mon pc rame

Question

bonjourj'ai téléchargé le logiciel hijackthis et j'ai fait un scan (voir ci dessous)est-ce quelqu'un peut m'aider a régler mes problèmesmerci beaucoup par avanceLogfile of HijackThis v1.99.1Scan saved at 16:59:24, on 20/12/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\Explorer.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exec:\progra~1\intern~1\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\WINDOWS\system32\94.tmpc:\docume~1\jean-b~1\applic~1
ewchi~1\Dentwavewindow.exec:\docume~1\jean-b~1\applic~1
ewchi~1\Dentwavewindow.exeC:\WINDOWS\System32\msiexec.exeC:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX09.063\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.psrvnonrufbefmlqtvmmo.net/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeWt5QKqMb/lsZIg4_W7nt2/.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.oreka.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/fr/fra/gen/default.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF2 - REG:system.ini: Shell=Explorer.exe smsse.exeF2 - REG:system.ini: UserInit=userinit.exe,xpjava.exeO1 - Hosts: 64.233.167.104 www.symantec.comO1 - Hosts: 64.233.167.104 www.sophos.comO1 - Hosts: 64.233.167.104 www.mcafee.comO1 - Hosts: 64.233.167.104 www.viruslist.comO1 - Hosts: 64.233.167.104 www.f-secure.comO1 - Hosts: 64.233.167.104 www.avp.comO1 - Hosts: 64.233.167.104 www.kaspersky.comO1 - Hosts: 64.233.167.104 www.networkassociates.comO1 - Hosts: 64.233.167.104 www.ca.comO1 - Hosts: 64.233.167.104 www.my-etrust.comO1 - Hosts: 64.233.167.104 www.nai.comO1 - Hosts: 64.233.167.104 www.trendmicro.comO1 - Hosts: 64.233.167.104 www.grisoft.comO1 - Hosts: 64.233.167.104 securityresponse.symantec.comO1 - Hosts: 64.233.167.104 symantec.comO1 - Hosts: 64.233.167.104 sophos.comO1 - Hosts: 64.233.167.104 mcafee.comO1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.comO1 - Hosts: 64.233.167.104 viruslist.comO1 - Hosts: 64.233.167.104 f-secure.comO1 - Hosts: 64.233.167.104 kaspersky.comO1 - Hosts: 64.233.167.104 kaspersky-labs.comO1 - Hosts: 64.233.167.104 avp.comO1 - Hosts: 64.233.167.104 networkassociates.comO1 - Hosts: 64.233.167.104 ca.comO1 - Hosts: 64.233.167.104 mast.mcafee.comO1 - Hosts: 64.233.167.104 my-etrust.comO1 - Hosts: 64.233.167.104 download.mcafee.comO1 - Hosts: 64.233.167.104 dispatch.mcafee.comO1 - Hosts: 64.233.167.104 secure.nai.comO1 - Hosts: 64.233.167.104 nai.comO1 - Hosts: 64.233.167.104 update.symantec.comO1 - Hosts: 64.233.167.104 updates.symantec.comO1 - Hosts: 64.233.167.104 us.mcafee.comO1 - Hosts: 64.233.167.104 liveupdate.symantec.comO1 - Hosts: 64.233.167.104 customer.symantec.comO1 - Hosts: 64.233.167.104 rads.mcafee.comO1 - Hosts: 64.233.167.104 trendmicro.comO1 - Hosts: 64.233.167.104 grisoft.comO1 - Hosts: 64.233.167.104 sandbox.norman.noO1 - Hosts: 64.233.167.104 www.pandasoftware.comO1 - Hosts: 64.233.167.104 uk.trendmicro-europe.comO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {77B37C7B-057E-F3B6-8E23-EA9EDC2D0160} - C:\DOCUME~1\JEAN-B~1\APPLIC~1\MULTIO~1\deafface.exeO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\Run: [runs] run.exeO4 - HKLM\..\Run: [ATIUpdater] atiupdxx.exeO4 - HKLM\..\Run: [HPWebSync] WebSyncSvc.exeO4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\94.tmpO4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\RunServices: [runs] run.exeO4 - HKLM\..\RunServices: [ATIUpdater] atiupdxx.exeO4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\Run: [runs] run.exeO4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [ball first] C:\DOCUME~1\JEAN-B~1\APPLIC~1\NEWCHI~1\city bike htm.exeO4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO4 - Global Startup: Picture Package Menu.lnk = ?O4 - Global Startup: Picture Package VCD Maker.lnk = ?O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO14 - IERESET.INF: START_PAGE_URL=http://www.oreka.comO15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet ZoneO16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exeO16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.tbcode.com/ist/softwares/v4.0/0006_regular.cabO16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exeO23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeO23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeO23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32pcsvc.exe

quick157 · Answer

Salut JB,

Hormis ton log HijackThis, tu devrais peut-être donner un minimum d'explication concernant le problème que tu rencontres. Ca aiderait certainement les membres qui sont aptes à déchiffrer le log.

Bien à toi

carlasne · Answer

bonjour jb
commence par sa
1 faite un scan en ligne http://www.bitdefender.fr/bd/site/products.php?p_id=24
et faite une analyse avec ses logiciel

2 télécharger ewido https://www.avg.com/en-ww/homepage
démo 14 jours et gratuit après sans protection active et mise a jours automatique

3 télécharger ad aware
Ad-aware

4 télécharger spybote
https://www.clubic.com/telecharger-fiche10965-spybot-search-and-destroy.html

5 faite les mise a jours et nettoyer votre pc

6 télécharger cleanup sur le site de M balltrap 34 (encore merci) voir démo section virus
http://www.florensac-chasse-trap.com/
ensuite a toi de choisir panda ou avaste ou risque de confit
@++ claude

carlasne · Answer

re jb et sa tu le fixe
O1 - Hosts: 64.233.167.104 www.symantec.com
O1 - Hosts: 64.233.167.104 www.sophos.com
O1 - Hosts: 64.233.167.104 www.mcafee.com
O1 - Hosts: 64.233.167.104 www.viruslist.com
O1 - Hosts: 64.233.167.104 www.f-secure.com
O1 - Hosts: 64.233.167.104 www.avp.com
O1 - Hosts: 64.233.167.104 www.kaspersky.com
O1 - Hosts: 64.233.167.104 www.networkassociates.com
O1 - Hosts: 64.233.167.104 www.ca.com
O1 - Hosts: 64.233.167.104 www.my-etrust.com
O1 - Hosts: 64.233.167.104 www.nai.com
O1 - Hosts: 64.233.167.104 www.trendmicro.com
O1 - Hosts: 64.233.167.104 www.grisoft.com
O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
O1 - Hosts: 64.233.167.104 symantec.com
O1 - Hosts: 64.233.167.104 sophos.com
O1 - Hosts: 64.233.167.104 mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
O1 - Hosts: 64.233.167.104 viruslist.com
O1 - Hosts: 64.233.167.104 f-secure.com
O1 - Hosts: 64.233.167.104 kaspersky.com
O1 - Hosts: 64.233.167.104 kaspersky-labs.com
O1 - Hosts: 64.233.167.104 avp.com
O1 - Hosts: 64.233.167.104 networkassociates.com
O1 - Hosts: 64.233.167.104 ca.com
O1 - Hosts: 64.233.167.104 mast.mcafee.com
O1 - Hosts: 64.233.167.104 my-etrust.com
O1 - Hosts: 64.233.167.104 download.mcafee.com
O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
O1 - Hosts: 64.233.167.104 secure.nai.com
O1 - Hosts: 64.233.167.104 nai.com
O1 - Hosts: 64.233.167.104 update.symantec.com
O1 - Hosts: 64.233.167.104 updates.symantec.com
O1 - Hosts: 64.233.167.104 us.mcafee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
O1 - Hosts: 64.233.167.104 customer.symantec.com
O1 - Hosts: 64.233.167.104 rads.mcafee.com
O1 - Hosts: 64.233.167.104 trendmicro.com
O1 - Hosts: 64.233.167.104 grisoft.com
O1 - Hosts: 64.233.167.104 sandbox.norman.no
O1 - Hosts: 64.233.167.104 www.pandasoftware.com
O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00000000-0000-0000-0000-000020040000} - http://207.234.185.217/ABoxInst_int12.exe
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) -
@ plus claude

jb10 · Answer

merci beaucoup carlasneje suis en train de faire ce que tu m'as recommandéje te tiendrais au courant

aranjuez31 · Answer

bsr2 antivirus se neutralisent et ne font pas leur bouloton ne répéte jamais assez : 1 seul antivirus, 1 seul pare-feu !fais en sorte de régler ce pb d'abord

jb10 · Answer

merci beaucoup pour votre aide.est-ce que ccleaner, clean up et spybot sont des antivirus ou des pare feu??voici mon nouveau rapportmerci encore pour votre aideLogfile of HijackThis v1.99.1Scan saved at 23:20:33, on 23/12/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\winupdates\winupdates.exeC:\WINDOWS\System32\lexpps.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\LimeWire\LimeWire.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exeC:\Program Files\AIM\aim.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\WINDOWS\explorer.exeC:\Program Files\WinRAR\WinRAR.exeC:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX00.468\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.cxdqwhlyntyrslnqnltbtcusx.com/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeXmhm/3C4D6bpIg4_W7nt2/.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO1 - Hosts: 64.233.167.104 www.symantec.comO1 - Hosts: 64.233.167.104 www.sophos.comO1 - Hosts: 64.233.167.104 www.mcafee.comO1 - Hosts: 64.233.167.104 www.viruslist.comO1 - Hosts: 64.233.167.104 www.f-secure.comO1 - Hosts: 64.233.167.104 www.avp.comO1 - Hosts: 64.233.167.104 www.kaspersky.comO1 - Hosts: 64.233.167.104 www.networkassociates.comO1 - Hosts: 64.233.167.104 www.ca.comO1 - Hosts: 64.233.167.104 www.my-etrust.comO1 - Hosts: 64.233.167.104 www.nai.comO1 - Hosts: 64.233.167.104 www.trendmicro.comO1 - Hosts: 64.233.167.104 www.grisoft.comO1 - Hosts: 64.233.167.104 securityresponse.symantec.comO1 - Hosts: 64.233.167.104 symantec.comO1 - Hosts: 64.233.167.104 sophos.comO1 - Hosts: 64.233.167.104 mcafee.comO1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.comO1 - Hosts: 64.233.167.104 viruslist.comO1 - Hosts: 64.233.167.104 f-secure.comO1 - Hosts: 64.233.167.104 kaspersky.comO1 - Hosts: 64.233.167.104 kaspersky-labs.comO1 - Hosts: 64.233.167.104 avp.comO1 - Hosts: 64.233.167.104 networkassociates.comO1 - Hosts: 64.233.167.104 ca.comO1 - Hosts: 64.233.167.104 mast.mcafee.comO1 - Hosts: 64.233.167.104 my-etrust.comO1 - Hosts: 64.233.167.104 download.mcafee.comO1 - Hosts: 64.233.167.104 dispatch.mcafee.comO1 - Hosts: 64.233.167.104 secure.nai.comO1 - Hosts: 64.233.167.104 nai.comO1 - Hosts: 64.233.167.104 update.symantec.comO1 - Hosts: 64.233.167.104 updates.symantec.comO1 - Hosts: 64.233.167.104 us.mcafee.comO1 - Hosts: 64.233.167.104 liveupdate.symantec.comO1 - Hosts: 64.233.167.104 customer.symantec.comO1 - Hosts: 64.233.167.104 rads.mcafee.comO1 - Hosts: 64.233.167.104 trendmicro.comO1 - Hosts: 64.233.167.104 grisoft.comO1 - Hosts: 64.233.167.104 sandbox.norman.noO1 - Hosts: 64.233.167.104 www.pandasoftware.comO1 - Hosts: 64.233.167.104 uk.trendmicro-europe.comO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\Run: [runs] run.exeO4 - HKLM\..\Run: [Services] C:\WINDOWS\system32\94.tmpO4 - HKLM\..\Run: [Printer Spooler] C:\WINDOWS\system32\9A.tmpO4 - HKLM\..\Run: [ltwob] C:\WINDOWS\msmbw.exeO4 - HKLM\..\Run: [serpe] C:\WINDOWS\System32\serbw.exeO4 - HKLM\..\Run: [avnort] C:\WINDOWS\msmbw.exeO4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /autoO4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\msmbw.exeO4 - HKLM\..\RunServices: [serpe] C:\WINDOWS\System32\serbw.exeO4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\msmbw.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\Run: [runs] run.exeO4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAjO4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startupO4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO14 - IERESET.INF: START_PAGE_URL=http://www.oreka.comO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} (CInstall Class) - http://adserver.sharewareonline.com/adserver/Install.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exeO23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeO23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeO23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32pcsvc.exe (file missing)

Utilisateur anonyme · Answer

Salut

Désolé d'avoir à te dire ca, mais ton pc est une usine à vers et trojans, installe un firewall d'urgence.
http://www.inoculer.com/firewall5.php3

Ensuite télécharge ceci et enregistre le sur ton bureau:
http://cjoint.com/?mymgm8Q8pC

Redemarre en mode sans echec:
Redemarre le pc, laisse passer l'écran du bios, puis tapote sur la touche F8 avant qu'apparaisse l'écran de chargement de windows.
Choisis le mode sans échec dans les options et valide avec entrée.

dezippe mymgm8Q8pC_Sflog.zip (clic droit dessus>extraire tout) puis double clic sur sflog.exe
une fois fais, redemarre le pc normalement et fait un scan av ici et poste le rapport:
http://www.bitdefender.fr

a+

quick157 · Answer

Salut jb,

Continue à suivre les conseils qui te sont donnés ci-dessus.

Pour info, ccleaner et cleanup sont des nettoyeurs alors que spybot est un antispyware (excellent logiciel d'ailleurs). Ce ne sont donc ni des antivirus ni des pare-feu.

Bien à toi

aranjuez31 · Answer

bsr
fixe les 016
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} (CInstall Class) - http://adserver.sharewareonline.com/adserver/Install.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180solutions/ie/bridge-c24.cab

aranjuez31 · Answer

re

fixe
O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\msmbw.exe
et aussi
O4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\msmbw.exe

et ce n'est pas fini
toutes ces 01 ne me plaisent pas
as-tu mis ces objets dans fichier host de toi-même ??

Utilisateur anonyme · Answer

salutC'est du à un ver, serflog A, qui se propage via msn et réseaux.http://www.symantec.com/region/fr/techsupp/avcenter/venc/data/fr-w32.serflog.a.htmla+

Utilisateur anonyme · Answer

salut

oui, (post 8), mais le ver empeche l'acces aux sites av (les 01), et de plus symantec à eu la bonne idée de mettre le mot fix dans le nom de son outil de désinfection, et le ver bloque l'execution de tout processus contenant les mots: fix, tool, removal...etc, lol
Avec de la chance peut-être en mode sans echec...
C'est un ver qui date, mais ca fait plusieurs log que je le vois réapparaitre, il reprend du service on dirait...

a+

jb10 · Answer

merci beucoup pour vos conseilsvoici mon nouvel hijackthisLogfile of HijackThis v1.99.1Scan saved at 12:24:09, on 31/12/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\SYSTEM32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXEC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXEC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exeC:\Program Files\Windows Media Player\wmplayer.exeC:\WINDOWS\System32\imapi.exeC:\Program Files\AIM\aim.exeC:\DOCUME~1\JEAN-B~1\LOCALS~1\Temp\Rar$EX00.094\HijackThis.exeC:\Program Files\Internet Explorer\IEXPLORE.EXER1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.cxdqwhlyntyrslnqnltbtcusx.com/HXECiVWaF3aiX0S0dgYd98t8chA5q/76Oradj5g4QeXmhm/3C4D6bpIg4_W7nt2/.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\Run: [runs] run.exeO4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /sO4 - HKLM\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKLM\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\Run: [runs] run.exeO4 - HKCU\..\Run: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\Run: [HPWebSync] WebSyncSvc.exeO4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAjO4 - HKCU\..\RunServices: [MSN Messenger] msnmsgr.exeO4 - HKCU\..\RunServices: [ATIUpdater] atiupdxx.exeO4 - HKCU\..\RunServices: [HPWebSync] WebSyncSvc.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO14 - IERESET.INF: START_PAGE_URL=http://www.oreka.comO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exeO23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeO23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeO23 - Service: Windows Remote Procedure Call Monitoring Service (rpcsvc) - Unknown owner - C:\WINDOWS\System32pcsvc.exe (file missing)

aranjuez31 · Answer

bjr

fixe ceciO4 - HKCU\..\Run: [SOProc_SoRefRegSoAlertWxLiteNnAj] rundll32 shell32.dll,ShellExec_RunDLL C:\PROGRA~1\SOFTWA~1\soproc.exe -pack SoRefRegSoAlertWxLiteNnAj

m.à.j de windows update: sp2

vire cette usine à spy qu'est messenger plus

as-tu appliqué les post 13 & 14 ? - aimerais connaître les résultats

Mon pc rame

14 réponses

Newsletters