundation\CFD.exe
          C:\WINDOWS\StopHid.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
          C:\WINDOWS\mHotkey.exe
          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
          C:\WINDOWS\SOUNDMAN.EXE
          C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\HP\KBD\KBD.EXE
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\Program Files\Alt-Tab Thingy v3\attmain.exe
          C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
          C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
          C:\Program Files\LClock\LClock.exe
          C:\Program Files\Styler\Styler.exe
          C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{0C180175-A0DE-4BAE-AA8C-1DE15E0AFF30}\Blaero Start Orb.exe
          C:\Program Files\PeerGuardian2\pg2.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\DOCUME~1\ALLUSE~1\APPLIC~1\ONLINE~1\BASHLO~1.EXE
          C:\Program Files\JPA\Madotate 3D\madotate.exe
          C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
          C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
          C:\Program Files\Logitech\SetPoint\SetPoint.exe
          C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
          C:\Program Files\Mozilla Firefox\firefox.exe
          C:\WINDOWS\system32\rundll32.exe
          C:\WINDOWS\system32\SearchFilterHost.exe
          C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
          O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll
          O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
          O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
          O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll
          O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
          O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
          O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
          O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
          O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
          O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
          O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
          O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
          O4 - HKLM\..\Run: [StopHid] StopHid.exe
          O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
          O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
          O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
          O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
          O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
          O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
          O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
          O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
          O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
          O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
          O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
          O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
          O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
          O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
          O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
          O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
          O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
          O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
          O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
          O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
          O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
          O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
          O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
          O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
          O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
          O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
          O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
          O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
          O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
          O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
          O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
          O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
          O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
          O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
          O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
          O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
          O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
          O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
          O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
          O20 - Winlogon Notify: fccbxus - C:\WINDOWS\SYSTEM32\fccbxus.dll
          O20 - Winlogon Notify: pmkjg - C:\WINDOWS\system32\pmkjg.dll
          O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
          O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
          O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
          O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
          O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
          O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
          O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
          O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
          O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
          O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
          O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
          O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
          O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
          O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
          O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
          0
          2. did71 Contributeur sécurité
            re,

            * Relance Vundofix
            * Ne clique pas sur "Scan for a vundo"
            * Clique droit au milieu de la fenêtre
            * Clique sur Add more files ?
            * Copie/colle les fichiers ci-dessous ( un par case) :

            C:\WINDOWS\system32\pmkjg.dll
            C:\WINDOWS\system32\fccbxus.dll
            C:\WINDOWS\system32\nnuxjbqe.dll

            * Clique sur Add files
            * Ensuite clique sur Close Windows
            * Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
            * Si l'outils demande un redémarrage, accepte
            * Poste le rapport Vundofix, ainsi qu'un nouveau log hijackthis

            a+
            0
            1. Arut
              J'ai fait ce que tu m'a demandé et le fichier C:\WINDOWS\system32\fccbxus.dll n'a pu être supprimé. Au redémarrage, vundo en trouve 3 que j'ai effacé, voici les nouveaux rapport :

              VundoFix V6.3.21

              Checking Java version...

              Java version is 1.5.0.5
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.6
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.9
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.10

              Java version is 1.5.0.11

              Scan started at 21:47:52 08/05/2007

              Listing files found while scanning....

              C:\WINDOWS\system32\gjkmp.bak1
              C:\WINDOWS\system32\gjkmp.bak2
              C:\WINDOWS\system32\gjkmp.ini
              C:\WINDOWS\system32\pmkjg.dll
              C:\WINDOWS\system32\uaqjsdit.dll

              Beginning removal...

              Attempting to delete C:\WINDOWS\system32\gjkmp.bak1
              C:\WINDOWS\system32\gjkmp.bak1 Has been deleted!

              Attempting to delete C:\WINDOWS\system32\gjkmp.bak2
              C:\WINDOWS\system32\gjkmp.bak2 Has been deleted!

              Attempting to delete C:\WINDOWS\system32\gjkmp.ini
              C:\WINDOWS\system32\gjkmp.ini Has been deleted!

              Attempting to delete C:\WINDOWS\system32\pmkjg.dll
              C:\WINDOWS\system32\pmkjg.dll Could not be deleted.

              Performing Repairs to the registry.
              Done!

              VundoFix V6.3.21

              Checking Java version...

              Java version is 1.5.0.5
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.6
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.9
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.10

              Java version is 1.5.0.11

              Scan started at 21:58:23 08/05/2007

              Listing files found while scanning....

              No infected files were found.

              Beginning removal...

              Beginning removal...

              Attempting to delete C:\WINDOWS\system32\fccbxus.dll
              C:\WINDOWS\system32\fccbxus.dll Could not be deleted.

              Attempting to delete C:\WINDOWS\system32\nnuxjbqe.dll
              C:\WINDOWS\system32\nnuxjbqe.dll Has been deleted!

              Attempting to delete C:\WINDOWS\system32\pmkjg.dll
              C:\WINDOWS\system32\pmkjg.dll Has been deleted!

              Performing Repairs to the registry.
              Done!

              VundoFix V6.3.21

              Checking Java version...

              Java version is 1.5.0.5
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.6
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.9
              Old versions of java are exploitable and should be removed.

              Java version is 1.5.0.10

              Java version is 1.5.0.11

              Scan started at 22:33:13 08/05/2007

              Listing files found while scanning....

              C:\WINDOWS\system32\dfhkj.bak1
              C:\WINDOWS\system32\dfhkj.ini
              C:\WINDOWS\system32\jkhfd.dll

              Beginning removal...

              Attempting to delete C:\WINDOWS\system32\dfhkj.bak1
              C:\WINDOWS\system32\dfhkj.bak1 Has been deleted!

              Attempting to delete C:\WINDOWS\system32\dfhkj.ini
              C:\WINDOWS\system32\dfhkj.ini Has been deleted!

              Attempting to delete C:\WINDOWS\system32\jkhfd.dll
              C:\WINDOWS\system32\jkhfd.dll Has been deleted!

              Performing Repairs to the registry.
              Done!

              Et le rapport de hijackthis :

              Logfile of HijackThis v1.99.1
              Scan saved at 22:50:26, on 08/05/2007
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\csrss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
              C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
              C:\WINDOWS\system32\nvsvc32.exe
              C:\windows\system\hpsysdrv.exe
              C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
              C:\Program Files\BroadJump\Client Foundation\CFD.exe
              C:\WINDOWS\StopHid.exe
              C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
              C:\WINDOWS\mHotkey.exe
              C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\WINDOWS\SOUNDMAN.EXE
              C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              C:\HP\KBD\KBD.EXE
              C:\WINDOWS\system32\RUNDLL32.EXE
              C:\Program Files\Alt-Tab Thingy v3\attmain.exe
              C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
              C:\WINDOWS\system32\UAService7.exe
              C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
              C:\Program Files\LClock\LClock.exe
              C:\Program Files\Styler\Styler.exe
              C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{E573F731-D87F-4B08-A667-516812D86E84}\Blaero Start Orb.exe
              C:\WINDOWS\system32\ZoneLabs\vsmon.exe
              C:\Program Files\PeerGuardian2\pg2.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\JPA\Madotate 3D\madotate.exe
              C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
              C:\WINDOWS\system32\SearchIndexer.exe
              C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
              C:\Program Files\Logitech\SetPoint\SetPoint.exe
              C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
              C:\Program Files\Mozilla Firefox\firefox.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\WINDOWS\system32\wbem\wmiapsrv.exe
              C:\WINDOWS\system32\wbem\wmiprvse.exe
              C:\WINDOWS\system32\SearchProtocolHost.exe
              C:\WINDOWS\system32\SearchFilterHost.exe
              C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
              O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
              O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
              O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
              O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
              O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
              O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll
              O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
              O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
              O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
              O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
              O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
              O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
              O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
              O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
              O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
              O4 - HKLM\..\Run: [StopHid] StopHid.exe
              O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
              O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
              O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
              O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
              O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
              O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
              O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
              O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
              O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
              O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
              O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
              O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
              O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
              O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
              O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
              O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
              O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
              O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
              O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
              O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
              O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
              O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
              O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
              O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
              O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
              O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
              O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
              O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
              O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
              O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
              O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
              O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
              O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
              O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
              O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
              O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
              O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
              O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
              O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
              O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
              O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
              O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
              O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
              O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
              O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
              O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
              O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
              O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
              O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
              O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
              O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
              O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
              O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
              O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
              O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
              O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
              O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
              O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
              O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
              O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
              O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
              O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
              O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
              O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
              O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
              O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
              O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
              O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
              0
              1. did71 Contributeur sécurité
                re,

                on va virer le reste!

                1. Télécharge The Avenger par Swandog46 sur ton Bureau:

                http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/

                Click sur Avenger.zip pour ouvrir le fichier
                Extraire avenger.exe sur votre bureau

                2. Copie tout le texte en gras ci-dessous : mettre en surbrillance et appuyer sur les touches(Ctrl+C):

                Files to delete:
                C:\WINDOWS\system32\fccbxus.dll

                3. Maintenant, lance The Avenger en cliquant sur son icône du bureau.
                Sous "Script file to execute" choisir "Input Script Manually".
                Puis clique sur l'icône en forme de loupe qui va ouvrir une nouvelle fenêtre "View/edit script"
                Dans cette fenêtre, colle le texte précedemment copié sur le bureau par les touches (Ctrl+V).
                Cliquer Done
                ensuite clique sur l'icône en forme de Feu Vert pour démarrer l'exécution du script
                Réponds "Yes" deux fois quand demandé.

                4. The Avenger va automatiquement faire ce qui suit:
                Il va Re-démarrer le système.
                Pendant le re-démarrage, il apparaitra brièvement une fenêtre de commande de windows noire sur ton bureau, ceci est NORMAL.
                Après le re-démarrage, il crée un fichier log qui s'ouvrira, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt

                5. Pour finir copie/colle le contenu du ficher c:\avenger.txt
                0
                1. Arut
                  voila :

                  Logfile of The Avenger version 1, by Swandog46
                  Running from registry key:
                  \Registry\Machine\System\CurrentControlSet\Services\sebrntbq

                  *******************

                  Script file located at: \??\C:\Program Files\fkbfgqnj.txt
                  Script file opened successfully.

                  Script file read successfully

                  Backups directory opened successfully at C:\Avenger

                  *******************

                  Beginning to process script file:

                  File C:\WINDOWS\system32\fccbxus.dll deleted successfully.

                  Completed script processing.

                  *******************

                  Finished! Terminate.
                  0
                  1. did71 Contributeur sécurité
                    re,

                    poste un nouvel hijackthis!

                    a+
                    0
                    1. Arut
                      Logfile of HijackThis v1.99.1
                      Scan saved at 23:17:16, on 08/05/2007
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\csrss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\windows\system\hpsysdrv.exe
                      C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                      C:\Program Files\BroadJump\Client Foundation\CFD.exe
                      C:\WINDOWS\StopHid.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                      C:\WINDOWS\mHotkey.exe
                      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                      C:\WINDOWS\SOUNDMAN.EXE
                      C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      C:\HP\KBD\KBD.EXE
                      C:\WINDOWS\system32\RUNDLL32.EXE
                      C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                      C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                      C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                      C:\WINDOWS\system32\rundll32.exe
                      C:\Program Files\LClock\LClock.exe
                      C:\Program Files\Styler\Styler.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\JPA\Madotate 3D\madotate.exe
                      C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                      C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{3B2F62ED-9FAD-4375-8A5A-ECF827196D3A}\Blaero Start Orb.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      C:\Program Files\Logitech\SetPoint\SetPoint.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                      C:\WINDOWS\system32\nvsvc32.exe
                      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\UAService7.exe
                      C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                      C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                      C:\WINDOWS\system32\SearchIndexer.exe
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\WINDOWS\system32\wbem\wmiapsrv.exe
                      C:\WINDOWS\system32\wbem\wmiprvse.exe
                      C:\Program Files\Mozilla Firefox\firefox.exe
                      C:\Program Files\Mozilla Thunderbird\thunderbird.exe
                      C:\WINDOWS\system32\SearchProtocolHost.exe
                      C:\WINDOWS\system32\SearchFilterHost.exe
                      C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                      O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
                      O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                      O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
                      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                      O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
                      O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll (file missing)
                      O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                      O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                      O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                      O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                      O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                      O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                      O4 - HKLM\..\Run: [StopHid] StopHid.exe
                      O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                      O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                      O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                      O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                      O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                      O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                      O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                      O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                      O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                      O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
                      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                      O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                      O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
                      O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                      O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                      O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                      O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                      O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                      O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                      O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                      O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                      O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                      O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                      O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                      O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                      O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                      O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                      O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                      O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                      O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                      O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                      O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                      O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                      O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                      O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                      O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
                      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                      O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
                      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                      O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                      O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                      O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                      O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                      O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                      O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                      O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                      O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                      0
                      1. Arut
                        Pour les manipulations suivante, on verra demain, faut que j'aille dormir, demain j'ai cours, mais merci de m'aider pour ce truc ! je serai sur le forum à partir de 13 heures. à demain !
                        0
                        1. did71 Contributeur sécurité
                          ok!

                          bonne nuit!

                          on a viré le plus néfaste!

                          pour demain:

                          Télécharge clean.zip

                          http://www.malekal.com/download/clean.zip

                          Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.
                          Ouvre le dossier Clean qui se trouve sur ton bureau.
                          Double-clic sur clean.cmd.
                          Une fenêtre noire va apparaître, choisis l'option 1.

                          Poste le rapport qui se trouve ici C:\rapport_clean.txt

                          a+
                          0
                          1. Arut
                            J'ai un problème, au démarage, j'obtien un message d'erreur avec le titre : RUNDLL et le contenu : "Erreur de chargement de C:/WINDOWS/systeme32/nnuxjbqe.dll
                            Le module spécifié est introuvable."
                            Que faire ?

                            voici le rapport de clean :

                            09/05/2007 a 13:27:26,14

                            *** Recherche des fichiers dans C:

                            *** Recherche des fichiers dans C:\WINDOWS\
                            C:\WINDOWS\ALCXMNTR.EXE FOUND

                            *** Recherche des fichiers dans C:\WINDOWS\system32
                            C:\WINDOWS\system32\mcrh.tmp FOUND
                            C:\WINDOWS\system32\SpoonUninstall.exe FOUND
                            C:\WINDOWS\nsreg.dat FOUND

                            *** Recherche des fichiers dans C:\Program Files
                            "C:\Program Files\secure32.html" FOUND
                            "C:\Program Files\Viewpoint\" FOUND
                            *** Fin du rapport !

                            et le rapport de HijackThis :


                            Logfile of HijackThis v1.99.1
                            Scan saved at 13:32:33, on 09/05/2007
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\csrss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                            C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                            C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                            C:\windows\system\hpsysdrv.exe
                            C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                            C:\Program Files\BroadJump\Client Foundation\CFD.exe
                            C:\WINDOWS\StopHid.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                            C:\WINDOWS\mHotkey.exe
                            C:\WINDOWS\system32\rundll32.exe
                            C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                            C:\WINDOWS\SOUNDMAN.EXE
                            C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            C:\WINDOWS\system32\nvsvc32.exe
                            C:\HP\KBD\KBD.EXE
                            C:\WINDOWS\system32\RUNDLL32.EXE
                            C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                            C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\UAService7.exe
                            C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                            C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                            C:\Program Files\LClock\LClock.exe
                            C:\Program Files\Styler\Styler.exe
                            C:\Program Files\PeerGuardian2\pg2.exe
                            C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{37FA537F-1648-404B-B850-520141DD2756}\Blaero Start Orb.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\JPA\Madotate 3D\madotate.exe
                            C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                            C:\Program Files\Internet Explorer\iexplore.exe
                            C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                            C:\Program Files\Logitech\SetPoint\SetPoint.exe
                            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            C:\WINDOWS\system32\wbem\wmiapsrv.exe
                            C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                            C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                            C:\Program Files\MSN Messenger\usnsvc.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Program Files\Mozilla Firefox\firefox.exe
                            C:\WINDOWS\system32\msiexec.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                            O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                            O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                            O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
                            O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                            O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                            O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
                            O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll (file missing)
                            O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                            O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                            O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                            O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                            O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                            O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                            O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                            O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                            O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                            O4 - HKLM\..\Run: [StopHid] StopHid.exe
                            O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                            O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                            O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                            O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                            O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                            O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                            O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                            O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                            O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                            O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                            O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                            O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                            O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
                            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                            O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                            O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
                            O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                            O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                            O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                            O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                            O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                            O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                            O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                            O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                            O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                            O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                            O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                            O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                            O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                            O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                            O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                            O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                            O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                            O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                            O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                            O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                            O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                            O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                            O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                            O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                            O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                            O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                            O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                            O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
                            O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                            O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
                            O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                            O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                            O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                            O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                            O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                            O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                            O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                            O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                            O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                            O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                            O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                            O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                            O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                            O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                            O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                            O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                            O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                            0
                            2. did71 Contributeur sécurité
                              Bonjour,

                              je réponds quand je peux, je bosse la journée!!

                              1) relance cleanzip,

                              Choisis cette fois l'option 2!

                              Poste le rapport ensuite

                              2) relance hijackthis, coche les lignes citées ci dessous et fix checked (toutes fenêtres IE fermées) :

                              O2 - BHO: (no name) - {7C80E902-B235-4025-B336-297255637489} - C:\WINDOWS\system32\pmkjg.dll (file missing)
                              O2 - BHO: (no name) - {9CA0C6F1-23D1-418F-8149-57B70BDF7520} - (no file)
                              O2 - BHO: (no name) - {BCFD37B0-E356-4D59-A870-EDD13D7ED4BE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
                              O2 - BHO: (no name) - {F38D448A-F274-4C34-B13B-A3E505E95209} - C:\WINDOWS\system32\fccbxus.dll (file missing)
                              O4 - HKLM\..\Run: [StopHid] StopHid.exe
                              O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
                              O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                              O4 - HKCU\..\Run: [team tick] C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe
                              O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\nnuxjbqe.dll",realset
                              O20 - Winlogon Notify: se500mdm - se500mdm.dll (file missing)
                              O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)

                              3) recherche et supprime le fichiers/dossier en gras ci dessous:

                              C:\Program Files\Blaero Start Orb
                              C:\DOCUME~1\HP_PRO~1\APPLIC~1\CHICUS~1\burn ball blue.exe

                              4) poste un nouvel hijackthis!

                              a+
                              0
                              1. Arut
                                Ah! désolé ! je ne voulait pas te vexer... excuse moi ! Merci beaucoup pour ton aide ! voila le rapport de cleanzip :

                                Rapport clean par Malekal_morte - http://www.malekal.com
                                Script execute en mode sans echec 09/05/2007 a 22:21:36,82

                                Microsoft Windows XP [version 5.1.2600]

                                *** Suppression des fichiers dans C:

                                *** Suppression des fichiers dans C:\WINDOWS\
                                tentative de suppression de C:\WINDOWS\ALCXMNTR.EXE

                                *** Suppression des fichiers dans C:\WINDOWS\system32
                                tentative de suppression de C:\WINDOWS\system32\mcrh.tmp
                                tentative de suppression de C:\WINDOWS\system32\SpoonUninstall.exe
                                tentative de suppression de C:\WINDOWS\nsreg.dat

                                *** Suppression des fichiers dans C:\Program Files
                                tentative de suppression de "C:\Program Files\secure32.html"
                                tentative de suppression de "C:\Program Files\Viewpoint\"

                                *** Suppression des clefs du registre effectuee..
                                *** Fin du rapport !

                                le log de hijackthis :

                                Logfile of HijackThis v1.99.1
                                Scan saved at 22:32:24, on 09/05/2007
                                Platform: Windows XP SP2 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\csrss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                C:\windows\system\hpsysdrv.exe
                                C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                C:\WINDOWS\mHotkey.exe
                                C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                                C:\WINDOWS\SOUNDMAN.EXE
                                C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                C:\HP\KBD\KBD.EXE
                                C:\WINDOWS\system32\RUNDLL32.EXE
                                C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                                C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                                C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                C:\WINDOWS\system32\nvsvc32.exe
                                C:\Program Files\LClock\LClock.exe
                                C:\Program Files\Styler\Styler.exe
                                C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                C:\Program Files\PeerGuardian2\pg2.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\{34A62FE2-6316-4A33-A669-2D5F364F186B}\Blaero Start Orb.exe
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\Program Files\JPA\Madotate 3D\madotate.exe
                                C:\WINDOWS\system32\UAService7.exe
                                C:\Program Files\Internet Explorer\iexplore.exe
                                C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                C:\Program Files\eMule\emule.exe
                                C:\WINDOWS\system32\SearchIndexer.exe
                                C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                C:\WINDOWS\system32\wbem\wmiapsrv.exe
                                C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
                                C:\Program Files\TuneUp Utilities 2007\RegistryCleaner.exe
                                C:\Program Files\Mozilla Firefox\firefox.exe
                                C:\Program Files\Alwil Software\Avast4\setup\avast.setup
                                C:\WINDOWS\system32\SearchProtocolHost.exe
                                C:\WINDOWS\system32\SearchFilterHost.exe
                                C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                                O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                                O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                                O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                                O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                                O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                                O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                                O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                                O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                                O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                                O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                                O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                                O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                                O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                                O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                                O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                                O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                                O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                                O4 - Startup: Blaero Start Orb.lnk = C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
                                O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                                O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                                O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                                O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                                O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                                O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                                O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                                O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                                O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                                O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                                O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                                O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                                O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                                O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                                O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                                O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                                O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                                O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                                O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                                O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                                O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                                O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                                O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                                O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                                O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                                O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                                O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                                O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                                O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                                O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                                O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                                O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                0
                                1. did71 Contributeur sécurité
                                  re,

                                  Télécharge SmitfraudFix de S!Ri:

                                  http://siri.urz.free.fr/Fix/SmitfraudFix.zip

                                  Tu le dézippes sur le Bureau.

                                  * Tu ouvres SmitfraudFix, tu double cliques sur SmitfraudFix.cmd et tu choisis l’option 1
                                  Postes le rapport.

                                  a+
                                  0
                                  1. Arut
                                    SmitFraudFix v2.179

                                    Rapport fait à 8:30:03,87, 10/05/2007
                                    Executé à partir de C:\Documents and Settings\HP_Propri‚taire\Bureau\SmitfraudFix\SmitfraudFix
                                    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                    Le type du système de fichiers est NTFS
                                    Fix executé en mode normal

                                    »»»»»»»»»»»»»»»»»»»»»»»» Process

                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\csrss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                    C:\WINDOWS\system32\nvsvc32.exe
                                    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\UAService7.exe
                                    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                    C:\WINDOWS\system32\SearchIndexer.exe
                                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    C:\windows\system\hpsysdrv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    C:\WINDOWS\system32\wbem\wmiapsrv.exe
                                    C:\WINDOWS\system32\rundll32.exe
                                    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                    C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                    C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                    C:\WINDOWS\mHotkey.exe
                                    C:\WINDOWS\system32\SearchProtocolHost.exe
                                    C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                                    C:\WINDOWS\SOUNDMAN.EXE
                                    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    C:\HP\KBD\KBD.EXE
                                    C:\WINDOWS\system32\RUNDLL32.EXE
                                    C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                                    C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                                    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                                    C:\Program Files\Styler\Styler.exe
                                    C:\Program Files\PeerGuardian2\pg2.exe
                                    C:\WINDOWS\system32\ctfmon.exe
                                    C:\Program Files\JPA\Madotate 3D\madotate.exe
                                    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                    C:\Program Files\eMule\emule.exe
                                    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                    C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                    C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                                    C:\Program Files\MSN Messenger\usnsvc.exe
                                    C:\Program Files\Mozilla Firefox\firefox.exe
                                    C:\Program Files\LClock\lclock.exe
                                    C:\WINDOWS\system32\cmd.exe
                                    C:\WINDOWS\system32\wbem\wmiprvse.exe
                                    C:\WINDOWS\system32\SearchFilterHost.exe

                                    »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propri‚taire

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Propri‚taire\Application Data

                                    »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_PRO~1\Favoris

                                    »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                    »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                    »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                    "Source"="About:Home"
                                    "SubscribedURL"="About:Home"
                                    "FriendlyName"="Ma page d'accueil"

                                    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                    SrchSTS.exe by S!Ri
                                    Search SharedTaskScheduler's .dll

                                    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                    "AppInit_DLLs"=""

                                    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                                    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

                                    »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32

                                    »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                    Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Miniport d'ordonnancement de paquets
                                    DNS Server Search Order: 194.117.200.10
                                    DNS Server Search Order: 194.117.200.15

                                    HKLM\SYSTEM\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer=194.117.200.10,194.117.200.15
                                    HKLM\SYSTEM\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer=194.117.200.10,194.117.200.15
                                    HKLM\SYSTEM\CS3\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer=194.117.200.10,194.117.200.15
                                    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.74 85.255.112.167
                                    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.74 85.255.112.167
                                    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.116.74 85.255.112.167

                                    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                                    »»»»»»»»»»»»»»»»»»»»»»»» Fin
                                    0
                                    1. did71 Contributeur sécurité
                                      Bonjour,

                                      je vois que tu as AVG antispyware, fais un scan avec et poste le rapport

                                      poste aussi un nouveau rapport hijackthis!

                                      a+
                                      0
                                      1. Arut
                                        ok mais je fait le scan rapide ou complet ? parece que le complet me prendra une bonne après midi !

                                        Logfile of HijackThis v1.99.1
                                        Scan saved at 19:41:26, on 10/05/2007
                                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                                        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                        Running processes:
                                        C:\WINDOWS\System32\smss.exe
                                        C:\WINDOWS\system32\csrss.exe
                                        C:\WINDOWS\system32\winlogon.exe
                                        C:\WINDOWS\system32\services.exe
                                        C:\WINDOWS\system32\lsass.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                        C:\WINDOWS\System32\svchost.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\Explorer.EXE
                                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                        C:\WINDOWS\system32\spoolsv.exe
                                        C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                        C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                        C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                        C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                        C:\WINDOWS\system32\nvsvc32.exe
                                        C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\system32\UAService7.exe
                                        C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                        C:\WINDOWS\system32\SearchIndexer.exe
                                        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                        C:\windows\system\hpsysdrv.exe
                                        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                        C:\WINDOWS\system32\wbem\wmiapsrv.exe
                                        C:\WINDOWS\system32\rundll32.exe
                                        C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                        C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                        C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                        C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
                                        C:\WINDOWS\SOUNDMAN.EXE
                                        C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                                        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                        C:\HP\KBD\KBD.EXE
                                        C:\WINDOWS\system32\RUNDLL32.EXE
                                        C:\Program Files\Alt-Tab Thingy v3\attmain.exe
                                        C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
                                        C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
                                        C:\Program Files\Styler\Styler.exe
                                        C:\Program Files\PeerGuardian2\pg2.exe
                                        C:\WINDOWS\system32\ctfmon.exe
                                        C:\Program Files\JPA\Madotate 3D\madotate.exe
                                        C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                        C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                        C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE
                                        C:\Program Files\MSN Messenger\usnsvc.exe
                                        C:\Program Files\LClock\lclock.exe
                                        C:\Program Files\eMule\emule.exe
                                        C:\Program Files\Emule Speed Booster\Emule Speed Booster.exe
                                        C:\Program Files\Mozilla Thunderbird\thunderbird.exe
                                        C:\WINDOWS\system32\mspaint.exe
                                        C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
                                        C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

                                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://windowsxlive.net/
                                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
                                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
                                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                        O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
                                        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                        O2 - BHO: Browster BrwIEConnector - {908A31E8-2A6E-4736-8E8A-AAF00C4AE38F} - C:\Program Files\Browster\Browster.dll
                                        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
                                        O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
                                        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
                                        O3 - Toolbar: Browster - {2EF39867-654F-48b6-8F93-B4FC3E8C6844} - C:\Program Files\Browster\Browster.dll
                                        O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
                                        O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
                                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                        O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
                                        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                                        O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
                                        O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
                                        O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
                                        O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
                                        O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                                        O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
                                        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                                        O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Fichiers communs\Logitech\KhalShared\KHALMNPR.EXE"
                                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                        O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
                                        O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
                                        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                        O4 - HKLM\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                                        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                        O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
                                        O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
                                        O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
                                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                        O4 - HKCU\..\Run: [Alt-Tab Thingy] "C:\Program Files\Alt-Tab Thingy v3\attmain.exe"
                                        O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
                                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                        O4 - HKCU\..\Run: [madotate] C:\Program Files\JPA\Madotate 3D\madotate.exe
                                        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                        O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
                                        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                        O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                                        O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
                                        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                                        O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
                                        O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
                                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                                        O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                                        O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
                                        O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                                        O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
                                        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
                                        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                                        O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                                        O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                                        O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
                                        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
                                        O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                                        O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
                                        O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                                        O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
                                        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                                        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                                        O17 - HKLM\System\CCS\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                                        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                                        O17 - HKLM\System\CS1\Services\Tcpip\..\{352E6EEB-7EE3-46B3-B3AA-22B074AA34AF}: NameServer = 194.117.200.10,194.117.200.15
                                        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.74 85.255.112.167
                                        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                        O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                                        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                                        O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                                        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                                        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                                        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                                        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                                        O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
                                        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                        O23 - Service: DHCP-Verwaltung - Unknown owner - C:\Program Files\eMule\Incoming\TmSunrise No CD Crack\TmSunrise No CD Crack.exe (file missing)
                                        O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
                                        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                                        O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                                        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                        O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
                                        O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe
                                        O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                        O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                        O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
                                        O23 - Service: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - C:\Program Files\VirtualCamera\VCamSrv.exe (file missing)
                                        O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
                                        0
                                        • 1
                                        • 2

                                        Discussions similaires

                                        Problème avec "PUADIManager:Win32/OfferCore
                                        Knaki

                                        3 réponses
                                        PUADlManager:Win32/OfferCore
                                        tenmalade

                                        2 réponses
                                        PUADlManager:Win32/OfferCore
                                        bernardarrad

                                        3 réponses
                                        PUA:Win32/InstallCore detecté par windows sécurité
                                        thetib

                                        11 réponses
                                        Pb Windows 7, .EXE n'est pas app win32 valide
                                        Witeric

                                        15 réponses