[LOGICIEL] [Centralisation] .:::: Hijackthis ::::.

[nahtano]

Pas particulièrement, un contrôle de routine .... mais merci bien quand même

[zaltimbrank]

Bonjour, je poste mon rapport a la demande de noisette, merci pour ton aide...

Je pense que ce n'est pas grand chose mais c'est ennuyeux!

Lorsque que je veut ouvrir une page web sous Windows, un encadré s'affiche me disant:

"Windows ne trouve pas 'C:\Documents and settings\Zaltimbrank\Bureau\Créer un site\tuto-29-6-0-apprenez-a-creer-votre-site-web.html'. Vérifiez que vous avez entré le nom correctement et essayez à nouveau. Pour rechercher un fichier, cliquez sur le bouton Démarrer, puis sur Rechercher."

Mais la page s'ouvre quand même quelque secondes après, et l'encadré reste en arrière-plan derrière la page, il faut que je clique sur "ok" et il disparait.

Logfile of HijackThis v1.99.1

Scan saved at 22:58:26, on 25/02/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\windows\system32\nvsvc32.exe

C:\windows\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\windows\Explorer.EXE

C:\WINDOWS\vsnpstd3.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\windows\system32\WTLXPan.Exe

C:\Program Files\Saitek\Software\Profiler.exe

C:\Program Files\Saitek\Software\SaiMfd.exe

C:\windows\MMKeybd.exe

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\Wireless LAN Utility\SiWake.exe

C:\Program Files\Wireless LAN Utility\SISCFG.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\system32\NeroCheck.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

O4 - HKLM\..\Run: [igfxTray] C:\windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WTLXPan] WTLXPan.Exe

O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe

O4 - HKLM\..\Run: [saiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe

O4 - HKLM\..\Run: [DVD43] "C:\Program Files\DVD Region+CSS Free\DVDRegionFree.exe" /hidden

O4 - HKLM\..\Run: [Office Keyboard] C:\windows\MMKeybd.exe

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe

O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O17 - HKLM\System\CCS\Services\Tcpip\..\{D252C1E7-08A9-447F-A594-DC1C6F25910A}: NameServer = 212.27.54.252,212.27.53.252

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxdev.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe

[snooky]

Rien à signalé ...

Coche et fixe cette ligne :

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

Passe Clean 1.4 .

Quelle page d'accueil dans ton navigateur ?

[zaltimbrank]

Rien à signalé ...

Coche et fixe cette ligne :

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

Passe Clean 1.4 .

Quelle page d'accueil dans ton navigateur ?

Ma page d'accueil est google...

[zaltimbrank]

oups! en cours de nettoyage, une fenetre s'est affichée:

des fichiers nécessaires au fonctionnement de windows ont étés remplacés par des fichiers d'une version non reconnue;

Pour maintenir la stabilité du système, windows doit restaurer la version originale de ces fichiers.

insérez votre cd rom de Windows XP professionnel maintenant.

et j'ai le choix de recommencer/Annuler et en mettant Annuler il me dit:

Vous avez choisi de ne pas restaurer la version originale des fichiers. Ceci peut affecter la stabilité de Windows.

Voulez-vous garder ces versions de fichiers non reconnues?

Que doit-je faire? les garder ou mettre mon cd d'XP? (je suis en XP Pro SP2)

[manolele]

le rapport de sysclean:

/--------------------------------------------------------------\

| Trend Micro Sysclean Package |

| Copyright 2002, Trend Micro, Inc. |

| http://www.trendmicro.com |

\--------------------------------------------------------------/

2007-02-25, 23:38:05, Auto-clean mode specified.

2007-02-25, 23:38:05, Running scanner "C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\TSC.BIN"...

2007-02-25, 23:38:12, Scanner "C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\TSC.BIN" has finished running.

2007-02-25, 23:38:12, TSC Log:

2007-02-25, 23:39:09, An error occurred while scanning file "C:\WINDOWS\system32\config\system.LOG": Accès refusé.

2007-02-25, 23:39:09, An error occurred while scanning file "C:\WINDOWS\system32\config\software.LOG": Accès refusé.

2007-02-25, 23:39:09, An error occurred while scanning file "C:\WINDOWS\system32\config\default.LOG": Accès refusé.

2007-02-25, 23:39:09, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM.LOG": Accès refusé.

2007-02-25, 23:39:09, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY.LOG": Accès refusé.

2007-02-25, 23:39:10, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY": Accès refusé.

2007-02-25, 23:39:11, An error occurred while scanning file "C:\WINDOWS\system32\config\SOFTWARE": Accès refusé.

2007-02-25, 23:39:11, An error occurred while scanning file "C:\WINDOWS\system32\config\SYSTEM": Accès refusé.

2007-02-25, 23:39:11, An error occurred while scanning file "C:\WINDOWS\system32\config\DEFAULT": Accès refusé.

2007-02-25, 23:39:11, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM": Accès refusé.

2007-02-25, 23:40:28, An error occurred while scanning file "C:\WINDOWS\Temp\JET9FF9.tmp": Accès refusé.

2007-02-25, 23:40:28, An error occurred while scanning file "C:\WINDOWS\Temp\Perflib_Perfdata_7c0.dat": Accès refusé.

2007-02-25, 23:40:46, An error occurred while scanning file "C:\WINDOWS\SoftwareDistribution\EventCache\{4C35D1A0-9370-422E-96E6-A6A3C264241D}.bin": Accès refusé.

2007-02-25, 23:40:50, An error occurred while scanning file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb": Accès refusé.

2007-02-25, 23:40:50, An error occurred while scanning file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb": Accès refusé.

2007-02-25, 23:40:50, An error occurred while scanning file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log": Accès refusé.

2007-02-25, 23:41:36, An error occurred while scanning file "C:\Documents and Settings\NetworkService\ntuser.dat.LOG": Accès refusé.

2007-02-25, 23:41:36, An error occurred while scanning file "C:\Documents and Settings\NetworkService\NTUSER.DAT": Accès refusé.

2007-02-25, 23:41:36, An error occurred while scanning file "C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Accès refusé.

2007-02-25, 23:41:36, An error occurred while scanning file "C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Accès refusé.

2007-02-25, 23:41:37, An error occurred while scanning file "C:\Documents and Settings\LocalService\ntuser.dat.LOG": Accès refusé.

2007-02-25, 23:41:37, An error occurred while scanning file "C:\Documents and Settings\LocalService\NTUSER.DAT": Accès refusé.

2007-02-25, 23:41:37, An error occurred while scanning file "C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Accès refusé.

2007-02-25, 23:41:37, An error occurred while scanning file "C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Accès refusé.

2007-02-25, 23:41:37, An error occurred while scanning file "C:\Documents and Settings\poitou\ntuser.dat.LOG": Accès refusé.

2007-02-25, 23:41:37, An error occurred while scanning file "C:\Documents and Settings\poitou\NTUSER.DAT": Accès refusé.

2007-02-25, 23:41:39, An error occurred while scanning file "C:\Documents and Settings\poitou\Local Settings\Temp\~DFB230.tmp": Accès refusé.

2007-02-25, 23:41:40, An error occurred while scanning file "C:\Documents and Settings\poitou\Local Settings\Temp\~DFB236.tmp": Accès refusé.

2007-02-25, 23:41:43, An error occurred while scanning file "C:\Documents and Settings\poitou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Accès refusé.

2007-02-25, 23:41:43, An error occurred while scanning file "C:\Documents and Settings\poitou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Accès refusé.

2007-02-25, 23:48:15, Running scanner "C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN"...

2007-02-26, 00:01:28, Files Detected:

Copyright © 1990 - 2004 Trend Micro Inc.

Report Date : 2/25/2007 23:48:16

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 278 (158679 Patterns) (2007/02/19) (427805)

Command Line: C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro

C:\WINDOWS\system32\sitaomk.dll [Possible_Obfus]

C:\WINDOWS\system32\fsnvzjb.dll [Possible_Obfus]

C:\Documents and Settings\poitou\Local Settings\Application Data\sitaomk.dll [Possible_Obfus]

C:\Program Files\Hijackthis Version Française\backups\backup-20070223-212354-463.dll [Possible_Obfus]

50458 files have been read.

50458 files have been checked.

43395 files have been scanned.

87218 files have been scanned. (including files in archived)

4 files containing viruses.

Found 4 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/26/2007 00:01:27

---------*---------*---------*---------*---------*---------*---------*---------*

2007-02-26, 00:01:28, Files Clean:

Copyright © 1990 - 2004 Trend Micro Inc.

Report Date : 2/25/2007 23:48:16

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 278 (158679 Patterns) (2007/02/19) (427805)

Command Line: C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro

Can not Clean [ Possible_Obfus]( 1) from C:\WINDOWS\system32\sitaomk.dll

Can not Clean [ Possible_Obfus]( 1) from C:\WINDOWS\system32\fsnvzjb.dll

Can not Clean [ Possible_Obfus]( 1) from C:\Documents and Settings\poitou\Local Settings\Application Data\sitaomk.dll

Can not Clean [ Possible_Obfus]( 1) from C:\Program Files\Hijackthis Version Française\backups\backup-20070223-212354-463.dll

50458 files have been read.

50458 files have been checked.

43395 files have been scanned.

87218 files have been scanned. (including files in archived)

4 files containing viruses.

Found 4 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/26/2007 00:01:27 13 minutes 10 seconds (790.67 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2007-02-26, 00:01:28, Clean Fail:

Copyright © 1990 - 2004 Trend Micro Inc.

Report Date : 2/25/2007 23:48:16

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 278 (158679 Patterns) (2007/02/19) (427805)

Command Line: C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro

Can not Clean [ Possible_Obfus]( 1) from C:\WINDOWS\system32\sitaomk.dll

Can not Clean [ Possible_Obfus]( 1) from C:\WINDOWS\system32\fsnvzjb.dll

Can not Clean [ Possible_Obfus]( 1) from C:\Documents and Settings\poitou\Local Settings\Application Data\sitaomk.dll

Can not Clean [ Possible_Obfus]( 1) from C:\Program Files\Hijackthis Version Française\backups\backup-20070223-212354-463.dll

50458 files have been read.

50458 files have been checked.

43395 files have been scanned.

87218 files have been scanned. (including files in archived)

4 files containing viruses.

Found 4 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/26/2007 00:01:27 13 minutes 10 seconds (790.67 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2007-02-26, 00:01:28, Scanner "C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN" has finished running.

2007-02-26, 00:18:08, Running scanner "C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN"...

2007-02-26, 00:18:14, Files Detected:

Copyright © 1990 - 2004 Trend Micro Inc.

Report Date : 2/26/2007 00:18:09

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 278 (158679 Patterns) (2007/02/19) (427805)

Command Line: C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro

506 files have been read.

506 files have been checked.

418 files have been scanned.

419 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/26/2007 00:18:14

---------*---------*---------*---------*---------*---------*---------*---------*

2007-02-26, 00:18:14, Files Clean:

Copyright © 1990 - 2004 Trend Micro Inc.

Report Date : 2/26/2007 00:18:09

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 278 (158679 Patterns) (2007/02/19) (427805)

Command Line: C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro

506 files have been read.

506 files have been checked.

418 files have been scanned.

419 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/26/2007 00:18:14 5 seconds (4.95 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2007-02-26, 00:18:14, Clean Fail:

Copyright © 1990 - 2004 Trend Micro Inc.

Report Date : 2/26/2007 00:18:09

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 278 (158679 Patterns) (2007/02/19) (427805)

Command Line: C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro

506 files have been read.

506 files have been checked.

418 files have been scanned.

419 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/26/2007 00:18:14 5 seconds (4.95 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2007-02-26, 00:18:14, Scanner "C:\Documents and Settings\poitou\Bureau\securitePC\SysCleanTrendMicro\VSCANTM.BIN" has finished running.

__________________________________

[snooky]

@ zaltimbrank :

Annule , puis ne pas restaurer la version originale des fichiers .

[zaltimbrank]

@ zaltimbrank :

Annule , puis ne pas restaurer la version originale des fichiers .

ok, merci a toi...

[snooky]

@ manolele :

Démarre le pc en mode sans échec .

... VundoFix te trouve ces fichiers :

C:\windows\system32\ckwmkrsa.dll

C:\Windows\system32\ddabx.dll

C:\Windows\system32\nnnmljg.dll

C:\Windows\system32\ssipvpex.exe

C:\Windows\system32\ultxrjxd.dll

Il faut cliquer sur Remove pour les supprimer !

Cette manip a-t'elle fonctionnée ?

Poste un nouveau rapport Vundofix , après Nettoyage .

[Kristof2582]

resalut snooky

ca y est hosts est installer....

....et maintenant que faire?

[snooky]

Poste un nouveau rapport Hijackthis .

Tu rencontres quels problèmes ?

[Kristof2582]

Logfile of HijackThis v1.99.1

Scan saved at 05:12:23, on 24/02/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AOL\Active Virus Shield\avp.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\sm56hlpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\AOL\Active Virus Shield\avp.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\MessengerSkinner\MessengerSkinner.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [aol] "C:\Program Files\AOL\Active Virus Shield\avp.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase9602.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Active Virus Shield (AVP) - Unknown owner - C:\Program Files\AOL\Active Virus Shield\avp.exe" -r (file missing)

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

[empirehell]

Bonjour à tous !

Depuis quelques temps mon ordi a des petits bugs : il faut cliquer plusieurs fois sur l'îcone des logiciels pour qu'ils se lancent ou Nod32 refuse de se lancer au démarrage à moins que ce ne soir Kerio ... Bref, c'est un peu n'importe quoi.

Je n'ai rien installé de nouveau récemment à part la mise à jours du WGA de Bilou.

J'ai passé a-squarred, Nod32, Clean 1.4, smithfraudfix le tout en mode sans échec mais sans résultats ....

Voici le log

Logfile of HijackThis v1.99.1

Scan saved at 11:45:46, on 26/02/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

D:\Folding@Home\FAH504-Console.exe

D:\Folding@Home2\FAH504-Console.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

D:\Folding@Home2\FahCore_78.exe

C:\Program Files\Eset\nod32krn.exe

D:\Folding@Home\FahCore_78.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ESET\nod32kui.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: 1PlaNet ADSL.lnk = ?

O4 - Global Startup: NOD32 Control Center (2).lnk = C:\Program Files\ESET\nod32kui.exe

O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - http://creative.com/su/ocx/15015/CTSUEng.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - http://cdn.scan.onecare.live.com/resource/...lscbase9602.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://creative.com/su/ocx/15021/CTPID.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{5EDB58E1-84BC-4165-A84A-DFCB2A0444E5}: NameServer = 193.95.122.40 193.95.93.77

O17 - HKLM\System\CCS\Services\Tcpip\..\{A06028FC-7863-4910-BC50-F92DED82F4F1}: NameServer = 192.168.0.1

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\msgrapp.8.1.0178.00.dll

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\msgrapp.8.1.0178.00.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll

O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\msgrapp.8.1.0178.00.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

O23 - Service: FAH@D:+Folding@Home+FAH504-Console.exe - Stanford University - D:\Folding@Home\FAH504-Console.exe

O23 - Service: FAH@D:+Folding@Home2+FAH504-Console.exe - Stanford University - D:\Folding@Home2\FAH504-Console.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

Merci d'avance !

[snooky]

@ empirehell :

Et sans Kerio et Nod32 , ça roule bien ?

[Kristof2582]

mes soucis c'est deja ce virus : RiskTool.Win32.Reboot.f

et le fait que Active virus shield n' a pas l' air de fonctionner pourtant i y a ecrit "actif" j'ai esayé de le desinstaler mais impossible!!

[snooky]

Le fichier reboot est un fichier valide de Smitfraudfix .

Il est reconnu par Kaspersky comme le Not-Atvirus RiskTool.Win32.Reboot.f !

Place le en zone de confiance ou en exclusion dans ton antivirus .

D'autres problèmes ?

[Kristof2582]

ah ok

oui un autre le fait que je n' arrive pas a desinstaller avs j' aimerais le desinstaller pour le reinstaller ensuite parce qu' apparament il a ete mal installer

[snooky]

Décoche " Activer l'autodéfense "

Quitte AVS en barre de tâches .

Désinstalle via ajout/supp des programmes .

Passe ce remover : ' clique sur avp_remover.cmd )

http://snooky730.free.fr/Programmes/KisKav6Remove.zip

[Kristof2582]

c ce que j ai deja essayé de le faire mais quand je clic "suprimer" ca m' ouvre une fenetre qui me dit que je dois fermer l anti virus avant de proceder a la desinstalation alors que j avais desactiver la protection juste avant et que tout etait fermer c pour ca que je comprend rien

[snooky]

Ctrl + Alt + Supp ... kill les processus AVS .

[brian]

Bonjour,

Voilà je crois que je suis infecté du Virus Sasser, j'ai des problème avec service.exe je crois, et ya la fenêtre de reboot avec un temps de 60sec pour sauvegardé tous mes fichiers, c'est exécuté par AUTORITI SYSTEM.

J'ai essayé de supprimer Sasser mais en vain...

merci

Logfile of HijackThis v1.99.1

Scan saved at 12:45:26, on 26/02/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Inventel\Gateway\WLANCFG.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\BRY\Mes documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [scanRegistry] C:\W

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &Télécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Tout t&élécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddList.html

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

[snooky]

@brian :

Pour empêcher le reboot , tape dans Démarer / Exécuter :

shutdown -a

Coche et fixe cette ligne :

O4 - HKLM\..\Run: [scanRegistry] C:\W

Passe Ewido en mode sans échec et poste le rapport .

[brian]

@brian :

Pour empêcher le reboot , tape dans Démarer / Exécuter :

shutdown -a

Merci je connais cette méthode et je l'utilise.

Mais j'ai l'impression que ce virus ou un autre fait merdé mon pc, MSN et Internet.

Et d'autre log, avec un programme qui ne répond pas.

Comment enlever ce virus ?

merci

EDIT: Ok

[Kristof2582]

Ctrl + Alt + Supp ... kill les processus AVS .

ok merci

mais excuse moi j' ai pas compris ce que je devait faire après avoir cliquer Ctrl+Alt+Supp

[snooky]

Regarde s'il y a encore un processus de AVS actif ( avp.exe ... ) ... termine le avec le clic droit .