virus indetructible??!?!?!

Eric84 · le 25 octobre 2006

tu l'a fait en mode sans echec ?

coucou bel@tor

bien sur que je les faite en mode sans échec

bibi26 · le 25 octobre 2006

En mode normal, clique sur "Démarrer", sur "Exécuter" et copie-colle : net start "Schedule"

Clique sur "Ok", retourne en mode sans échec et démarre Look2Me-Destroyer

Eric84 · le 25 octobre 2006

En mode normal, clique sur "Démarrer", sur "Exécuter" et copie-colle : net start "Schedule"

Clique sur "Ok", retourne en mode sans échec et démarre Look2Me-Destroyer

Coucou

j'ai eu beau faire sa mais le même msg apparait et Look2Me-Destroyer ne démarre

pas plus ... est-ce normal?!

merci d'avance

Modifié le 25 octobre 2006 par Eric84

bibi26 · le 25 octobre 2006

Erreur de ma part, tu dois l'utiliser en mode normal, désolé

Eric84 · le 25 octobre 2006

Erreur de ma part, tu dois l'utiliser en mode normal, désolé

Coucou

voici les 2 raport:

Look2Me-Destroyer V1.0.12

Scanning for infected files.....

Scan started at 2006-10-25 16:52:02

Infected! C:\WINDOWS\system32\kt06l7ds1.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0017624.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0017625.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019669.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019869.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019872.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020123.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020128.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020133.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020137.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020166.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020191.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020234.dll

Infected! C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020243.dll

Infected! C:\WINDOWS\system32\dkconfig.dll

Infected! C:\WINDOWS\system32\h2l2lc3o1f.dll

Infected! C:\WINDOWS\system32\irnml5511.dll

Infected! C:\WINDOWS\system32\kqdlv1.dll

Infected! C:\WINDOWS\system32\kt06l7ds1.dll

Infected! C:\WINDOWS\system32\rumotepg.dll

Infected! C:\WINDOWS\system32\sglogcfg.dll

Infected! C:\WINDOWS\system32\guard.tmp

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\kt06l7ds1.dll

C:\WINDOWS\system32\kt06l7ds1.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0017624.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0017624.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0017625.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0017625.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019669.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019669.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019869.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019869.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019872.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP33\A0019872.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020123.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020123.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020128.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020128.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020133.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020133.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020137.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020137.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020166.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020166.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020191.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020191.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020234.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020234.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020243.dll

C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP38\A0020243.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\dkconfig.dll

C:\WINDOWS\system32\dkconfig.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\h2l2lc3o1f.dll

C:\WINDOWS\system32\h2l2lc3o1f.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\irnml5511.dll

C:\WINDOWS\system32\irnml5511.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\kqdlv1.dll

C:\WINDOWS\system32\kqdlv1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\kt06l7ds1.dll

C:\WINDOWS\system32\kt06l7ds1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\rumotepg.dll

C:\WINDOWS\system32\rumotepg.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\sglogcfg.dll

C:\WINDOWS\system32\sglogcfg.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\guard.tmp

C:\WINDOWS\system32\guard.tmp Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reinstall

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{38DEBAA9-0531-4C29-804F-DDF3CFC01766}"

HKCR\Clsid\{38DEBAA9-0531-4C29-804F-DDF3CFC01766}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{82D6A6C8-2E44-4702-B89D-2968717E5137}"

HKCR\Clsid\{82D6A6C8-2E44-4702-B89D-2968717E5137}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{20A3EAC0-0AEE-4013-97E2-9F7FA36CADD6}"

HKCR\Clsid\{20A3EAC0-0AEE-4013-97E2-9F7FA36CADD6}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{01BAC69C-3762-4687-B7C8-CEDC966FA115}"

HKCR\Clsid\{01BAC69C-3762-4687-B7C8-CEDC966FA115}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{6F0AD9DA-3C96-4B8A-8992-B8706D20869A}"

HKCR\Clsid\{6F0AD9DA-3C96-4B8A-8992-B8706D20869A}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{FD542DD0-F288-4AAC-A340-B65D2B48AC93}"

HKCR\Clsid\{FD542DD0-F288-4AAC-A340-B65D2B48AC93}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{B8C7BB43-506F-4778-9AE4-ABACFCA2965E}"

HKCR\Clsid\{B8C7BB43-506F-4778-9AE4-ABACFCA2965E}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7464B4E7-BA87-408E-AB5D-9CAF87EA921E}"

HKCR\Clsid\{7464B4E7-BA87-408E-AB5D-9CAF87EA921E}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5AF78F91-2128-41C8-9CA1-64B6FF722876}"

HKCR\Clsid\{5AF78F91-2128-41C8-9CA1-64B6FF722876}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A6673AED-6615-4B82-8EB9-8320138F93F2}"

HKCR\Clsid\{A6673AED-6615-4B82-8EB9-8320138F93F2}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7A27691B-D75B-44CA-9F51-97D8B38ACA5C}"

HKCR\Clsid\{7A27691B-D75B-44CA-9F51-97D8B38ACA5C}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administrateurs - Succeeded

Logfile of HijackThis v1.99.1

Scan saved at 17:01:05, on 2006-10-25

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\Program Files\Sygate\SPF\Smc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\wt\updater\wcmdmgr.exe

C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Crazy Browser\Crazy Browser.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe

C:\Documents and Settings\All Users\Documents\SETUP A GRAVER (attendre d'en avoir plein)\Logiciel de sécuriter\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.ca/ig/dell?hl=fr&client=dell-row&channel=ca&ibd=0060928

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.imesh.com/ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.ca.dell.com/content/default.as...;l=FR&s=gen

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.ca.dell.com/content/default.as...;l=FR&s=gen

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ca/ig/dell?hl=fr&client=dell-row&channel=ca&ibd=0060928

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ca/ig/dell?hl=fr&cli...amp;ibd=0060928

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\Smc.exe -startgui

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime

O4 - HKCU\..\Run: [TClockEx] C:\PROGRA~1\TClockEx\TCLOCKEX.EXE

O4 - Startup: wkcalrem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1161357769531

O17 - HKLM\System\CCS\Services\Tcpip\..\{6EDD0899-9C1A-4E49-8DD5-B6190C8DE0FB}: NameServer = 142.217.192.9,142.217.192.8

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll

O23 - Service: FireDaemon Service: binconf (binconf) - Unknown owner - C:\WINNT\system32\directx\asp\mech\FireDaemon.EXE (file missing)

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: FireDaemon Service: windll64 (windll64) - Unknown owner - C:\WINNT\system32\directx\asp\mech\FireDaemon.EXE (file missing)

esperon que sa sera positif

bibi26 · le 25 octobre 2006

Bonjour,

Refait le scan ewido et clique sur l'action "Quarantine" et pas "No actions".

Eric84 · le 27 octobre 2006

Coucou

sais fait il y a pus de virus du moin je croit...

est-ce que je doit faire autre chose?

merci d'avance..

Modifié le 27 octobre 2006 par Eric84

bibi26 · le 27 octobre 2006

Poster le rapport ewido et hijackthis pour voir si tout est bien partit

Eric84 · le 29 octobre 2006

allo

voici les deux rapport:

Logfile of HijackThis v1.99.1

Scan saved at 21:11:59, on 2006-10-28

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\Program Files\Sygate\SPF\Smc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\WINDOWS\wt\updater\wcmdmgr.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\rundll32.exe

C:\program files\topthemesxp\txp.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\winlogon.exe

C:\Documents and Settings\xERIC22x\Bureau\polaris se\Polarise SE.exe

C:\Program Files\Crazy Browser\Crazy Browser.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe

C:\Documents and Settings\All Users\Documents\SETUP A GRAVER (attendre d'en avoir plein)\Logiciel de sécuriter\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.ca/ig/dell?hl=fr&client=dell-row&channel=ca&ibd=0060928

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.imesh.com/ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.ca.dell.com/content/default.as...;l=FR&s=gen

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.ca.dell.com/content/default.as...;l=FR&s=gen

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ca/ig/dell?hl=fr&client=dell-row&channel=ca&ibd=0060928

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.ca/ig/dell?hl=fr&cli...amp;ibd=0060928

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {2F6F2245-3EFF-6CFE-83B4-C55117E3E950} - (no file)