[Résolu]winantispyware

lea38 · le 6 janvier 2007

Bonjour à tous, et HELP !!!!

Apparement je suis pas la seule a avoir des pb avec winantispyware2006 qui me harcele pour que je le télécharge + toutes ces autres fenetres qui s'ouvrent et ralentissent tout, + des mails bizzares sur ma messagerie, mon anti virus que je dois reactiver manuellement régulièrement.

J'ai bien peur que mon ordi soit deja bien infecté

Je sais pas quoi faire, si qq un pouvait m'aider à le tuer j'ai vu que certains avaient réussit a s'en débarasser mais ça a l'air super compliqué....

Modifié le 22 janvier 2007 par lea38

bruce lee · le 6 janvier 2007

bonjour lea38 et bienvenue sur zebulon

telecharge la version original de hijackthis http://www.merijn.org/files/hijackthis.zip

déconnecte toi du net et installe le et installe le sur ton bureau

lance le en cliquant sur Do a system scan and save a logfile a la fin du scan le bloc note va s'ouvrir tu fais un copier coller de tout son contenu.

Télécharge Blacklight (de F-Secure); clique sur "I ACCEPT" au bas de la page. Sauvegarde le sur ton Bureau.

Double-clique blbeta.exe et accepte la licence; clique Scan puis Next

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

Copie et colle le contenu de ce rapport dans ta prochaine réponse. NE PAS choisir l'option "rename ou cleaning" de suite : nous devons analyser le rapport, car des fichiers légitimes peuvent être présents, tel wbemtest.exe

lea38 · le 7 janvier 2007

Bonjour Bruce lee, et un grand merci de me répondre , j'ai fais ce que tu disais et je t'envoie les copies des deux rapports :

hijackthis :

Logfile of HijackThis v1.99.1

Scan saved at 12:24:36, on 07/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Apps\Powercinema\PCMService.exe

C:\apps\ABoard\ABoard.exe

C:\apps\ABoard\AOSD.exe

C:\Program Files\Lexmark 2300 Series\lxcgmon.exe

C:\Program Files\Lexmark 2300 Series\ezprint.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE

C:\Program Files\Logitech\ImageStudio\LogiTray.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Windows Defender\MSASCui.exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

C:\APPS\skype\phone\Skype.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\APPS\HIDSERVICE\HIDSERVICE.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGserv.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\PROGRA~1\INCRED~1\bin\IMApp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\lxcgcoms.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\WINZIP\winzip32.exe

D:\Documents and Settings\emily\Local Settings\Temp\wz6b4c\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.incredimail.com/french

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"

O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe

O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [lxcgmon.exe] "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"

O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2300 Series\ezprint.exe"

O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE

O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe

O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [jzdfutixvc] c:\windows\system32\jzdfutixvc.exe jzdfutixvc

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [skype] "C:\APPS\skype\phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [incrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm

O18 - Protocol: bw+0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: offline-8876480 - {DC044544-1A75-4DBD-BCD6-5927EE3B2021} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe

O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

O23 - Service: LXCGCustomerConnect - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGserv.exe

O23 - Service: lxcg_device - Unknown owner - C:\WINDOWS\system32\lxcgcoms.exe

O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

F-Secure

01/07/07 12:38:06 [info]: BlackLight Engine 1.0.55 initialized

01/07/07 12:38:06 [info]: OS: 5.1 build 2600 (Service Pack 2)

01/07/07 12:38:07 [Note]: 7019 4

01/07/07 12:38:07 [Note]: 7005 0

01/07/07 12:39:28 [Note]: 7006 0

01/07/07 12:39:28 [Note]: 7011 1540

01/07/07 12:39:28 [Note]: 7026 0

01/07/07 12:39:28 [Note]: 7024 3

01/07/07 12:39:28 [info]: Hidden process: C:\windows\system32\gdyjfqrxse.exe

01/07/07 12:39:31 [Note]: FSRAW library version 1.7.1021

01/07/07 12:41:28 [info]: Hidden file: c:\WINDOWS\system32\gdyjfqrxse_nav.dat

01/07/07 12:41:28 [Note]: 10002 1

01/07/07 12:41:28 [info]: Hidden file: c:\WINDOWS\system32\gdyjfqrxse.dat

01/07/07 12:41:28 [Note]: 10002 1

01/07/07 12:41:28 [info]: Hidden file: C:\windows\system32\gdyjfqrxse.exe

01/07/07 12:41:28 [Note]: 10002 1

01/07/07 12:41:28 [info]: Hidden file: c:\WINDOWS\system32\gdyjfqrxse_navps.dat

01/07/07 12:41:28 [Note]: 10002 1

01/07/07 12:42:11 [Note]: 2000 1012

Voilà, @ +

Et encore merci

bruce lee · le 7 janvier 2007

re

Si durant la procédure ci-dessous, il y a des étapes que tu n'as pas reussi a faire, merci de continuer la procédure jusqu'au bout et de les signaler dans ta prochaine reponse.

1/Télécharge puis installe http://www.ewido.net/en/download

Une fois AVG AS lancé, clique sur Mise à jour

Ferme le programme.

Télécharge Brute Force Uninstaller (de Merijn).

Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

ouvre le bloc note(demarrer\tous les programmes\accessoires\bloc notes)

copie ceci (sans le mot citation):

RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gdyjfqrxse
RegDelValue HKLM\Software\Microsoft\Windows\CurrentVersion\Run|gdyjfqrxse

RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|gdyjfqrxse

FileDelete %SYSDIR%\gdyjfqrxse_navup.dat

FileDelete %SYSDIR%\gdyjfqrxse_navps.dat

FileDelete %SYSDIR%\gdyjfqrxse_nav.dat

FileDelete %SYSDIR%\yotnkqacgh.dat

FileDelete %SYSDIR%\gdyjfqrxse.exe

-Enregistrez dans: C:\BFU

-Nom du fichier : aftermath.bfu (attention! l'extension doit bien etre .bfu et pas autre chose)

-Type du fichier : tous les fichiers

-cliquez sur Enregistrer

-quittez le Bloc Notes

2/Démarre en mode sans échec http://www.sosordi.net/Faq/Faq.2.html

3/lance hijackthis en cliquant sur do a scan system only et coche ces lignes:

O4 - HKLM\..\Run: [jzdfutixvc] c:\windows\system32\jzdfutixvc.exe jzdfutixvc

toutes les lignes 018 sauf les trois dernieres

Ferme toutes les fenêtres ouvertes sauf Hijackthis et clique sur fix checked

4/Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

Sous Scriptline to execute copie/colle cette ligne :

c:\bfu\aftermath.bfu

Clique sur Execute et laisse-le faire son travail.

Attendre que Complete script execution apparaîsse et clique sur OK.

Clique Exit pour fermer le programme BFU.

5/ Relance AVG AS puis choisis l'onglet Analyse

Puis l'onglet Paramètres

Sous la question Comment réagir ?, clique sur Actions recommandées et choisis Quarantaine

Reclique sur l'onglet Analyse puis réalise une Analyse complète du système

Si un fichier infecté est détecté en fin d'analyse

Clique sur Appliquer toutes les actions

Clique sur Enregistrer le rapport puis sur Enregistrer le rapport sous

Enregistre ce fichier texte sur ton bureau

6/Redémarre en mode normal

7/Poste le rapport d'AVG Anti spyware 7.5 ainsi qu'un nouveau log Hijackthis et enfin un nouveau rapport de blacklight

Bon courage, et si tu as la moindre question n'hésite surtout pas

@+

Modifié le 7 janvier 2007 par bruce lee

lea38 · le 11 janvier 2007

Salut Bruce lee

Ca y est je viens juste de faire toutes les manip', ça m'a occupé un moment...mais j'ai pas rencontré de problème particulier.

AVG m'a trouvé 18 fichiers infectés... Je ne me faisais donc pas des idées, par contre je sais pas comment j'ai fait pour les choper, emule peut être...; j'ai pourtant avast, kerio, et ad-aware mais a vrai dire j'y comprends rien si ça se trouve ils sont mal parametrés ? Peut tu m'éclairer ?

Bon pour l'instant je t'envoie les rapports, et je croise les doigts pour que tu sauve mon ordi.

@ +

---------------------------------------------------------

AVG Anti-Spyware - Rapport d'analyse

---------------------------------------------------------

+ Créé à: 20:40:53 11/01/2007

+ Résultat de l'analyse:

D:\Documents and Settings\emily\Cookies\emily@incredimailltd.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@adviva[1].txt -> TrackingCookie.Adviva : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@com[1].txt -> TrackingCookie.Com : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@banner.grandonline[2].txt -> TrackingCookie.Grandonline : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@grandonline[2].txt -> TrackingCookie.Grandonline : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@www.vegasred[1].txt -> TrackingCookie.Vegasred : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.

D:\Documents and Settings\emily\Cookies\emily@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.

Fin du rapport

Logfile of HijackThis v1.99.1

Scan saved at 20:52:33, on 11/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

C:\Apps\Powercinema\PCMService.exe

C:\apps\ABoard\ABoard.exe

C:\apps\ABoard\AOSD.exe

C:\Program Files\Lexmark 2300 Series\lxcgmon.exe

C:\Program Files\Lexmark 2300 Series\ezprint.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE

C:\Program Files\Logitech\ImageStudio\LogiTray.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\APPS\skype\phone\Skype.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\APPS\HIDSERVICE\HIDSERVICE.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGserv.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\PROGRA~1\INCRED~1\bin\IMApp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\lxcgcoms.exe

C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

D:\Documents and Settings\emily\Bureau\eradiquer win\HijackThis.exe